China cyber leak reveals world of hackers for hire

AI-Soon staff also boasted in leaked chats that they secured access to telecom service providers in Pakistan, Kazakhstan, Mongolia, Thailand and Malaysia.

MASSIVE data leak from Chinese cybersecurity firm I-Soon has offered a rare glimpse into the inner workings of Beijing-linked hackers.

I-Soon is yet to confirm the leak is genuine and has not responded to a request for comment. As of Friday, the leaked data was removed from the online software repository GitHub, where it had been posted.

Analysts say the leak is a treasure-trove of intel into the dayto-day operations of China's hacking programme, which the FBI says is the biggest of any country.

From staff complaints about pay and office gossip to claims of hacking foreign governments, here are some of the key insights from the leaks where every day, workers at I-Soon were targeting big fish.

Government agencies from China’s neighbours, including Kyrgyzstan, Thailand, Cambodia, Mongolia and Vietnam, had websites or email servers compromised, the leak revealed.

There are long lists of targets, from British government departments to Thai ministries.

I-Soon staff also boasted in leaked chats that they secured access to telecom service providers in Pakistan, Kazakhstan, Mongolia, Thailand and Malaysia.

They named the government of India, a geopolitical rival of Beijing’s, as a key target for “infiltration”.

And they claimed to have secured back-end access to higher education institutions in Hong Kong and self-ruled Taiwan, which China claims as part of its territory.

But they also admitted to having lost access to some of their data seized from government agencies in Myanmar and South Korea.

Other targets are domestic, from China’s northwestern region of Xinjiang to Tibet and from illegal pornography to gambling rings.

Judging from the leaks, most of I-Soon’s customers were provincial or local police departments, as well as province-level state security agencies responsible for protecting the Communist Party from perceived threats to its rule.

The firm also offered clients help protecting their devices from hacking and securing their communications.

There were references to official corruption: in one chat, salesmen discussed selling the company’s products to police, and planned to give kickbacks to those involved in the sale.

There were also references to a client in Xinjiang, where Beijing is accused of grave human rights violations. But workers complained about the challenges of doing business in the tense region.

“Everyone thinks of Xinjiang like a nice big cake... but we have suffered too much there,” one said.

In their chats, I-Soon staffers told colleagues their main focuses were making Trojan horses — malware disguised as legitimate software that allows hackers access to private data — and building databases of personal information.

“At the moment, the Trojan horses are mainly customised for Beijing’s State Security Department.”

It also laid out how the firm’s hackers could access and take over a person’s computer remotely, allowing them to execute commands and monitor what they type, known as keylogging.

One service offered is a tool that allows clients to break into accounts on social media platform X, formerly Twitter, claiming to be able to obtain the phone number of a user and break into their private messages.

They also have a technique to bypass two-step authentication, a common login technique that offers an extra level of security to the account.

The leak also paints a less-thanflattering picture of the day-today goings-on at a mid-level Chinese cybersecurity firm.

Chats are full of complaints about office politics, lack of basic tech expertise, poor pay and management, and the challenges the company faced in securing clients.

Other screenshots showed arguments between an employee and a supervisor over salaries.

And in another leaked chat, a staffer complained to a colleague that their boss had bought a car worth over a million yuan (US$139,000) instead of giving their team a pay rise.

“Does the boss dream about being an emperor?”