An offer of up to $10 million
The U.S. Rewards for Justice program is seeking information on Zhang Yu under an offer of up to $10 million concerning foreign-government-directed malicious cyber activity against U.S. critical infrastructure. Its notice identifies Zhang as a director at Shanghai Firetech and alleges work on behalf of China’s Ministry of State Security’s Shanghai bureau.
The underlying activity predates this week
The notice connects Zhang and Xu Zewei to alleged theft of U.S. COVID-19 research beginning in 2020 and to the subsequent HAFNIUM campaign against Microsoft Exchange servers. It names a U.S. university and law firm among victims. The agency says Xu was extradited to the United States in April 2026 and Zhang remains at large. These government allegations should not be confused with a verdict or a newly discovered October intrusion.
Research and correspondence deserve their own priorities
For an academic institution or professional-services firm, our assessment is that the importance of a system cannot be measured only by how much downtime it would cause. A mailbox or shared research folder can hold information that remains sensitive after a project ends. Security planning should identify those collections, who owns them and which outside parties can access them. That exercise gives an MSP a business reason to prioritize particular systems rather than treating every server as interchangeable. It also lets leadership decide what must remain available during a containment operation.
Retain useful evidence, not everything indefinitely
An investigation may continue long after the immediate response team has dispersed. Institutions can prepare by documenting where incident records, relevant logs and vendor reports are stored and who can retrieve them. Retention should follow an approved business and investigative purpose, with access controls and a review date. This is different from leaving every old mailbox or export online forever. At a response exercise, ask a specific question: could the organization reconstruct who administered an affected system at the time? If ownership records disappear during staff changes or supplier transitions, later technical evidence becomes harder to interpret.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
