The U.S. Department of State's Bureau of International Narcotics and Law Enforcement Affairs has announced reward offers of up to $2 million each for information leading to the arrests or convictions of two Chinese nationals, Yin KeCheng and Zhou Shuai. These individuals are suspected malicious cyber actors residing in China.
Yin and Zhou have been linked to an advanced persistent threat group known as APT27. Private sector security researchers also recognize this group by various names, including "Threat Group 3390," "Bronze Union," "Emissary Panda," "Lucky Mouse," "Iron Tiger," "UTA0178," "UNC 5221," and "Silk Typhoon." Both individuals have been involved in cyber activities that benefit multiple Chinese entities financially.
An FBI investigation into APT27, which started around 2014, has led to two separate indictments announced by the Department of Justice. Yin faces charges for cybercrime activities from approximately 2013 to 2015. In a separate conspiracy related to computer network intrusions from about 2018 to 2020, both Yin and Zhou face charges together. They are accused of wire fraud, money laundering, aggravated identity theft, and violations under the Computer Fraud and Abuse Act.
These reward offers fall under the Transnational Organized Crime Rewards Program (TOCRP), authorized by the Secretary to support global law enforcement efforts against transnational crime. The announcement coincides with Treasury sanctions action by the Office of Foreign Assets Control (OFAC) against Zhou and his company Shanghai Heiying Information Technology. These measures form part of a comprehensive government effort against malicious cyber activities.
Individuals with relevant information can contact the FBI via email at yin_zhou_info@fbi.gov or reach out through U.S. embassies or consulates if located outside the United States. Those within the United States may also contact local FBI field offices.
"ALL IDENTITIES ARE KEPT STRICTLY CONFIDENTIAL." Government officials and employees are not eligible for rewards.
