Ethermac|Leaked document trove shows a Chinese hacking scheme focused on harassing dissidents

A large trove of more than 500 sensitive technical documents posted online anonymously last week details one Chinese technology company's hacking operations,Ethermac target lists and marketing materials for the Chinese government.

The majority of the operations appear to be focused on surveilling and harassing dissidents who publicly criticize the Chinese government, including on global social media platforms like X, formerly known as Twitter.

Target lists reveal victims from at least 14 governments from Pakistan to Australia, as well as academic institutions, pro-democracy organizations in places like Hong Kong, as well as the military alliance NATO. The company was also bidding for work to surveil the minority Uyghur population in Xinxiang, a broader Chinese government program that major global human rights' organizations around the world have heavily criticized. There are even pictures of custom devices used for spying, such as a recording device disguised as a power bank.

Cybersecurity researchers are still investigating different components of the leak, which was shared to the open source development website popular with programmers, called GitHub. However, experts from top U.S. cybersecurity companies including Google's Mandiant and Sentinel Labs have shared preliminary analysis of the contents of the leak, believing the documents to be authentic.

"We have every reason to believe this is the authentic data of a contractor supporting global and domestic cyber espionage operations out of China," said John Hultquist, the chief analyst for Mandiant Intelligence, a part of Google Cloud. "This leak is narrow, but it is deep. We rarely get such unfettered access to the inner workings of any intelligence operation. We are working hard to learn as much as we can and put it to good use."

The state-affiliated company, called i-Soon, is known to be one of many contractors and subcontractors who compete for opportunities to perform hacking and surveillance operations for different Chinese government agencies. The company is currently facing litigation from another Chinese contractor called Chengdu 404, a company that the U.S. government has publicly linked in court documents to hacking operations for the state. It appears i-Soon may have done subcontracting work with Chengdu 404.

In previous public materials, i-Soon has noted relationships with China's Ministry of Public Security, Ministry of State Security, and People's Liberation Army, among others. The company is publicly known for providing cybersecurity trainings around the country from its base in Shanghai.

But beyond what's publicly known, the details in the leak give internal insights into how an increasingly competitive marketplace for hacking operations within China functions. It's unclear if all the claims made in marketing materials included in the leak are true, such as the ability to break into devices manufactured by top U.S. companies like Apple and Microsoft. However, it's clear that the company is heavily invested in automating the ability to constantly monitor platforms like X and Facebook. Those platforms, unlike the popular WeChat, are not controlled by the Chinese government, making them popular with dissidents.

There are also details in the leak concerning internal pay scales and other bureaucratic details of contracts with the Chinese government. There is a note, or "ReadMe" document, included on the GitHub page where the leak is hosted, where the purported source of the leak claims to be dissatisfied with the company's policies. That could indicate the source being a disgruntled employee, though it's also possible the leak is the result of an intelligence operation or the work of a competitor.

While the contents of the leak are not entirely surprising, they're especially helpful to specialists and researchers, who continue to review the contents. In particular, individual documents can help researchers fact-check their assumptions about who was responsible for previously discovered breaches.