Rewards for Justice (RFJ) is offering a reward of up to $10 million for information 

leading to the identification or location of any person who, while acting at the 

direction or under the control of a foreign government, participates in malicious 

cyber activities against U.S. critical infrastructure in violation of the Computer Fraud 

and Abuse Act.

Under this reward offer, RFJ seeks information on Zhang Yu, a Chinese national and 

director at Shanghai Firetech Information Science and Technology Company, Ltd. 

working at the behest of the People’s Republic of China (PRC) Ministry of State 

Security (MSS) Shanghai State Security Bureau (SSSB). The MSS and SSSB are PRC 

intelligence services responsible for the country domestic counterintelligence, non-

military foreign intelligence, and aspects of the PRC’s political and domestic security.

Starting in early 2020, Zhang and his partner Xu Zewei, then a general manager at 

Shanghai Powerock Network Co. Ltd., gained unauthorized access to COVID-19 

research conducted by U.S.-based universities and leading immunologists and 

virologists to steal sensitive information.

The following year, Zhang and Xu exploited vulnerabilities in computers running 

Microsoft Exchange Server, a computer program involved in the storage and retrieval 

of e-mails. Those intrusions were part of mass intrusion campaign, publicly known 

as HAFNIUM, which compromised thousands of computers worldwide. Among the 

victims were a university and a law firm, both based in the United States. Xu was 

arrested by Italian law enforcement and extradited to the United States in April 2026. 

Zhang remains at large.

The PRC uses an extensive network of private companies and contractors in China 

to hack and steal information in a manner that obscures the PRC government’s 

involvement.

“正义奖赏”（Rewards for Justice，简称 RFJ）计划悬赏最高 1000 万

美元，以征集有助于确认或定位相关人员身份及下落的信息；

该类人员须是在外国政府的指示或控制下，违反《计算机欺诈与

滥用法》（Computer Fraud and Abuse Act），参与针对美国关键基础

设施的恶意网络活动。

在此悬赏计划下，RFJ 寻求有关张宇（Zhang Yu）的信息。张宇是

中国公民，也是上海火泰信息科技有限公司（Shanghai Firetech 

Information Science and Technology Company, Ltd.）的负责人，他

受中华人民共和国（PRC）国家安全部（MSS）上海市国家安全局

（SSSB）的指使开展活动。MSS 和 SSSB 属于中国的情報机构，

负责国内反间谍工作、非军事类境外情报工作，以及涉及政治与

国内安全的相关事务。

自 2020 年初起，张宇与其同伙徐泽伟（Xu Zewei，时任上海

博锐克网络科技有限公司总经理）未经授权访问了由美国高校及

顶尖免疫学家和病毒学家开展的 COVID-19 研究项目，企图窃取

敏感信息。

次年，张宇和徐泽伟利用了运行 Microsoft Exchange Server（一款

用于电子邮件存储与检索的计算机程序）的计算机系统漏洞。

这些入侵行动属于代号为“HAFNIUM”的大规模入侵行动的一部分，

该行动导致全球数千台计算机遭到入侵。受害者包括位于美国的

一所大学和一家律师事务所。徐泽伟于 2026 年 4 月被意大利执法

部门逮捕并引渡至美国，而张宇目前仍然在逃。

中国利用国内广泛的私营企业和承包商网络进行黑客攻击和信息

窃取，以此掩盖中国政府的参与。