Orange Cyberdefense’s World Watch team mapped China’s cyber offensive ecosystem: state agencies, private contractors, front companies, universities, hacking competitions and vulnerability databases. As of October 2024, the map holds more than 300 nodes and 400 relationships, including 171 private companies and 19 front companies. It also shows how the CNNVD and CNVD vulnerability databases and competitions like the Tianfu Cup can funnel exploits to state agencies.
In this light, I would like to highlight the article by Margin Research that examines the implications of a significant leak involving Shanghai Anxun Information Co. (i-Soon), a Chinese cybersecurity contractor. This leak, which surfaced on February 16, 2024, includes internal documents, chat logs, and sales pitches, shedding light on China’s offensive cyber capabilities and drawing parallels to Western entities like NSO Group. SentinelLabs read the same leak as a market of contractors competing for low-value government jobs, with at least 14 governments, NATO and Hong Kong pro-democracy groups among the apparent victims. Turns out state hacking also runs on underpaid subcontractors.