APT40 is run by the Hainan department of the Chinese Ministry of State Security

APT40 is run by the Hainan department of the Chinese Ministry of State Security

In our previous articles we identified a network of front companies for APT activity in Hainan and showed their links to Hainan University academic Gu Jian. Although it was difficult to find people who work for these companies we identified a number of individuals and concluded that this network of companies was actually APT40. One of the individuals we identified, Ding Xiaoyang, is the owner of a phone number used on job adverts under the name Mr Chen.

Ding Xiaoyang’s role

When we started we weren’t sure what Ding Xiaoyang’s role was.

So we ran the numbers. How many Dings are there likely to be in Haikou, Hainan, and would it be possible to identify a specific Ding Xiaoyang among them?

Continue reading “APT40 is run by the Hainan department of the Chinese Ministry of State Security”

Hainan Xiandun Technology Company is APT40

Hainan Xiandun Technology Company is APT40

You knew where this was heading.

In our previous articles we identified a constellation of front companies for APT activity in Hainan and a computer science specialist at Hainan University who is linked to one of the companies. We named the individuals that we could identify as working for these companies, including one that we know to be Hainan resident Ding Xiaoyang who had used his telephone number on a job advert using the name ‘Mr Chen’.

Having identified a network of interlinked technology and information security companies in Hainan, looking at other job adverts posted by the companies is illuminating…

Continue reading “Hainan Xiandun Technology Company is APT40”