US offers $10 million for Hafnium suspect Zhang Yu after his alleged partner's extradition

The nine-count indictment was unveiled last year. It covers intrusions that began in February 2020 ^[7]. Xu's arrest came four years and one month after the charged window closed ^[11], and his extradition took nine more months ^[12]. Zhang remains at large ^[6].

Prosecutors describe a chain of command. US officials say Zhang is director of Shanghai Firetech Information Science and Technology and worked on behalf of the Chinese government ^[2]. The two men allegedly reported back to supervising officers at the SSSB ^[9]. In one instance, according to prosecutors, Xu confirmed he "had compromised the network of a research university located in the Southern District of Texas" ^[9].

The charges cover two kinds of operation. One is targeted theft from researchers ^[3]. The other is what the indictment calls "the indiscriminate HAFNIUM computer intrusion campaign that compromised thousands of computers worldwide, including in the United States" ^[7].

Brett Leatherman, assistant director of the FBI's cyber division, gave the scale of that campaign last year. "Through HAFNIUM, the CCP targeted over 60,000 U.S. entities, successfully victimizing more than 12,700 in order to steal sensitive information," he said ^[10]. By his figures, about one targeted entity in five was compromised ^[13].

In the government's account, the same two contractors did both jobs: collection against specific targets, tasked by intelligence officers, and mass compromise ^[7][8]. That makes Hafnium, as charged, a sustained state-directed operation, not one opportunistic exploit run by freelancers. Every part of it is an allegation made by US officials and prosecutors ^[2][8].