CyberNew CyberNew
Threat Intelligence & APT The Record 1 week ago

US posts $10 million reward for accused Chinese ‘Hafnium’ hacker

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"US posts $10 million reward for accused Chinese ‘Hafnium’ hacker The State Department is offering $10 million for information on the whereabouts of Zhang Yu, a Chinese national accused of being a key figure in the Hafnium hacking campaign . U.S. officials claimed Zhang, who serves as director of Shanghai Firetech Information Science and Technology, worked on behalf of the Chinese government as..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Zhang Yu reward poster

US posts $10 million reward for accused Chinese ‘Hafnium’ hacker

The State Department is offering $10 million for information on the whereabouts of Zhang Yu, a Chinese national accused of being a key figure in the Hafnium hacking campaign. 

U.S. officials claimed Zhang, who serves as director of Shanghai Firetech Information Science and Technology, worked on behalf of the Chinese government as part of an effort that saw hackers breach thousands of computers and steal troves of documents and emails. 

Zhang allegedly worked alongside another Chinese official, Xu Zewei, and stole COVID-19 research from U.S.-based universities, immunologists and virologists. The State Department said Zhang violated the Computer Fraud and Abuse Act through his cyberattacks, which targeted at least one university and a law firm. 

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →