US officials have been scouring a trove of newly leaked documents from a Chinese tech firm for clues on how the government in Beijing allegedly uses the company in extensive hacking campaigns, multiple US cybersecurity officials familiar with the matter told CNN.
The Biden administration's study of the leak is ongoing, but private experts told CNN it offers some of the clearest public evidence yet of how they believe China's powerful security agencies outsource hacking operations to tech firms to target victims around the world.
The documents, posted anonymously online last weekend for anyone to access, include screenshots of chat logs, as well as records of employees and Chinese government clients of the tech firm I-Soon. The company's hacking victims range from Tibetan exile-run political groups, hospitals in Taiwan and India to Hong Kong's universities following the city's mass pro-democracy protests in 2019, according to the leaked data. More than a dozen, mostly Asian, foreign governments are listed as targets.
I-Soon's clients include China's police, intelligence service and military, according to a spreadsheet listing 183 contracts signed between 2016 and 2022 by I-Soon's subsidiary in the southwestern province of Sichuan.
"This is some of the best visibility we've had into Chinese hacking operations outside of a government SCIF," said Adam Kozy, who used to track Chinese hackers for the FBI, using an acronym for classified facilities.
"I'm not aware of the specifics you mentioned. In principle, I want to emphasize that China firmly opposes the unwarranted denigration and smearing against China," Liu Pengyu, spokesperson for the Chinese Embassy in Washington, DC, said in an emailed statement when asked for comment.
"The so-called claim that 'the Chinese authorities surveil dissidents overseas' is completely fabricated," Liu's statement continued. "China is a major victim of cyber attacks. We keep a firm stance against all forms of cyber attacks and resort to lawful methods in tackling them. China does not encourage, support or condone attacks launched by hackers."
Wu Haibo, the CEO of privately owned and Shanghai-based I-Soon, did not respond to multiple requests for comment.
The leak comes amid unprecedented tensions in US-China relations in cyberspace and appears to fly in the face of Beijing's repeated denials that it sponsors cyberattacks.
FBI Director Christopher Wray and other top US officials warned Congress last month that another set of Chinese hackers unrelated to I-Soon have infiltrated critical US infrastructure and could use that access to disrupt any US military response to a potential Chinese invasion of Taiwan.
Beijing has strongly denied the allegations and in turn accuses the US of conducting its own cyberattacks.
"The Chinese government is really trying to change this narrative that China hacks other countries," Dakota Cary, a consultant at security firm SentinelOne who focuses on China, told CNN. "So I think [the leaks will] really upset them."
GitHub, the popular software developer platform where the leaked data appeared, took the documents down late Thursday, saying the data was a "violation of GitHub's terms of service."
Keep reading about the company's hacking operations.
More on China's spying campaigns:
