Zhang Yu and the HAFNIUM attacks: Why the U.S. is offering $10 million for his location

In early 2021, security researchers discovered that attackers had exploited zero-day vulnerabilities in Microsoft Exchange Server, the email and collaboration platform used by millions of organizations worldwide. The campaign, named HAFNIUM by security vendors, compromised tens of thousands of organizations, including U.S. government agencies, critical infrastructure operators and private companies. The attackers used the compromised servers as a foothold to steal data, install persistent backdoors and move laterally into corporate networks. Within weeks, Microsoft released patches, but the damage was done: multiple nation-state groups and financially motivated criminals subsequently weaponized the same vulnerabilities against unpatched systems.

The U.S. government and cybersecurity firms attributed HAFNIUM to Chinese state-sponsored operators. The technical and operational patterns, timing and targeting aligned with known Chinese cyber-espionage methodology. This wasn't ransomware for profit or opportunistic credential theft: it was methodical network reconnaissance aimed at stealing intellectual property, government secrets and strategic communications.

Zhang Yu is accused of being a member of a Chinese state-sponsored cyber unit responsible for developing and deploying the Exchange Server exploits. U.S. prosecutors filed charges against him, along with other members of the operation, in connection with the HAFNIUM campaign and related intrusions. The indictment details how the attackers developed the zero-day exploits, tested them in their own lab environment and then launched the global campaign to compromise vulnerable systems.

However, Zhang Yu has not been arrested. He remains at large, presumed to be in China, a country that does not extradite its nationals to the United States. This is the central reason for the $10 million reward: traditional law enforcement and diplomatic pressure have failed to bring him into U.S. custody, so the State Department is appealing to the public for actionable intelligence.

State-sponsored cyber operations present a unique challenge for law enforcement. Unlike traditional crimes, the perpetrators often operate from within the borders of their own government, which provides them protection from arrest. Attribution itself is forensic work: security researchers analyze malware code, infrastructure, timing, targeting patterns and tradecraft to make educated assessments about who is responsible. However, attribution is not the same as proof admissible in court. Indictment requires evidence sufficient to convince prosecutors that they can prove a case beyond reasonable doubt, even if the defendant cannot be physically brought to trial.

The U.S. government regularly indicts foreign hackers it knows it will never capture, as a way of formally documenting the crime, deterring future behavior through diplomatic and sanctions pressure, and keeping the case public. When conventional methods fail, reward programs become a tool of last resort: they signal seriousness, they create financial incentive for defection or betrayal, and they keep the case visible to the public and international partners who might have useful information.

The U.S. State Department runs several reward programs for information on terrorism, human rights violations and cybercrime. Rewards for cyber attackers are rare, which makes the Zhang Yu case noteworthy. The $10 million figure places it in the upper tier of cyber-related rewards. Theoretically, someone with access to Zhang Yu (a colleague, family member, rival within the government, a defector) could provide information that leads to his location or apprehension. In practice, state-sponsored personnel are typically monitored and compartmentalized, making such intelligence difficult to obtain.

Reward programs often generate tips, but the vast majority are not actionable. People may report rumors, provide outdated information or pursue the reward themselves without reliable evidence. Verified intelligence that actually leads to a capture is extraordinarily rare. The program's real value may lie in its deterrent effect: it signals to other state-sponsored hackers that their identities are known, that their governments will not shield them forever, and that Western law enforcement will pursue them for years or decades.

The Zhang Yu indictment and reward announcement show that the U.S. is willing to invest significant resources in attributing and prosecuting state-sponsored cyber operations, even when immediate arrest is impossible. This approach assumes that individuals within foreign governments may eventually become vulnerable to recruitment, blackmail, relocation or defection. It also sends a signal to allies and international partners that the U.S. takes cyber espionage seriously and will hold perpetrators accountable on the public record.

However, the strategy has limitations. If extradition is impossible and reward-based intelligence fails to emerge, the indictment becomes largely symbolic. The practical value is degraded: Zhang Yu is unlikely to face trial unless geopolitical circumstances change dramatically or he leaves China. Some cybersecurity experts argue that public attribution and indictment, while important for transparency and deterrence, are more effective when paired with sanctions, diplomatic pressure and disruption of the attacker's infrastructure and financial assets.

The Zhang Yu case illustrates why state-sponsored cyber operations are so difficult to stop. The perpetrators operate with government protection, enjoy sophisticated tools and resources, and can evade traditional law enforcement. Public indictments and reward programs are tools of last resort, signaling resolve and keeping pressure on attackers even when arrest is unlikely. For organizations, the lesson is clear: patch Microsoft Exchange servers and other critical software as soon as security updates are released, monitor for signs of compromise, and treat state-sponsored threats with the seriousness they deserve. The fact that HAFNIUM compromised systems years ago and related vulnerabilities were weaponized long after the initial campaign shows that attribution and prosecution move far more slowly than the pace of technological change in cyber operations.

If you operate Microsoft Exchange servers or manage a network that depends on them, check your systems for signs of the HAFNIUM indicators of compromise published by Microsoft and CISA (Cybersecurity and Infrastructure Security Agency). These indicators are freely available and will help you determine whether your organization was targeted or compromised.

Source: The Hacker News