A large trove of more than 500 sensitive technical documents posted online anonymously last week details one Chinese technology company's hacking operations, target lists and marketing materials for the Chinese government.
The majority of the operations appear to be focused on surveilling and harassing dissidents who publicly criticize the Chinese government, including on global social media platforms like X, formerly known as Twitter.
Target lists reveal victims from at least 14 governments from Pakistan to Australia, as well as academic institutions, pro-democracy organizations in places like Hong Kong, as well as the military alliance NATO. The company was also bidding for work to surveil the minority Uyghur population in Xinxiang, a broader Chinese government program that major global human rights' organizations around the world have heavily criticized. There are even pictures of custom devices used for spying, such as a recording device disguised as a power bank.
Cybersecurity researchers are still investigating different components of the leak, which was shared to the open source development website popular with programmers, called GitHub. However, experts from top U.S. cybersecurity companies including Google's Mandiant and Sentinel Labs have shared preliminary analysis of the contents of the leak, believing the documents to be authentic.
"We have every reason to believe this is the authentic data of a contractor supporting global and domestic cyber espionage operations out of China," said John Hultquist, the chief analyst for Mandiant Intelligence, a part of Google Cloud. "This leak is narrow, but it is deep. We rarely get such unfettered access to the inner workings of any intelligence operation. We are working hard to learn as much as we can and put it to good use."
The state-affiliated company, called i-Soon, is known to be one of many contractors and subcontractors who compete for opportunities to perform hacking and surveillance operations for different Chinese government agencies. The company is currently facing litigation from another Chinese contractor called Chengdu 404, a company that the U.S. government has publicly linked in court documents to hacking operations for the state. It appears i-Soon may have done subcontracting work with Chengdu 404.
In previous public materials, i-Soon has noted relationships with China's Ministry of Public Security, Ministry of State Security, and People's Liberation Army, among others. The company is publicly known for providing cybersecurity trainings around the country from its base in Shanghai.
But beyond what's publicly known, the details in the leak give internal insights into how an increasingly competitive marketplace for hacking operations within China functions. It's unclear if all the claims made in marketing materials included in the leak are true, such as the ability to break into devices manufactured by top U.S. companies like Apple and Microsoft. However, it's clear that the company is heavily invested in automating the ability to constantly monitor platforms like X and Facebook. Those platforms, unlike the popular WeChat, are not controlled by the Chinese government, making them popular with dissidents.
There are also details in the leak concerning internal pay scales and other bureaucratic details of contracts with the Chinese government. There is a note, or "ReadMe" document, included on the GitHub page where the leak is hosted, where the purported source of the leak claims to be dissatisfied with the company's policies. That could indicate the source being a disgruntled employee, though it's also possible the leak is the result of an intelligence operation or the work of a competitor.
While the contents of the leak are not entirely surprising, they're especially helpful to specialists and researchers, who continue to review the contents. In particular, individual documents can help researchers fact-check their assumptions about who was responsible for previously discovered breaches.
2024-12-25 10:311255 view
2024-12-25 09:37196 view
2024-12-25 09:37395 view
2024-12-25 09:072432 view
2024-12-25 08:572746 view
2024-12-25 08:41847 view
We check out a lot of things in a given year: Lots of movies, TV shows, and music. Today, we are hig
Wide receiver DeVonta Smith is out of the Philadelphia Eagles' Week 3 game against the New Orleans S
The WNBA playoffs begin Sunday with four first-round games. The Indiana Fever are returning to the p