ISOON

The iSoon campaign, a series of related activities with a unified goal, was centered around the Shanghai Anxun Information Technology (Anxun; aka iSOON), a key Chinese InfoSec vendor. This campaign saw a significant leak of information that put the spotlight on China's growing hacking industry. The compromise of iSoon led to the exposure of internal documents, revealing some of the inner workings of the firm. As per the leaked data, iSoon, despite being a relatively small player in the Chinese cybersecurity community, claimed to have breached organizations in over 30 countries using its sophisticated tools. The KEYPLUG malware campaign was linked to iSoon, as shown in Figure 11. Further investigations into this leak could provide insights into the involvement of APT41 or related entities, suggesting a plausible connection between them and the iSoon Leak incident. The compromised company, along with Sichuan Silence Information Technology and a university, are located in Chengdu, Sichuan - a hotspot for China's burgeoning hacking industry. According to threat research firm Natto, at the time of the leak, iSoon operated out of six locations in China and had about 160 employees. However, only about 26 of these employees held a four-year university degree and were involved in sensitive operations. Notably, one complaint from Chinese hackers revealed through the leak was low pay, illustrating the challenging environment within the cybersecurity industry in China. Despite these challenges, private sector companies like iSoon continue to develop valuable tools for state and local authorities.