[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faWYH5eaJmAJo7SQrtBtZohDrOmxXZ1sqm4Bjo9N-K8w":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"155c276b-5f0b-4fb9-8955-f1f959db126a","US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward","us-seeks-alleged-chinese-hafnium-hacker-with-10-million-reward-ff329b","Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026. The post US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward appeared first on SecurityWeek.","The US Department of State is offering a $10 million reward for information on Zhang Yu, a Chinese national accused of participating in the Hafnium campaign against Microsoft Exchange servers. Zhang is alleged to have worked for the Shanghai State Security Bureau and targeted COVID-19 research and other sensitive data. He is charged alongside Xu Zewei, who was extradited from Italy to the US.","US offers $10M reward for info on alleged Chinese hacker Zhang Yu linked to Hafnium campaign.","https:\u002F\u002Fwww.securityweek.com\u002Fus-seeks-alleged-chinese-hafnium-hacker-with-10-million-reward\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHafnium-hacker-reward.jpg","2026-10-08T12:46:21+00:00","2026-10-08T14:00:21.351042+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Zhang Yu","threat_actor",{"name":21,"type":19},"Xu Zewei",{"name":23,"type":19},"Hafnium",{"name":25,"type":19},"Silk Typhoon",{"name":27,"type":28},"Microsoft","vendor",{"name":30,"type":31},"Microsoft Exchange Server","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[27,30],{"controls":58,"vendors":144},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":110,"vendor_name":27,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":54,"name":117,"problem":118,"products":119},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[145],{"slug":110,"name":27,"logo_path":111,"roles":146},[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":164},"hafnium-exchange-attacks-highlight-critical-patching-failures","Hafnium Exchange Attacks Highlight Critical Patching Failures","The Hafnium campaign exploited unpatched vulnerabilities in Microsoft Exchange servers, enabling state-sponsored Chinese actors to exfiltrate sensitive data including COVID-19 research. The root cause was organizations failing to apply available security patches in a timely manner, leaving internet-facing email infrastructure exposed to known exploits. This attack demonstrates that nation-state actors actively target high-value, unpatched systems at scale, often within days of vulnerability disclosure. The long-term impact — stolen sensitive research and intelligence — underscores that delayed patching in critical environments can have national security consequences.",[153,154,155,156,157,158,159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST IR-4: Incident Handling","NIST RA-5: Vulnerability Monitoring and Scanning","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1505.003: Web Shell","ITIL Change Management: Emergency Change Procedures","CISA Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities",{}]