I-Soon Leak Exposes Chinese State-Linked Hacking Operations

A leaked trove of internal files from Chinese contractor I-Soon exposed tools, target lists, pricing documents, and operational details tied to cyber-espionage work reportedly conducted on behalf of Chinese government entities. Reporting indicates the material links I-Soon to intrusions and surveillance activity targeting foreign governments, telecommunications providers, ethnic minorities, dissidents, and online platforms, while also outlining services such as account compromise, data theft, social media monitoring, and infrastructure support for offensive operations.

The disclosures provide a rare inside view of China’s contractor ecosystem, showing how a private firm allegedly supplied hacking capabilities to public security and intelligence customers through a commercialized menu of services. Researchers and media reports said the leak included screenshots, chat logs, and project records that appeared to document operational workflows, victim targeting, and the broader relationship between state agencies and outsourced cyber operators, offering unusual transparency into how Chinese cyber-espionage campaigns may be organized and monetized.