Chinese Data Leak Reveals Salt Typhoon Contractors

The Chinese nation-state threat actor tracked as Salt Typhoon is operated by a clutch of private hacking firms whose clients include multiple Chinese government agencies, finds analysis of leaked datasets by cybersecurity firm SpyCloud.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The firm spotted datasets sold on criminal forums in May that appear to have originated inside China’s hack-for-hire ecosystem, a network of companies that take direct tasking orders from intelligence agencies and that also hack on spec in the hopes of later selling access or stolen data to the government.

SpyCloud’sanalysis of sample data taken from the criminal forums included IP addresses of routers apparently attacked by Salt Typhoon, employee details such as names and internal chat logs. They also contained contracts, such as one between a Beijing hacking firm and a military supplier to the People’s Liberation Army.

The identity protection company said it verified the authenticity of the leak by cross-referencing the personal information and matching it to real individuals in China. “Some of the listed router usernames correspond with actual Chinese internet service providers,” SpyCloud researchers said.

Researchers found a spreadsheet listing buyers, sellers and financial transaction details. Salt Typhoon, also known APT27, Emissary Panda and UNC5221 is linked to intrusions in U.S. telecommunications networks.

The federal government has identified a handful of Chinese companies that contract for government hacking work, including by naming Sichuan Juxinhe Network Technology as a Salt Typhoon contractor. U.S. federal prosecutors further announced indictments Tuesday against two suspected private sector Silk Typhoon hackers, identifying them as employees of Shanghai Powerock Network and Shanghai Firetech Information Science and Technology. Italian authorities arrested accused hacker, identified as Xu Zewei, 33, when he flew into Milan (see: Italian Police Arrest Alleged Chinese Hacker Wanted by FBI).

SpyCloud says there are still Salt Typhoon contractors that have yet to be publicly identified by the government: Beijing Huanyu Tiangiong Information Technology, publicly listed as a computer peripheral equipment manufacturer and Sichuan Zhixin Ruijie Network Technology Company, a putative information and communication technology firm.

The leaks also shows their customers of those two companies plus Sichuan Juxinhe Network Technology also appear to include People’s Liberation Army Unit 61419, a hacking unit tracked as “Tick” by Japanese authorities following an incident against Japan’s space agency in 2016 and 2017. Recorded Future observed the unit in 2021 seeking to buy Western and Russian antivirus software, likely to reverse engineer exploits to sneak past defenses.

Another customer referenced in the datasets is the Institute of Information Engineering of the Chinese Academy of Sciences, a publicly owned academic institute that established China’s first cyber range “and has significant known ties to the Chinese hack-for-hire industry,” Spy Cloud researchers said.

Other Chinese government entities listed include the Foreign Affairs Office of the People’s Government of Beijing and the Bureau of Economy and Information Technology at Chengdu. Additionally, other Chinese hacking groups, Qi’anxin, Legendsec and VenusTech were listed as potential Salt Typhoon customers.

The Chinese government’s reliance on hacking-for-hire was thrown into sharp relief in early 2024 when data taken from hacking contractor iSoon offered a rare peak inside the daily existence of for-profit nation-state hackers, complete with banter about mahjong and complaints about low pay (see: Chinese Hacking Contractor iSoon Leaks Internal Documents).

“China’s state-sanctioned data collection and intelligence apparatus is leaky,” SpyCloud said. “We’ve observed a vast ecosystem of corrupt insiders siphoning state data and selling it on the black market.”

“Operations by front companies have non-attribution advantages,” said Mei Danowski, threat intelligence expert at Natto Thoughts, which tracks Chinese hacking. “However, hack-for-hire firms have built an ecosystem for doing business with the government to make profits, which can be efficient for their operations as well,” Danowski told Information Security Media Group.

Eugenio Benincasa, a senior cybersecurity researcher at ETH Zurich, said the SpyCloud findings are “consistent with the modus operandi” of past Salt Typhoon activities.

“For example, VenusTech has long been linked to the Chinese government,” Benincasa said. “It has provided cybersecurity services to multiple PLA departments, including general staff, armaments, logistics, political units and supports several defense industry consortiums.”