U.S. offers $10 million for information on Zhang Yu

The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, whom U.S. authorities accuse of participating in cyber intrusions targeting COVID-19 researchers and Microsoft Exchange servers. Zhang remains at large, according to authorities, and the allegations against him have not been tested in court. The offer is being made through the department’s Rewards for Justice program. Its stated terms cover information about people who engage in malicious cyber activity against U.S. critical infrastructure while acting at the direction or under the control of a foreign government. The program identifies Zhang as a target of the appeal; the announcement does not establish his current whereabouts. A federal indictment charges Zhang and Xu Zewei in connection with alleged computer intrusions between February 2020 and June 2021. U.S. authorities say the pair first targeted U.S. universities and researchers working on COVID-19 vaccines, treatments and testing. They later allegedly exploited vulnerabilities in Microsoft Exchange Server as part of the campaign known as HAFNIUM.