Private Contractor Linked to Multiple Chinese State-Sponsored Groups

A recent leak from I-SOON, a Chinese IT and cybersecurity company, has revealed connections to several state-sponsored cyber groups including RedAlpha, RedHotel, and Poison Carp. The leak exposes a sophisticated espionage network involving the theft of communications data for individual tracking. Analysis confirms operational and organizational ties between I-SOON and these groups, highlighting I-SOON's role as a digital quartermaster providing shared cyber capabilities in China's aggressive cyber ecosystem. Despite the leak, I-SOON is expected to continue operations with minor adjustments. The revelation enhances understanding of Chinese cyber espionage and may impact future US legal actions against I-SOON operatives.

• Libyan Oil Refinery Among Targets in Long-running Likely Espionage CampaignMalware2026-03-20
• Threat Brief: March 2026 Escalation of Cyber Risk Related to IranMalware2026-03-03
• Attack on *stan: Your malware, my C2Malware2026-01-30
• Yet Another Leak of China's Contractor-Driven Cyber-Espionage EcosystemMalware2026-01-10
• What's in an ASP? Creative Phishing Attack on Prominent Academics and Critics of RussiaCampaign2025-06-18