Chinese Engineer Xu Zewei Awaits Trial in HAFNIUM Case as U.S. Offers $10 Million Reward for Co-Defendant Zhang Yu
WASHINGTON — The U.S. Department of State's Rewards for Justice (RFJ) program announced on October 7 that it is offering a reward of up to $10 million for information leading to the identification or location of Zhang Yu, a co-defendant who remains at large in a federal hacking case. Zhang, 44, is a director at Shanghai Firetech Information Science and Technology Company, Ltd., according to the State Department. He is charged alongside Xu Zewei, a Chinese engineer who was extradited from Italy to the United States in April and is now in custody awaiting trial in Houston. The reward targets Zhang, not Xu, who is already in U.S. custody.
According to the State Department notice and Justice Department filings, prosecutors allege that Zhang and Xu acted at the behest of officers of the Shanghai State Security Bureau (SSSB), part of China's Ministry of State Security (MSS). At the time of the alleged intrusions, Xu was a general manager at Shanghai Powerock Network Co. Ltd. The Justice Department describes Powerock as one of many "enabling" companies that conducted hacking for the Chinese government. All of the charges are allegations that have not been tested or proven in court.
The alleged intrusions took place between February 2020 and June 2021. The indictment says that in early 2020, Xu, Zhang and others gained unauthorized access to COVID-19 research conducted by U.S.-based universities and leading immunologists and virologists. As one example, the indictment alleges that on or about February 19, 2020, Xu confirmed to an SSSB officer that he had compromised the network of a research university in the Southern District of Texas, and that on February 22 the officer directed him to target the mailboxes of virologists and immunologists working on COVID-19 research, after which Xu confirmed he had acquired the contents of the researchers' mailboxes. That account is the prosecution's allegation as set out in the indictment; it is not a guilty plea by Xu.
The indictment further alleges that beginning in late 2020, the two men exploited vulnerabilities in Microsoft Exchange Server as part of the mass intrusion campaign publicly known as HAFNIUM, which Microsoft now tracks as Silk Typhoon. The specific victims named in the case include another university in the Southern District of Texas and a law firm with offices worldwide, including in Washington, D.C. Prosecutors say the intruders installed web shells to maintain remote access and searched the law firm's mailboxes using terms including "Chinese sources," "MSS" and "HongKong." The FBI has said the broader HAFNIUM campaign targeted more than 60,000 U.S. entities and successfully victimized more than 12,700 U.S. organizations. Microsoft publicly disclosed the campaign in March 2021, and the United States and partner governments attributed HAFNIUM to China's MSS in July 2021.
The nine-count indictment charges conspiracy to commit wire fraud and two counts of wire fraud; conspiracy to cause damage to and obtain information by unauthorized access to protected computers, and to commit wire fraud and identity theft; two counts of obtaining information by unauthorized access to protected computers; two counts of intentional damage to a protected computer; and aggravated identity theft. According to the Justice Department, the counts carry maximum penalties ranging from two to 20 years in prison. The department notes that an indictment is merely an allegation and that all defendants are presumed innocent until proven guilty beyond a reasonable doubt.
The case then moved to Europe. The indictment was filed under seal in November 2023 and unsealed in July 2025. On July 3, 2025, Xu, then 33, arrived at Milan Malpensa Airport in Italy with his new wife; multiple news outlets reported the couple was traveling on their honeymoon, and Italian police arrested him at the airport at the request of the United States. According to Reuters, Xu's lawyer said at the time that his client was a victim of mistaken identity, and his family said he was an ordinary IT technician.
The extradition fight lasted about nine months. According to Italian media reports, the Milan Court of Appeal ruled the U.S. request admissible on January 27, 2026, Italy's Supreme Court rejected Xu's appeal on April 16, and Italy's Justice Ministry then issued the final authorization. Xu was transferred to U.S. custody on April 25, 2026, and made his initial appearance in federal court in Houston on April 27. He remains in custody, with a detention hearing that had been set for April 30 before U.S. Magistrate Judge Richard W. Bennett. Xu has denied the allegations through an attorney, according to reporting on the extradition.
"The extradition of Xu Zewei demonstrates the FBI's reach extends well beyond U.S. borders," Brett Leatherman, assistant director of the FBI's Cyber Division, said when the extradition was announced. "Xu will now answer for his alleged role in HAFNIUM, a group responsible for a vast intrusion campaign directed by China's Ministry of State Security that compromised more than 12,700 U.S. organizations. He is one of many contractors the Chinese government uses to obscure its hand in cyber operations, and others who do the same face the same risk." Assistant Attorney General for National Security John A. Eisenberg said the United States looks forward "to proving our case in court."
The October 7 reward announcement is the latest step in the case. The RFJ notice says the offer covers information on any person who, acting at the direction or under the control of a foreign government, takes part in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act, and that it specifically seeks information on Zhang's identification or location, with tips accepted through the program's Tor tip line. The Justice Department has also asked anyone with information about Zhang's whereabouts to contact the FBI at 1-800-CALL-FBI. The case is being investigated by the FBI's Houston Field Office and prosecuted by Assistant U.S. Attorney Mark McIntyre of the Southern District of Texas and Matthew Anzaldi of the National Security Division's National Security Cyber Section.
Since Xu's arrest, his family has kept an account on a Chinese social media platform documenting their wait. According to the family's social media posts, written under the theme "waiting for Bobo's dad to come home," the family has counted the days of his detention — one post marked "day 288 of waiting for Bobo's dad to come home" — and has repeatedly said they believe he is innocent. No trial date for Xu has been publicly announced, and Zhang remains at large.
Published by GSM · USA (original Chinese edition)
Photo: 美国国务院「正义悬赏」计划发布的悬赏海报：最高 1000 万美元征集同案被告 Zhang Yu 的身份或下落线索。图片来源：美国国务院（公共领域）。The U.S. Department of State Rewards for Justice poster offering up to $10 million for information on Zhang Yu. Image: U.S. Department of State (public domain).
