192. Return to the leak that unmasked China’s hackers-for-hire

Summary

Click Here Podcast Episode 192: Return to the Leak that Unmasked China’s Hackers-for-Hire

Host: Dina Temple-Raston
Produced by: Recorded Future News
Release Date: December 17, 2024

---

1. Introduction to the Isoon Leak

In Episode 192 of Click Here, Dina Temple-Raston revisits a pivotal story from the podcast's archives that sheds light on the intricate relationship between Chinese cybersecurity firms and the government. The episode centers around the significant leak of internal documents from Isoon, a prominent Chinese cybersecurity company, which unveiled the structured and corporatized nature of China's hackers-for-hire network.

Dina Temple-Raston [00:14]:
"Earlier this month, the US sanctioned a Chinese cybersecurity company called Sichuan Silence and charged one of its employees with compromising thousands of firewalls. This ties back to our earlier story about a huge leak of internal documents from Isoon, revealing China's formalized hackers-for-hire network."

---

2. The Surprise of Mei Danowski

Mei Danowski, co-founder of the Substack newsletter nattothoughts and a specialist in China's cybersecurity landscape, becomes a central figure in understanding the impact of the Isoon leak.

Mei Danowski [02:34]:
"It was the long weekend, so I didn't really check a lot, you know, my emails, my chat and stuff."

While enjoying a rare break with her family, Mei discovers a surge of traffic on her blog, signaling widespread attention to her previous coverage on Isoon.

Mei Danowski [02:56]:
"And then I saw people was reading all my Nano Thoughts, the one I wrote about ISO. I was like, what?"

---

3. Unveiling Isoon’s Government Ties

The leaked documents from Isoon provided undeniable evidence of the company's collaboration with Chinese government agencies. This revelation was a goldmine for researchers like Mei, who had long suspected but lacked concrete proof of such partnerships.

Mei Danowski [03:47]:
"It's huge. I was just so surprised to see the amount of the information came out."

Previously, it was believed that Chinese cyberattacks were fueled by Guanxi—connections and relationships. However, the Isoon leak revealed a much more structured and industrial approach.

Dina Temple-Raston [04:38]:
"The leaked papers included major contracts with government agencies that had clearly been paying Isoon to build hacking tools and surveillance programs."

---

4. The Evolution of China's Cyber Industrial Complex

The episode delves into how companies like Isoon transitioned from grassroots hacker groups to sophisticated cybersecurity firms collaborating directly with the government.

Mei Danowski [08:02]:
"You can see it's a route because all these hackers later realized you have a patriotic sentiment. That's a good thing. But the thing is they were thinking about their future, how they can grow in this big environment as everybody was."

Isoon's strategic filing of patents for aggressive cyber tools underscores their evolution into a mature industry.

Dina Temple-Raston [08:23]:
"Isoon filed for patents for pretty aggressive techie things. They seemed to be developing the kinds of tools that could help launch cyber attacks."

---

5. The Chengdu 404 Lawsuit and Further Revelations

An ostensibly routine intellectual property lawsuit between Isoon and Chengdu 404 exposed deeper government ties, as Chengdu 404 was revealed to be a front for the Chinese Ministry of State Security.

Dina Temple-Raston [09:30]:
"To the uninitiated, this court filing looked like your average intellectual property dispute. But to insiders like Mei, the case was a revelation."

The U.S. Department of Justice had previously indicted Chengdu 404 employees for hacking on behalf of the Chinese government.

Michael Horka [10:20]:
"We have unsealed three indictments that collectively charge five Chinese nationals with computer hacking."

---

6. Insights from Isoon's Internal Communications

The leaked documents included chat logs and contract details that illustrated the competitive and collaborative nature of China's cybersecurity firms.

Mei Danowski [11:37]:
"There's interesting conversations in the leaked document... They often mentioned saying, oh, do you know, so and so. And this company sounds like they got a big contract with the Public Security Bureau. Could we tag along?"

These interactions revealed a network of "drinking buddies" who were both collaborators and competitors, striving to secure lucrative government contracts.

Dina Temple-Raston [12:10]:
"The leaked documents provide a laundry list of pilfered information... It also shows employees of Isoon actually thinking through their plans for future hacks."

---

7. The Legacy of Shen Wei Guang and Information Warfare

The episode chronicles the contributions of Shen Wei Guang, a dismissed People's Liberation Army (PLA) officer who is considered the father of China's information warfare doctrine.

Mei Danowski [15:20]:
"He was computer illiterate. He didn't really know how to use a laptop, a computer."

Despite his lack of technical prowess, Shen's foresight in predicting the future of warfare shifted Chinese military strategy towards information and cyber domains.

Dina Temple-Raston [16:08]:
"He wrote a book in 1985. Future wars, Shen said, would be fought with information."

---

8. China's Advancements and U.S. Countermeasures

Under President Xi Jinping, China intensified its cyber capabilities, shifting from discovering and disclosing vulnerabilities to hoarding zero-day exploits for offensive use.

Michael Horka [18:42]:
"They don't use a whole lot of custom tooling... They'll use things that the typical network administrators often use for remote management of servers."

This strategy made Chinese cyberattacks more sophisticated and harder to detect.

Volt Typhoon – An Escalating Threat:
The state hacking group Volt Typhoon emerged as a particularly aggressive entity, targeting critical infrastructure such as water and electric utilities, transportation, and maritime sectors.

Michael Horka [19:24]:
"Your water utilities, electric utilities, transportation, maritime, stuff like that."

In response, the Biden administration has been pushing for not only defensive measures but also contingency plans to mitigate the impact of potential breaches.

Ann Neuberger [20:04]:
"Different sectors are at different places of maturity."

---

9. Diplomatic Efforts and the Search for Norms

Ann Neuberger, the Biden administration's Deputy National Security Advisor for Cyber and Emerging Technology, highlighted ongoing high-level discussions with China to establish agreed-upon norms for information warfare.

Ann Neuberger [21:13]:
"To discuss rules of the road."

However, she was cautious about revealing specific outcomes or concessions from these discussions.

---

10. The Unique Chinese Approach to Hacking-for-Hire

Unlike Russia or Iran, which rely on cyber gangs for their operations, China has cultivated a privatized yet state-controlled cybersecurity industry. This model ensures a balance between control and deniability, allowing the government to maintain plausible deniability while leveraging private companies for cyber operations.

Mei Danowski [22:09]:
"Their goal to become a superpower is on par with United States. Then the United States do have offensive capability. That's well known, right?"

Dina Temple-Raston [22:31]:
"The Isoon papers suggest that China has developed a kind of hacking with Chinese characteristics. They've chosen something they're good at, running a business, so they've opted to recruit private industry instead of private gangs."

---

11. Conclusion: The Future of Cyber Warfare

The episode underscores the maturation of China's cyber capabilities and the sophisticated integration of private companies into national cyber strategies. This evolution presents significant challenges for global cybersecurity, necessitating coordinated international responses and robust defensive mechanisms.

Dina Temple-Raston [23:24]:
"Using outsiders to help you hack isn't a Chinese invention. Russian cyber gangs have been targeting Moscow's adversaries for years. Iranian hacktivists do too."

The structured and corporatized approach of China's hackers-for-hire network marks a distinctive and formidable presence in the global cyber landscape, highlighting the need for continued vigilance and innovation in cybersecurity defenses.

---

Notable Quotes with Timestamps

• Dina Temple-Raston [02:34]:
  "It was the long weekend, so I didn't really check a lot, you know, my emails, my chat and stuff."

• Mei Danowski [03:47]:
  "It's huge. I was just so surprised to see the amount of the information came out."

• Dina Temple-Raston [04:38]:
  "The leaked papers included major contracts with government agencies that had clearly been paying Isoon to build hacking tools and surveillance programs."

• Michael Horka [18:42]:
  "They don't use a whole lot of custom tooling... They'll use things that the typical network administrators often use for remote management of servers."

• Ann Neuberger [21:13]:
  "To discuss rules of the road."

---

Production Credits

• Produced by: Sean Powers and Dina Temple-Raston
• Edited by: Karen Duffin
• Fact-Checked by: Darren Ancrum
• Original Music by: Ben Levinston
• Staff Writer: Lucas Riley
• Illustrator: Megan Gough

Click Here is a production of Recorded Future News, dedicated to unraveling the true stories behind the digital world's creation and disruption.

---

For more insights into cybersecurity news and policies, consider subscribing to Cyber Daily from Recorded Future News.

Transcript

[Dina Temple Raston]

From Recorded Future News and prx, this is Click Here.

Hey, it's Dina. The Click Here team is taking a break from producing brand new episodes in December so we can work on some great stories we'd want to bring you in 2025. In the meantime, we wanted to share an episode from our archives that we think will help explain this thing that happened. Earlier this month, the US sanctioned a Chinese cybersecurity company called Sichuan Silence and charged one of its employees with compromising thousands of firewalls. Now, all of this might ring a bell for our regular listeners because earlier this year we did a story about a huge leak of internal documents from from a Chinese cybersecurity company called isoon. And it turns out that leak pulled back the curtain for the first time on the secret world of China's hacker for hire network. Instead of using cyber criminals to hack adversaries as Russia is thought to do, China has formalized and corporatized it. And one of the companies listed as working with Isoon on Chinese government hacking projects, none other than Sichuan Silence, the company the US just sanctioned. So today, a return to the Isoon paper story. Take a listen.

[Mei Danowski]

Click here.

[Dina Temple Raston]

A few years ago, Mae Danowski co founded a substack called nattothoughts. She's a threat intelligence analyst who specializes in China's cybersecurity and she has a strong and loyal following. But nothing crazy. That is until this past President's Day weekend when this news story broke. There's been an extraordinary leak of a trove of documents by the Chinese government.

[Unknown]

That reveals spyware and even large scale.

[Dina Temple Raston]

Cyber attacks against foreign governments, companies and more. That would be very up a rally. Except as fate would have it, she had taken a rare weekend off and had gone to Philadelphia with her husband and niece. While the cyber research world was abuzz with the Chinese version of the Cantilks, Mei was touring Independence hall and running up those stairs from the Rocky movie.

[Mei Danowski]

So it was the long weekend, so I didn't really check a lot, you know, my emails, my chat and stuff.

[Dina Temple Raston]

But then she started getting all these texts from her friends.

[Mei Danowski]

Somebody already was telling me, sending my link, you should look at this.

[Dina Temple Raston]

And when she checked her site, all of a sudden she noticed traffic on her Natto Thoughts blog was going crazy.

[Mei Danowski]

And then I saw people was reading all my Nano Thoughts, the one I wrote about ISO. I was like, what?

[Dina Temple Raston]

Isoon, a fairly well known Chinese tech company, had sprung a leak. Thousands of internal documents and private chats from the company suddenly appeared on GitHub a popular coder's website. And the documents provided unshakable proof that Isoon was in cahoots with the Chinese government. The leaked papers included major contracts with government agencies that had clearly been paying ISOON to build hacking tools and surveillance programs, in addition to vacuuming up intelligence on their behalf, which, until the leaks, everyone sort of had to piece together. And now the details were right there in black and white for all the world to see.

[Mei Danowski]

It's huge. I was just so surprised to see the amount of the information came out.

[Dina Temple Raston]

It was a goldmine for researchers like Mei, who for years have been trying to decode the secret world of China's hackers for hire. Sure, people knew the government worked with private companies to steal information and hack into networks, but they assumed it worked the way stuff like this usually does in China, with something called Guanxi, which loosely means connections. Traditionally, Chinese businesses landed contracts because they were run by a relative of a local party official, or they knew the right people, not because they were the best company for the job.

[Mei Danowski]

The government just handed them projects, handed them tasks. But oftentimes, it's not that way.

[Dina Temple Raston]

The leak made plain that while Guanxi was still there, the Chinese government's cyberattacks are being fueled by something much bigger than that. They're the result of a massive, well structured hacking industry that has been years in the making, a kind of Chinese cyber industrial complex. Which helps explain partly why Chinese attacks in cyberspace seem to be getting a lot more serious and a lot more dangerous from recorded future news. I'm Deana Temple Crest and this is Click Here, a podcast about all things cyber and intelligence. We tell true stories about the people making and breaking our digital world. And today, inside the ISUN papers, a 190 megabyte leak of secret contracts, presentations, client lists and chat logs that are pulling back the curtain on China's secret world of hackers for hire. Stay with us.

[Unknown]

You come to the New Yorker Radio Hour for conversations that go deeper with people you really want to hear from, whether it's Bruce Springsteen or Questlove or Olivia Rodrigo, Liz Cheney, or the godfather of artificial intelligence, Geoffrey Hinton, or some of my extraordinarily well informed colleagues at the New Yorker. So join us every week on the New Yorker Radio Hour. Wherever you listen to podcasts.

[Dina Temple Raston]

This is Click here. Isun is kind of notorious in China because the company's CEO is a bit of a local hacking rock star. In fact, his hacker handle, to give you an idea of his specialty, is shut down he's well known.

[Mei Danowski]

He's definitely well known because he, you know, he was the Green army member. The member of a Green Army.

[Dina Temple Raston]

The Green Army. It dates back to 1997.

[Mei Danowski]

That's the first hacker group established in China.

[Dina Temple Raston]

It was a collective of several thousand self described Chinese patriotic hackers. A bunch of young people who were good with computers who decided to launch a campaign to break into foreign websites on China's behalf. They hacked Taiwan for wanting to be independent of China. They targeted Japan for not sufficiently owning up to the atrocities of the Nanjing massacre. Some of the Green Army's most prominent members, like Isun's CEO, moved out of the volunteer patriotic hacking business into the private sector. They went on to create giant cybersecurity firms motivated by a very capitalist mindset. And is that sort of a normal process for you? Start out as a hacker and then you sort of develop a cybersecurity company and then you work with the government. Is that a normal route?

[Mei Danowski]

You can see it's a route because all these hackers later realized you have a patriotic sentiment. That's a good thing. But the thing is they were thinking about their future, how they can grow in this big environment as everybody was.

[Dina Temple Raston]

Doing business and the businesses just took off and they started doing the kinds of things you usually see in mature industries, like starting to file for patents. According to data on Google patents, I soon filed for patents for pretty aggressive techie things. They seemed to be developing the kinds of tools that could help launch cyber attacks. For example, one of their patents was for a way to use WI fi to crack into a computer network. Another described an intelligence platform that could help customers target key individuals and organizations. And that was what was public, if you knew where to look. But definitive proof of Isun's government ties. The first real crack in this great wall of secrecy came out kind of by accident in a lawsuit last year. It was filed in a local Chinese court neither party probably thought anyone would notice. And it involved I, sun, and a tech company called Chengdu 404.

[Mei Danowski]

That's the one of the company I've been following for a while.

[Dina Temple Raston]

To the uninitiated, this court filing looked like your average intellectual property dispute. Chengdu 404 and I soon were fighting over a software development contract. But to insiders like Mei, the case was a revelation. First because it involved Chengdu 404, which it turns out is not just any tech company. It's a well known front for the Chinese Ministry of State Security, which is responsible, among other things, for foreign Intelligence, counterintelligence, and the political security of the Chinese Communist party. And the U.S. justice Department actually said as much a few years ago when it indicted a handful of Chengdu 404 employees. The charges, essentially hacking on behalf of the Chinese government.

[Michael Horka]

We have unsealed three indictments that collectively charge five Chinese nationals with computer hacking.

[Dina Temple Raston]

And then if that wasn't enough, there was more proof that surfaced around the same time as that obscure lawsuit that was filed last year. It was a video posted on Chinese social media. This is from that video, which is entitled Cybersecurity Talent Training Seminar two. And that voice you're hearing is Isoon's chief technology officer. He's telling a classroom of students that protecting the Internet is already a boom industry in China full of opportunity. And then he said the quiet part out loud. Cybersecurity projects in China today, he said, are being led by the government. The I Soon leak didn't just underscore that point. It also revealed details that Beijing doesn't want people to know about how this public private partnership works.

[Mei Danowski]

There's interesting conversations in the leaked document in the. I assume I have a lot of chat between the employees with the clients. They often mentioned saying, oh, do you know, so and so. And this company sounds like they got a big contract with the Public Security Bureau. Could we tag along?

[Dina Temple Raston]

Right. So everybody was sort of pals with each other.

[Mei Danowski]

Yeah, they call them drinking buddies, but they also compete with each other, like try to poach their best talent, you can say, some of the big fish, you know, to eat the small fishes.

[Dina Temple Raston]

And these drinking buddies aren't just employees of I Soon. And this is really the biggest revelation of the leaked documents. They provide the first real concrete proof not just that Isoon works for the government, but that many tech companies do. And it shows just how massive and mature this hacking for hire industry in China has become.

[Mei Danowski]

There's 120 contracts shown in the leaked document.

[Dina Temple Raston]

The documents include over 100 contracts that I soon had with other tech companies and the Chinese government. Inside, there are literally dozens and dozens of companies people didn't know had government ties that are now publicly outed. And that's just what's included in this leak. Researchers say that's only the tip of the iceberg. The Isoon papers provide this other important thing, the first real look at how cutthroat this vast company network is. It reveals a little mini Silicon Valley drama with key employees getting poached, companies promising investments, and all the jockeying for position and trying to prove their value to the state appears to be paying off. The leaked documents provide a laundry list of pilfered information, such as 95 gigabytes of immigration data stolen from India, hacked call logs from a South Korean telecom provider, internal documents from Malaysia's Senate. And it also shows employees of ISOON actually thinking through their plans for future hacks. There's some chat logs between employees talking through ideas on how to best crack into the treasury and home office in the uk. And when we come back, China seems to be doubling down on cyber operations and what US Officials are doing in response.

[Ann Neuberger]

We've started that journey. Different sectors are at different places of maturity.

[Dina Temple Raston]

Stay with us.

[Unknown]

Do nice guys really finish last? I'm Tim Harford, host of the Cautionary Tales podcast, and I'm exploring that very question. Join me for my new miniseries on the art of fairness. From New York to Tahiti, we'll examine villains undone by their villainy, monstrous self devouring egos, and accounts of the extraordinary power of decency. Listen on the iHeartRadio app, Apple Podcasts, or wherever you listen to podcast.

[Dina Temple Raston]

The man considered the father of China's information warfare doctrine is this unlikely character, a low level People's Liberation army officer named Shen Wei Guang. He understood the power of technology, but allegedly he couldn't even type.

[Mei Danowski]

He was computer illiterate. He didn't really know how to use a laptop, a computer.

[Dina Temple Raston]

In 1979, Chen was a soldier fighting in the Sino Vietnamese War, a conflict which lasted all of 27 days.

[Mei Danowski]

It was a poor man's war. Little else but infantry and artillery were used. The Chinese set out to teach Vietnam a lesson.

[Dina Temple Raston]

While the short battle was considered a draw, the fight itself deeply affected Chen so much that it made him consider other ways nations might settle their differences.

[Mei Danowski]

He was thinking, you know, can we have a fighting without blood, a war without bullets?

[Dina Temple Raston]

So he wrote a book in 1985. This was just two years after Arpanet gave birth to the Internet. Future wars, Shen said, would be fought with information. And the idea landed with a thud. People totally dismissed it. Like, sure, Shen, in the future we won't fight with guns, we'll just fight with data. And that might have been it had Shen not decided to write an article for a military publication in hopes of getting his ideas out more broadly.

[Mei Danowski]

His first piece was published in the PLA Daily.

[Dina Temple Raston]

The PLA Daily, the People's Liberation Army's paper of record. And it couldn't have happened at a more opportune time because just three years.

[Mei Danowski]

Later, in an explosive development near the Persian Gulf. Word that Iraq has invaded neighboring state of Kuwait. With fighting reported along the border.

[Dina Temple Raston]

The residents say the US military eventually stepped in and showed just how much technology could do. The Gulf War became the world's first computer war. It revealed the huge technology gap between the US military and everyone else. Computer assisted weapons, teleconferences among generals, and it was all out there for everyone to see on live tv. And it rather famously rattled the Chinese leadership. They felt so behind. And Shen's high tech information war suddenly didn't seem so crazy after all. The military started to take a second look at his writing. They even assigned his original book for soldiers to study.

[Mei Danowski]

The military picked it up. Try to study, you know, what really is information warfare. Finally people realize the information warfare is the same.

[Dina Temple Raston]

Chen got invited to conferences and he wrote a second book. And then he started to refer to himself as a futurist, which clearly he was. And all this got even more momentum after Chinese leader Xi Jinping came to power because he made cyber a priority. All of a sudden, China was stepping up its use of zero days, those security holes and widely used software that no one knows about. Not so long ago, Chinese hackers went to global hacking competitions to find vulnerabilities in software and then release them to the world so they could be patched. Now the Chinese seem to be hoarding vulnerabilities for their own use.

[Michael Horka]

They don't use a whole lot of custom tooling, things that could be signatured. They'll use things that the typical network administrators often use for remote management of servers and things like that, so they're difficult to detect.

[Dina Temple Raston]

This is Michael Horka, a senior information security engineer at Lumen Technologies, Black Lotus Labs. And he says the influx of all of this new private talent and the new training for China state hackers has allowed them to up their game even more. And one group in particular has become increasingly aggressive. A state hacking group called Volt Typhoon. And its MO is targeting critical infrastructure.

[Michael Horka]

Your water utilities, electric utilities, transportation, maritime, stuff like that.

[Dina Temple Raston]

This was big news earlier this year when FBI Director Chris Wray unexpectedly announced that the US had found Volt Typhoon malware pre positioned in critical US networks. They were lying in wait in power stations and aviation networks. Ostensibly it was in anticipation of needing them for some future attack. And we talked about this in a previous episode. The big takeaway Ray told us a few weeks ago, isn't that the Chinese government is doing this, but rather how much they're doing it.

[Mei Danowski]

We're seeing it now on a scale and intensity that we have not previously seen.

[Dina Temple Raston]

Which explains why Biden administration officials are increasingly seeing these kinds of cyber operations through a new lens. US Companies have always been asked to patch and update and silo their systems to guard against attacks. But now there's also a push to have something in place, a kind of plan B, something to lean on in case nation state hackers manage to crack into critical systems.

[Ann Neuberger]

Because what really matters? Preventing the disruption of critical services that Americans rely on, from water to pipelines to electricity.

[Dina Temple Raston]

This is Ann Neuberger. She's the Biden administration's deputy national Security advisor for cyber and emerging technology. We met at a restaurant on the sidelines of the Munich security conference late last month. And she says one of the big problems is there aren't agreed upon norms when it comes to this kind of information warfare. And she confirmed that there are ongoing discussions with the Chinese at the highest levels to see if there's a way to agree on some, to convey and.

[Ann Neuberger]

To discuss rules of the road.

[Dina Temple Raston]

And is that actually being pursued now?

[Ann Neuberger]

There have been high level discussions of that.

[Dina Temple Raston]

And do they get that this is not something that they should be doing? She wouldn't bite on the question.

[Ann Neuberger]

I can't. Clearly we convey the message.

[Dina Temple Raston]

Which brings us back to that recent leak of documents for my Soon. Among other things, the materials revealed an eight year effort by the company to target just about anything it could get its hands on. Databases, communications. And while it doesn't appear to be pre positioning malware in critical networks like Voltage, Typhoon May Danowski from Nattoth says they are definitely leaning in and trying to meet the moment. They aren't just defending their networks. They're doing what Shen suggested they do all those years ago. They're using data instead of bullets.

[Mei Danowski]

Their goal to become a superpower is on par with United States. Then the United States do have offensive capability. That's well known, right?

[Dina Temple Raston]

How do you compete if you don't have offensive cyber too?

[Mei Danowski]

Yeah. Yeah.

[Dina Temple Raston]

And if all this sounds familiar, it should. Using outsiders to help you hack isn't a Chinese invention. Russian cyber gangs have been targeting Moscow's adversaries for years. Iranian hacktivists do too. And that arrangement gives the leadership in both those countries a patina of deniability. The Isun papers suggest that China has developed a kind of hacking with Chinese characteristics. They've chosen something they're good at, running a business, so they've opted to recruit private industry instead of private gangs. It's something they can control, but is just independent enough that when something goes awry, Beijing can claim, hey, it wasn't us. This is Click Here.

Today's episode was produced by Sean Powers and me, Dina Temple Raston. It was edited by Karen Duffin, Fact Checked by Darren Ancrum, and contains original music by Ben Levinston. Our staff writer is Lucas Riley and our illustrator is Megan Gough. Click Here is a production of Recorded Future News. We'll be back on Friday with Mike Drop.

[Unknown]

If you're looking for a daily guide to cybersecurity news and policy, sign up for the Cyber Daily from Recorded Future News. It serves up the day's most interesting and important cyber stories from our sister publication the Record, and then aggregates all of the big cyber stories you might have missed from news outlets around the world. Just go to TheRecord Media and click on Cyber Daily to get all you need to know about the world of cybersecurity right in your inbox.