AMBENO (TOP) – The United States has offered a reward of up to $10 million for information on Zhang Yu, a Chinese national accused of carrying out cyberattacks on the orders of Beijing’s intelligence services. Zhang remains at large.
The Rewards for Justice (RFJ) program of the U.S. Department of State is offering the money for information leading to the identification or location of anyone who, while acting at the direction or under the control of a foreign government, takes part in malicious cyber activity against U.S. critical infrastructure. Such activity violates the Computer Fraud and Abuse Act. Under this offer, RFJ is seeking specific information on Zhang. The offer was published on 7 October.
Who is Zhang Yu
RFJ describes Zhang as a director at Shanghai Firetech Information Science and Technology Company, Ltd. RFJ says he worked at the request of the Shanghai State Security Bureau (SSSB), part of the Ministry of State Security (MSS) of the People’s Republic of China (PRC). The MSS and SSSB are PRC intelligence services responsible for domestic counterintelligence, non-military foreign intelligence, and aspects of the PRC’s political and domestic security.
Alleged attacks on COVID-19 research and Microsoft servers
According to RFJ, in early 2020 Zhang and his partner Xu Zewei, then a general manager at Shanghai Powerock Network Co. Ltd., gained unauthorized access to COVID-19 research by U.S. universities and leading immunologists and virologists in order to steal sensitive information.
The following year, the two allegedly exploited vulnerabilities in computers running Microsoft Exchange Server, a program used to store and retrieve emails. The intrusions were part of a major campaign publicly known as HAFNIUM, which compromised thousands of computers worldwide. Victims included a university and a law firm, both in the United States.
Microsoft publicly disclosed the HAFNIUM attacks in March 2021 and now tracks the actor as Silk Typhoon. The FBI has said the campaign compromised more than 12,700 U.S. organizations.
One suspect in custody, the other at large
Zhang and Xu were charged in a nine-count indictment unsealed in July 2025, days after Italian police arrested Xu in Milan at the request of the United States. Xu was extradited to the U.S. in April 2026 and has since appeared in federal court in Houston. Zhang remains at large. The charges against him have not been tested in court.
Private companies as cover
RFJ says the PRC uses an extensive network of private companies and contractors in China to hack and steal information in a way that hides the government’s involvement. RFJ has paid more than $250 million to over 125 people since 1984.
Why this matters for Timor-Leste
The RFJ notice does not mention Timor-Leste, and there is no evidence that Zhang Yu or the HAFNIUM campaign is linked to the country. Even so, the case illustrates cyber threats that small states also face, as governments take steps to strengthen their digital defenses.
In March 2026, the Interministerial Working Group on Cybersecurity, chaired by Minister of the Presidency of the Council of Ministers Agio Pereira, met in Dili to review proposals and advance preparation of a legislative package to strengthen the cybersecurity legal framework. The group also includes the Minister of Transport and Communications, the Minister of Justice, and the Director-General of the National Strategic Intelligence Service.
In August 2026, Timor-Leste approved the Integrated National Plan 2026–2031 to combat online scam networks, organized cybercrime and human trafficking. Interior Minister Francisco da Costa Guterres proposed the plan, which reflects concern for national security, economic stability, digital sovereignty and the financial system. On 23 July, the security think tank Fundasaun Mahein warned that recent arrests signaled a new phase of transnational organized crime in Timor-Leste.
The threat also touches Oe-Cusse Ambeno. In September 2025, the United Nations Office on Drugs and Crime (UNODC) warned that the Special Administrative Region of Oecusse-Ambeno appeared to have been targeted by transnational organized crime groups through “criminal foreign direct investment.”
At the same time, reliance on the internet is growing. Internet penetration in Timor-Leste has risen considerably since 2021, when it stood at only 35%, and cybersecurity is becoming more important as the digital economy grows.
