Reported by:
Cherry Meigh Timbol
News Content Editor
Published October 9, 2026
The U.S. Department of State is offering a reward of up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national accused of stealing COVID-19 research from American universities and participating in cyberattacks against U.S. computer systems.
The reward was announced through the State Department’s Rewards for Justice program. U.S. authorities allege that Zhang worked on behalf of China’s Ministry of State Security through its Shanghai State Security Bureau. Zhang remains at large.
COVID-19 Research Targeted
According to a federal indictment, Zhang and his alleged associate, Xu Zewei, conducted cyber intrusions between February 2020 and June 2021.
Prosecutors allege that the pair targeted American universities and scientists researching COVID-19 vaccines, treatments and testing. The operation allegedly involved unauthorized access to researchers’ email accounts and the theft of sensitive research information.
Authorities allege that officers of China’s Shanghai State Security Bureau directed the operation and received updates on the hackers’ activities.
Zhang Yu, a Chinese national accused of conducting cyberespionage against U.S. universities and COVID-19 researchers on behalf of Beijing’s intelligence services. The State Department is offering up to $10 million for information under its Rewards for Justice program. Courtesy of U.S. Department of State
Link to HAFNIUM Cyberattack Campaign
U.S. authorities also accuse Zhang and Xu of participating in the HAFNIUM hacking campaign, which exploited vulnerabilities in Microsoft Exchange Server in 2021.
The campaign compromised thousands of computers worldwide, including systems belonging to American organizations. The FBI said the operation targeted more than 60,000 U.S. entities and successfully compromised more than 12,700 organizations.
Microsoft Exchange Server is widely used by organizations to manage email communications. According to the indictment, the hackers exploited vulnerable systems to access email accounts and obtain information.
Co-Defendant Extradited to the United States
Xu Zewei was arrested in Italy in July 2025 at the request of U.S. authorities. He was extradited to the United States in April 2026 to face federal charges connected to the alleged hacking operations.
Zhang and Xu were named in a nine-count indictment unsealed in July 2025 in the U.S. District Court for the Southern District of Texas. Zhang has not been arrested, according to the State Department.
The $10 million reward seeks information leading to Zhang’s identification or location in connection with alleged malicious cyber activities against U.S. critical infrastructure. Information can be submitted through the State Department’s Rewards for Justice program.
The allegations against Zhang have not been proven in court.
