The $10 Million Poster: What a Wanted Chinese Hacker Reveals About How Beijing Outsources Espionage
Bottom line up front: on October 7, the U.S. State Department offered up to $10 million for information on Zhang Yu, a 44-year-old Chinese national accused of helping steal COVID-19 vaccine research from a Texas university and of joining the HAFNIUM campaign that compromised more than 12,700 American organizations. The reward will almost certainly never be paid. Zhang is believed to be in China, and Beijing does not extradite its own citizens. The poster has a different purpose. It raises the cost of being a contract hacker, and it hands practitioners a rare, documented look at how China runs intelligence collection through private companies. That is the real story, and it matters well beyond Texas.
What the Indictment Actually Says
The reward notice is short. The nine-count indictment behind it, returned in Houston in November 2023 and unsealed in July 2025, is not. It describes two phases of activity between February 2020 and June 2021, all of it allegedly directed by officers of the Shanghai State Security Bureau, a branch of China's Ministry of State Security.
The first phase was the pandemic. On or about February 19, 2020, co-defendant Xu Zewei told a bureau officer that he had broken into the network of a research university in the Southern District of Texas. Three days later, the officer directed him to specific email accounts belonging to virologists and immunologists working on COVID-19 vaccines, treatments, and testing. Xu later confirmed that he had acquired the contents of those mailboxes.
The second phase was HAFNIUM. Beginning in late 2020, the men allegedly exploited unpatched flaws in Microsoft Exchange Server, the email software used by much of the world. Microsoft disclosed the campaign in March 2021. The FBI says it targeted more than 60,000 U.S. entities and compromised more than 12,700. Victims named in the indictment include a second Texas university and a global law firm with a Washington office, whose mailboxes were searched for terms such as "MSS" and "HongKong."
Three facts deserve emphasis for accuracy:
Everything is alleged. Neither man has been convicted.
The 12,700 figure covers the whole HAFNIUM campaign, not the COVID-19 research theft.
China denies the allegations. In July 2025, embassy spokesman Liu Pengyu said China opposes all cybercrime and had neither the need nor the intention to steal vaccines.
"The poster names a corporate director, not an intelligence officer. That is the whole point."
The Contractor Model
Zhang is described as a director at Shanghai Firetech Information Science and Technology. Xu worked for Shanghai Powerock Network. The Justice Department calls these "enabling" companies, and the description is the most useful intelligence in the case.
China's security services do not rely only on uniformed officers at keyboards. They sit atop a market of private firms and freelancers who scan for vulnerable systems, break in, and sell what they find. An officer tasks the contractor, reviews the take, and asks for more. The contractor keeps the profit from whatever the state does not want. The arrangement gives Beijing three advantages: deniability, scale, and cheap talent that the government never has to train or pay full time.
It also produces collateral damage. Because contractors cast wide nets to find anything sellable, campaigns like HAFNIUM hit far more victims than any intelligence requirement would justify. Hospitals, city governments, and small businesses were compromised alongside the targets that mattered. The leftovers were often resold to criminals.
For practitioners, the lesson is that "state-sponsored" and "criminal" are no longer separate categories. The same operator may serve both in the same week.
Why the Poster Works Even When It Fails
Zhang will not be arrested in Shanghai. The State Department knows that. The reward is a pressure tool with three audiences.
Contract hackers who travel. Xu Zewei was arrested at Milan's airport on July 3, 2025, while on vacation. Italy extradited him to Houston on April 25, 2026. He has pleaded not guilty and says his phone was stolen in 2020 and that he is a victim of mistaken identity. Whatever the verdict, the message to every other contractor is simple: your name is on a list, and the list travels with you.
Insiders who might talk. The notice offers relocation as well as money. That is an invitation to defect, aimed at colleagues, business partners, and the officers who tasked them.
The public. A wanted poster is a perception-war instrument. It keeps the narrative that China steals science in front of allies, investors, and voters.
This is not a new tactic. Washington posted a similar $10 million reward in March 2024 for the APT31 group operating behind a Wuhan front company. The cumulative effect is a growing archive of named individuals who can never safely leave China.
"The reward will almost certainly never be paid. Its job is to make the next contractor think twice before booking a flight."
An Analyst's View: The Mailbox Is the Target
Strip away the geopolitics and the Texas case is a story about email. The pandemic phase did not involve exotic tools. An operator got inside a university network, and a handler told him which scientists' inboxes to read. The HAFNIUM phase exploited an email server that thousands of institutions had not patched.
Universities, research hospitals, and policy institutes are attractive precisely because they are open. Collaboration is their business model. That makes them soft entry points into government programs, pharmaceutical partners, and the inboxes of people who advise ministers. African institutions should pay particular attention. Nigerian and other African universities in joint research programs with Western partners inherit their partners' threat profile without inheriting their security budgets. A compromised account in Ibadan or Nairobi is a credible path into a laboratory in Houston.
Practical steps for the audiences OSRS serves:
Research institutions: Treat the email accounts of senior scientists and principal investigators as privileged assets. Enforce multi-factor authentication, monitor for unusual mailbox access, and patch Exchange and similar servers within days, not quarters.
Security agencies and policymakers: Build the sovereign capacity to attribute intrusions and name actors. Naming is cheap, and the Zhang poster shows it can shape adversary behavior over years.
Business leaders: Assume that any intrusion attributed to a "criminal" group may be feeding a state customer. Classify stolen data accordingly when assessing exposure.
Law enforcement: Watch travel. The arrests that stick happen in airports, not in Shanghai.
The Bottom Line
The $10 million reward for Zhang Yu is unlikely to produce an arrest. It will produce something else: a longer list of contract hackers who cannot travel, a clearer public record of how China's intelligence services outsource their work, and a reminder that the most valuable target in a world-class research institution is still an inbox. Organizations that understand the contractor model will defend better than those waiting for a uniformed adversary who may never appear.
OSRS can help. OGUN Security Research and Strategic Consulting provides intelligence-driven threat assessments, counterintelligence awareness training, research-security reviews for universities and laboratories, and strategic advisory services for government, law enforcement, and private-sector leaders. Contact us to schedule a briefing or a research-security assessment for your organization.
Enjoyed this article? Share it with a colleague who needs to see it. Stay informed by subscribing to our email list and following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
About the Author
Dr. Sunday Oludare Ogunlana is the Founder and CEO of OGUN Security Research and Strategic Consulting LLC, a Professor of Cybersecurity, a national security scholar, and a television commentator. He advises government, law enforcement, academic, and private-sector organizations on security strategy and serves on advisory bodies including the Global Alternative Agenda, the Council for African Security Affairs, and the African Security Forum.
Intelligence. Protection. Strategy. www.ogunsecurity.com
Comments