U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Microsoft Exchange Hacks
What Happened — The U.S. State Department announced a reward of up to $10 million for information that leads to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 HAFNIUM campaign that exploited Microsoft Exchange Server vulnerabilities.
Why It Matters for Trust & Control Assurance
- The HAFNIUM attacks leveraged previously unknown Exchange flaws, highlighting the need for continuous control‑mapping and evidence collection to prove timely patching and vulnerability management.
- A robust control‑assurance program can demonstrate to regulators and partners that you have documented processes for monitoring critical vendor products and for responding to emerging exploit activity.
Who Is Affected – Enterprises that run Microsoft Exchange (or any on‑premises email platform), spanning technology, financial services, healthcare, and government sectors.
Recommended Actions – Review your Exchange inventory, verify that all security updates released after the HAFNIUM disclosures are applied, and map your patch‑management controls to a common control framework to generate defensible audit evidence. Source: The Hacker News
Technical Notes – HAFNIUM used a chain of zero‑day exploits (CVE‑2021‑26855, CVE‑2021‑26857, CVE‑2021‑26858, CVE‑2021‑27065) to gain remote code execution on vulnerable Exchange servers, leading to credential theft and lateral movement. Source: [Microsoft Security Advisory]