iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CyberScoop reported on January 9, 2020, that the anonymous group Intrusion Truth had published evidence alleging that several Hainan technology companies acted as fronts recruiting hackers for Beijing-linked activity. The evidence—job advertisements, repeated wording, shared phone numbers and overlapping addresses—was suggestive, not proof that any company or posting was controlled by the Chinese state.
What the Intrusion Truth dump revealed
Intrusion Truth said it identified five Hainan companies advertising for offensive cybersecurity staff. The postings sought penetration testers, network-security development engineers and, in one case, female English translators preferably belonging to the Communist Party.
The most specific job language
An advertisement from Hainan Tengyuan sought applicants with “a track record of sharing hacking exploits” and experience developing Windows Trojan shellcode and encrypting PE files. That wording is more specialized than a typical defensive-security vacancy, but it still does not establish who would employ the applicants or how the skills would be used.
How the company network was assembled
Intrusion Truth then compared corporate contact details. It said eight additional companies shared phone numbers or addresses with the five firms in the advertisements, producing a network of 13 apparently connected companies.
#1 Best Overall
CyberScoop’s example was Hainan Xinhuaheng. It reportedly shared a telephone number with Hainan Tengyuan, Hainan Dingwei, Haikou Fengshang, Hainan Hualian Anshi and Hainan Jiaxi, and occupied the same building as the other businesses. Shared details can indicate common ownership or administration, but they can also result from tenants, contractors or reused business-contact information.
Why APT40 was considered a possible link
Researchers cited by CyberScoop associated the dump with APT40, a group also known as Leviathan, TEMP.Periscope and TEMP.Jumper. The connection was an investigative assessment rather than a finding that the 13 companies had been conclusively identified as APT40 entities.
FireEye’s earlier reporting
CyberScoop used FireEye’s March 2019 reporting to provide context. FireEye linked APT40 to the theft of U.S. Navy information and described technical artifacts consistent with a China-based operation. FireEye also observed the group using rar.exe to compress and encrypt stolen data.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Campaigns mentioned in the report
APT40 was described as the main suspect in attacks targeting Cambodia’s elections and the U.S. maritime industry. Those earlier assessments supplied a threat-actor context; they did not independently authenticate the corporate relationships identified by Intrusion Truth.
Rank #3
- Students build unmatched deductive-reasoning skills as they become crime-solving stars
- Most scenarios have more than one plausible outcome, allowing individuals or groups to broadly interpret evidence
- Includes interpretive handwriting, body language, fingerprinting, and many more activities
How strong was the evidence?
The dump combined several kinds of clues. Their value differs depending on whether they are corroborated by technical or independent evidence.
| Investigative clue | What was reported | What it can and cannot establish |
|---|---|---|
| Technical wording | Tengyuan sought Windows Trojan shellcode and PE-encryption experience; other ads sought penetration testers and network-security engineers. | Suggests knowledge of offensive tools, but penetration-testing work can also be legitimate security testing. |
| Contact and address reuse | Phone numbers and locations allegedly connected five advertised firms to eight more companies. | Indicates an apparent business relationship or shared administration; it does not by itself prove a hacking operation. |
| Malware or infrastructure corroboration | FireEye’s separate APT40 reporting described China-based technical artifacts and use of rar.exe for stolen data. |
Strengthens the background case for how APT40 operated, but the report did not say those artifacts came from the Hainan companies. |
| Independent confirmation | CyberScoop reported the allegations and prior researcher assessments; Intrusion Truth’s identity remained unclear. | Limited independent confirmation means attribution should remain qualified. |
| Company response | Xiandun Technology Development and Tengyuan could not immediately be reached for comment. | No immediate response leaves the allegations unanswered; silence is not proof of wrongdoing. |
Does a suspicious cybersecurity job posting prove Chinese APT activity?
No. Companies routinely hire penetration testers and security developers to evaluate and protect their own systems. A posting becomes more probative when its language is unusually specific, its employer is tied to other entities through multiple records, and the same people, malware, infrastructure or victimology appear in independent investigations.
Rank #4
In this case, Intrusion Truth’s claim that the companies were “a front for APT activity” should be treated as an allegation. The job advertisements and corporate links were investigative leads, not a public demonstration of state sponsorship.
Quick Recap
Timeline of the reporting
- March 2019: FireEye reporting, as summarized by CyberScoop, connected APT40 with theft of U.S. Navy information and documented technical characteristics of the group.
- January 9, 2020: Jeff Stone reported for CyberScoop on Intrusion Truth’s Hainan-company data dump.
- 2020 report: Intrusion Truth said five firms advertised for offensive-security roles and that shared contact details linked eight additional firms, for 13 apparently connected companies.
What remains unknown
- The identity and sponsorship of Intrusion Truth were not established in the report.
- The companies’ alleged relationships to one another were not independently proven beyond the reported advertisements, phone numbers and addresses.
- No public evidence in the report conclusively showed that the firms recruited for, directed or funded APT40 operations.
- The 13-company figure is a count from this investigation, not a prevalence estimate for Hainan or China’s technology sector.
How to read similar front-company investigations
- Separate the source’s allegation from independently reported facts.
- Check whether technical language is unusually operational or could fit ordinary defensive work.
- Look for multiple reused contact details and addresses rather than one coincidental match.
- Require corroboration from malware, infrastructure, personnel or victim data before accepting an APT attribution.
- Record whether the named companies responded, while treating a non-response only as an unresolved question.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
