Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A recent leak from I-SOON, a Chinese IT and cybersecurity company, has revealed connections to several state-sponsored cyber groups including RedAlpha, RedHotel, and Poison Carp. The leak exposes a sophisticated espionage network involving the theft of communications data for individual tracking. Analysis confirms operational and organizational ties between I-SOON and these groups, highlighting I-SOON's role as a digital quartermaster providing shared cyber capabilities in China's aggressive cyber ecosystem. Despite the leak, I-SOON is expected to continue operations with minor adjustments. The revelation enhances understanding of Chinese cyber espionage and may impact future US legal actions against I-SOON operatives.

The threat involves the exposure of I-SOON, a Chinese IT and cybersecurity private contractor, which has been linked to multiple Chinese state-sponsored cyber espionage groups including RedAlpha, RedHotel, and Poison Carp. A recent leak from I-SOON revealed its operational and organizational ties to these groups, confirming its role as a digital quartermaster within China's cyber ecosystem. I-SOON provides shared cyber capabilities, facilitating sophisticated espionage campaigns primarily focused on the theft of communications data to enable individual tracking and intelligence gathering. The leak sheds light on the infrastructure and coordination behind these state-sponsored campaigns, which leverage advanced techniques and tools to infiltrate targets, maintain persistence, and exfiltrate sensitive information. Despite the leak, I-SOON is expected to continue its operations with minor adjustments, indicating resilience and adaptability. The campaign is characterized by the use of multiple tactics and techniques mapped to MITRE ATT&CK IDs such as T1583 (Acquire Infrastructure), T1592 (Gather Victim Host Information), T1589 (Gather Victim Network Information), T1596 (Search Open Technical Databases), T1102 (Web Service), T1608 (Stage Capabilities), T1590 (Gather Victim Identity Information), T1598 (Phishing for Information), T1588 (Obtain Capabilities), and T1587 (Develop Capabilities). These techniques highlight a comprehensive approach to cyber espionage, including infrastructure setup, reconnaissance, capability development, and data exfiltration. No known exploits are currently reported in the wild related to this leak, but the intelligence gained from the exposure could enable defenders to better understand and potentially disrupt these espionage operations. The leak also has implications for legal and geopolitical actions, particularly by the US, against I-SOON operatives and affiliated groups.

Detailed information about Private Contractor Linked to Multiple Chinese State-Sponsored Groups. Get real-time updates, technical details, and mitigation strate

Title	Severity	Type	Source	Date

Threats Tagged 'i-soon'

Filter Threats

Threats Tagged 'i-soon'