US Charges Members of Chinese Hacker-for-Hire Group i-Soon

The US has charged members of prolific Chinese hacking group APT27, alongside government employees and i-Soon staff, for long-running arms-length hacking campaigns.

The Department of Justice (DoJ) said yesterday that eight i-Soon employees and two Ministry of Public Security (MPS) officers are wanted for a campaign that ran from 2016 to 2023 and involved the widespread hacking of email accounts, mobile phones, servers and websites.

Among them are i-Soon’s CEO, Wu Haibo, COO, Chen Cheng, and others. The DoJ said they made tens of millions of dollars as hackers for hire – conducting both computer intrusions at the request of the MPS or Ministry of State Security (MSS), or doing so under their own initiative and then selling any compromised data to Beijing.

Cybersecurity company i-Soon apparently charged the MSS and MPS $10,000-$75,000 for each compromised email inbox and also earned money training MPS employees.

Among its targets was an unnamed “large religious organization” and “multiple news organizations” critical of Beijing.

Read more on i-Soon: I-Soon GitHub Leak: What Cyber Experts Learned About Chinese Cyber Espionage

According to the DoJ, the scheme extended beyond i-Soon.

“Today’s announcements reveal that the Chinese Ministry of Public Security has been paying hackers-for-hire to inflict digital harm on Americans who criticize the Chinese Communist Party (CCP),” said assistant director Bryan Vorndran of the FBI’s Cyber Division.

“To those victims who bravely came forward with evidence of intrusions, we thank you for standing tall and defending our democracy. And to those who choose to aid the CCP in its unlawful cyber activities, these charges should demonstrate that we will use all available tools to identify you, indict you, and expose your malicious activity for all the world to see.”

Separately, the DoJ charged two APT27 actors for a long-running for-profit campaign dating back to 2013. They allegedly hacked and sold data to multiple buyers, including the Chinese government. Among the victims were US technology companies, think tanks, law firms, defense contractors, local governments, health care systems and universities.

Upping the stakes further, the US State Department issued a reward of up to $10m for information leading to the “identification or location” of the wanted i-Soon employees and $2m each for “information leading to the arrests and convictions” of APT27 actors Yin Kecheng and Zhou Shuai.

The Treasury’s Office of Foreign Assets Control (OFAC) also announced sanctions against Yin for his alleged role in hacking the agency between September and December 2024.