U.S. Rewards Program Names Zhang Yu in 2021 Exchange Zero-Day Campaign

The November 2023 indictment, unsealed July 2025, alleges Zhang supervised intrusions at two Texas universities and a Washington law firm, first targeting COVID-19 research then pivoting to unpatched Exchange servers. Xu Zewei, arrested in Milan and extradited April 2026, is accused of providing initial access; both men are linked to contractors Firetech and Powerock that U.S. prosecutors describe as cutouts for the Ministry of State Security. Court filings cite chat logs and tasking documents but no independent technical attribution tying specific packets to the named individuals has been released.

DOJ statements frame the operation as part of a broader pattern where MSS routes operations through private Shanghai firms to create plausible deniability; similar structures appear in earlier indictments against contractors supporting APT41 and Barium. Microsoft’s March 2021 disclosure identified HAFNIUM infrastructure and four zero-days including CVE-2021-26855 but stopped at country-level attribution, leaving the contractor layer to law-enforcement documents. The $10 million reward, active since January 2025 for foreign-directed critical-infrastructure intrusions, now carries a named target.

Operational effect is likely continued pressure on contractor networks rather than immediate arrest; Xu’s extradition demonstrates that foreign arrests remain feasible while Zhang remains in China. Expect additional sanctions designations against Firetech and Powerock plus further indictments naming mid-level operators whose communications appear in the same evidence set.