US Seizes Chinese Hacker Infrastructure, Unseals Indictments

U.S. federal authorities Tuesday seized digital infrastructure traced to two Shanghai hackers operating on behalf of the Chinese government as “Silk Typhoon,” responsible for a late 2024 incursion into the Department of Treasury.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The judicially authorized seizure of four online domains used in phishing attacks and virtual private servers used to create a VPN – ecoatmosphere.org, newyorker.cloud, heidrickjobs.com and maddmail.site – came with the unsealing of indictments against the two hackers, Treasury sanctions and a reward of up to $2 million leading to their arrest.

The two men at the center of the investigation are Zhou Shuai, aka “Coldface,” and Yin Kecheng. Prosecutors say their hacking activity underpins the threat group variously tracked as APT27, Silk Typhoon, Emissary Panda and UNC 5221.

A server leased by Yin reviewed by FBI investigators contained Phishlets, files used to configure the Evilginx, a hacking tool typically deployed as an attacker-in-the-middle platform for intercepting and stealing login credentials, including multifactor authentication challenges. In the server image probed by the FBI, the Phishlets file contained evidence that attackers used outlook.newyorker.cloud, a subdomain of one of the seized domains, to launch phishing attacks.

Treasury already sanctioned Yin in January for his involvement in hacking into the federal department’s own computing environment, including into the bureau responsible for enforcing sanctions and the office that reviews foreign investments for national security threats (see: US Identifies Hacking Firm Behind Salt Typhoon Telecom Hacks).

The FBI believes that Yin in particular was responsible for the Treasury intrusion, which occurred sometime between Sept. 2, 2024, and Dec. 6, 2024. Treasury on Wednesday It added Zhou to the list of individuals cut off from the international dollar payments system, as well as Shanghai Heiying Information Technology Company, a private company majority owned by Zhou and used by him to broker stolen data to the Chinese government.

China’s reliance on a network of government contractors hacking on its behalf has come into sharp relief, particularly after the February 2024 leak of internal documents depicting government clients, rates for penetrating foreign governments and hacking tools from one such firm known as iSoon. Prosecutors today also unsealed an indictment against the CEO of iSoon and seven other employees as well as two Ministry of Public Security officers who directed the firm’s activities (see: US Prosecutors Indict iSoon Chinese Hacking Contractors).

Investigators say Zhou brokered data stolen by Yin and iSoon and served for a period of time in i-Soon’s strategic consulting division. Both men have been driven at least partially by a desire to make money, government documents show. The FBI said Wednesday that Yin in 2013 told an associate he hoped penetrating an American military target would net him enough to buy a car.

Zhou’s time in the Chinese hacking scene goes back at least to 2007 while has been active since at least 2013. A 2023 grand jury in the U.S. District for the District of Columbia indicted both on 25 criminal counts, accusing them of hacking into a “multinational conglomerate company” as well as stealing designs for electro-magnetic weapons, and naval warships. A 2013 grand jury in the same federal district indicted Yin in 2013 on 19 criminal counts. The indictment describes a familiar set of activities such as leasing servers to conceal his real IP address and deploying PlugX, a remote access Trojan associated with Chinese nation-state hackers (see: FBI Deletes More Than 4,000 PlugX Malware Instances).