I-SOON

i-Soon, also known as Anxun Information and Shanghai Anxun Information Technology Co., Ltd., is a Chinese cybersecurity contractor founded in Shanghai in 2010, with operations in Chengdu. It provides hacking-for-hire services, intrusion technologies, and intelligence-processing platforms to Chinese government customers, including the Ministry of Public Security (MPS), Ministry of State Security (MSS), and provincial and municipal security bureaus. Its operations support state intelligence collection and surveillance of foreign governments, overseas dissidents, and other targets of interest to Chinese authorities. Its targets include government agencies, foreign ministries, military organizations, telecommunications providers, universities, healthcare institutions, media organizations, religious organizations, and civil society. Operations span Asia, Europe, Africa, and the Americas, including intrusions against U.S. federal and state agencies. The company operates within a contracting and subcontracting ecosystem that connects government tasking, freelance hackers, access brokers, and other cybersecurity firms. i-Soon's services encompass initial compromise, data exfiltration, and exploitation of stolen information. Its tooling includes phishing-based credential collection, token-based email collection, remote-access implants, keylogging, screen capture, file transfer, and pivoting through compromised hosts. It also supplies platforms for ingesting, searching, translating, and analyzing large collections of stolen emails and documents. Associated FishMonger, also known as Earth Lusca, activity has used SprySocks backdoors, including Windows variants employing kernel-level concealment of processes, files, and network connections. Activity attributed to i-Soon has been tracked under names including Aquatic Panda, Red Alpha, RedHotel, Charcoal Typhoon, Red Scylla, HASSIUM, Chromium, and TAG-22. These tracking labels describe overlapping activity clusters and should not be treated as exact organizational equivalents. The company also has documented connections to the APT41 contractor and tooling ecosystem. Internal documents exposed in February 2024 revealed extensive government contracting and operational relationships. Eight employees, including co-founders Wu Haibo and Chen Cheng, were indicted in the United States in March 2025. The United Kingdom sanctioned the company in December 2025, followed by European Union sanctions against the company and its co-founders in March 2026.