US Offers Up to $10 Million for Information on Chinese Man Accused of Stealing COVID-19 Research

The U.S. State Department is offering a reward of up to $10 million for information on a Chinese national accused of working for Beijing’s intelligence services to steal COVID-19 research from American universities and scientists.

The department’s Rewards for Justice program is seeking information on Zhang Yu, a director of Shanghai Firetech Information Science and Technology Co., who allegedly conducted cyberespionage on behalf of the Chinese regime’s Ministry of State Security (MSS).

The FBI Cyber Division also publicized the reward on Oct. 7, asking for information about Zhang, his associates, or their malicious cyber activities.

Zhang remains at large. His co-defendant, Xu Zewei, was arrested in Italy in July 2025 and extradited to the United States on April 25, 2026, to face federal hacking charges in Houston.

US Universities, Scientists Targeted

According to a federal indictment, Zhang and Xu participated in hacking operations between February 2020 and June 2021 under the direction of officers from the Shanghai State Security Bureau, an arm of the MSS.

The defendants allegedly targeted universities, immunologists, and virologists conducting research into COVID-19 vaccines, treatments, and testing.

Prosecutors allege that the hackers stole several gigabytes of data from one American university. They also sought access to researchers’ email accounts to obtain sensitive information.

According to the indictment, a Shanghai state security officer supplied Xu with the usernames of five university employees, including scientists researching COVID-19, and instructed him to obtain their email contents. The defendants allegedly targeted some of the same researchers again.

In 2021, Zhang and Xu allegedly participated in another hacking campaign, publicly known as HAFNIUM, which exploited security vulnerabilities in Microsoft Exchange Server, software used to manage email communications.

Microsoft Exchange Server is widely used by organizations to manage email, making compromised systems potential gateways to confidential communications and other sensitive information.

The campaign compromised thousands of computers worldwide, including systems belonging to an American university and law firm, according to the State Department.

The Justice Department said in April the HAFNIUM operation compromised more than 12,700 U.S. organizations.

Federal prosecutors allege that Chinese intelligence officers relied on private technology companies and contractors to steal information while concealing the Chinese government’s involvement.

Xu, formerly a general manager at Shanghai Powerock Network Co., faces a nine-count federal indictment that includes wire fraud, unauthorized computer access, computer damage, and aggravated identity theft.

Xu denied the hacking allegations during extradition proceedings in Italy, claiming mistaken identity. On April 27, Chinese Foreign Ministry spokesman Lin Jian also opposed his extradition, accusing Washington of fabricating charges through political manipulation and urging Italy to reverse its decision.

Zhang, his representatives, or his employer have not issued any public response from to the U.S. charges as of publication time.

The Rewards for Justice program is accepting information about Zhang and his associates through its secure Tor-based reporting channel. The State Department says eligible informants may receive financial rewards and relocation assistance.