Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns

Summary: On Feb. 16, 2024, someone uploaded data to GitHub that appeared to include internal communications, sales materials and product manuals from the Chinese IT security services company i-Soon, also known as Anxun Information Technology, and Unit 42 assessed with high confidence that the leaks are genuine. Unit 42 linked the leaked chat conversations, dated November 2018 to January 2023 and involving 37 unique usernames, to the 2022 Comm100 supply chain attack and to infrastructure tied to the 2019 Poison Carp campaign, and found a product manual showing a malware control panel named Treadstone, which the 2019 U.S. grand jury indictment of three Chengdu 404 employees directly references.

Key Takeaway: The leak shows a commercial firm marketing the same tool sets attributed to Chinese APT groups, including Treadstone and a ShadowPad C2 server at 118.31.3[.]116:44444 that SentinelLabs attributed to Winnti, which Unit 42 says makes attribution harder for defenders and threat intelligence analysts.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related