The US has charged 12 Chinese nationals, including two public security officials, with involvement in a hacker-for-hire campaign on Beijing’s behalf whose targets included American government agencies.
The justice department indicted 10 of the Chinese citizens for allegedly leading a decade-long hacking campaign at the request of Chinese intelligence and police agencies.
They also allegedly sold data obtained through hacking to the Chinese ministry of state security and the ministry of public security.
“Today, we are exposing the Chinese government agents directing and fostering indiscriminate and reckless attacks against computers and networks worldwide,” said Sue Bai, head of the US justice department’s national security division, “as well as the enabling companies and individual hackers that they have unleashed.”
According to the justice department, 10 of the suspects — including the two MPS officials — worked for a Chinese company called i-Soon, which generated millions of dollars in an extensive “hacker-for-hire ecosystem”.
It said i-Soon conducted hacking at the request of the MSS and MPS but also obtained data through independent hacking, which it sold to the security agencies at a cost of $10,000-$75,000 for each exploited email inbox.
“The Chinese ministry of public security has been paying hackers for hire to inflict digital harm on Americans who criticise the Chinese Communist party,” said Bryan Vorndran, assistant director of the FBI’s cyber division.
The justice department said the targets of the hacking campaign included a religious organisation that was critical of the Chinese government, a rights group and US-based media outlets.
The hackers also targeted foreign ministries in Taiwan, India, South Korea and Indonesia.
One FBI official said i-Soon had been a “key player” in China’s information security ecosystem over the past decade and had at times employed 100 people. He said the company had estimated that it would generate revenues of $75mn by 2025.
“The bottom line here is the PRC [People’s Republic of China] . . . utilises proxies, third-party companies, to effectuate its objectives and goals by conducting these cyber operations against the US,” the official said.
The justice department also charged Zhou Shuai and Yin Kecheng, two members of a hacking group known as APT27, for alleged involvement in multiyear “for-profit computer intrusion campaigns”.
Yin was allegedly involved in an attack on the US Treasury department from September to December 2024.
One US official said Zhou was a “very large person in the hacking community in China and was involved in brokering data obtained by hacking around the world”.
“His involvement is deep, long-standing, and the fact that he is charged in this indictment should be a signal to everybody that there are no persons who are beyond the law,” the official added.
The FBI official added that the indicted individuals were not connected with Salt Typhoon, a months-long alleged Chinese attack on US telecoms networks that allows hackers to target any unencrypted phone call in the US.
In a recent interview with the Financial Times, former national security adviser Jake Sullivan said Salt Typhoon was unique because of the “sheer scale of access” that the hacking campaign has achieved.
The Chinese embassy in Washington said it opposed US efforts to impose its “long-arm jurisdiction” on China.
“We urge the US to stop using cyber security issues to smear China and stop abusing illegal unilateral sanctions,” said Liu Pengyu, the Chinese embassy spokesperson.