Blog

Chinese police are currently investigating a large data leak that originated with a private security firm with apparent ties to Chinese state security. The data, which came from the contractor I-Soon and was uploaded to the coding repository Github.com, provides unique insight into the workings of a worldwide cybersecurity operation.

This is not the first time GitHub has been used to facilitate cybercrime. In January of this year, it was discovered that many bad actors were leveraging GitHub’s file and code sharing capabilities to distribute malicious payloads within legitimate traffic. The fraudsters were also able to direct this traffic to phishing websites.

In addition to documenting hacking operations and some of the tools utilized by the company, the released documents provided an insider’s view of the targets. These include at least fourteen foreign government bodies, institutions, and, rather unsurprisingly, Hong Kong-based organizations. It should be highlighted that the legitimacy of the documents has yet to be validated, despite the fact that most of the information corresponds to known threat vectors that have previously originated in the PRC.

I-Soon, also known as Shanghai Anxun Information Company, was founded in Shanghai in 2010 and has multiple offices throughout China. The company’s website, which is now offline, advertised a variety of cybersecurity services, many of which were detailed in the 190 megabyte breach. The client page included a list of Chinese regional security bureaus and public security departments, as well as the Ministry of Public Security.

The disclosed material consists of a variety of papers, screen shots, and private chat discussions. The list also includes some basic facts, such as complaints about the company’s poor salary and employee gambling tendencies. One of the most intriguing aspects of the breach is that AI translation has made the data available to far more analysts than before. The barrier to access is now significantly lower, allowing persons other than experienced Sinologists to examine the information more quickly and easily. For example, we were able to use ChatGPT Vision to OCR decode and interpret some of the document images in seconds, whereas it would have taken considerably longer previously.

The uploads began in mid-February, with hundreds of WeChat messages and marketing papers hitting Github servers. A vast number of sales presentation documents highlighting the company’s hacking expertise and previous vulnerabilities are amid the pile. According to sources, the material expressly names terrorism-related targets that the organization has previously hacked, including those in Pakistan and Afghanistan. The illegal documents purportedly include the fees collected for some of these hacking initiatives. According to one source, the business received $55,000 for gathering data from a foreign country’s Ministry of Economy.

There are currently little or no clues as to the leakers’ identities—or even their motivations—but it appears that a Taiwanese analyst spotted the secret stockpile on Github and quickly publicized it on social media. An unidentified I-Soon employee informed the Associated Press that an internal investigation is now underway, and that employees were instructed to “continue working as normal” while the investigation was ongoing.

While certainly not groundbreaking in terms of raw information, this breach provides the world with a unique and personal glimpse into the realities on the front lines of the murky global espionage industry. It turns out that much of it is probably not so much James Bond, but rather office parties and petty employees feuds.

If you did not receive the call or text you expected today and live in the United States, it may not be your fault. AT&T, as well as probably the other two major carriers in the United States, T-Mobile and Verizon, experienced an hours-long outage on Thursday, which is still occurring as of this writing.

And by outage, we mean no cell service at all for tens of thousands of consumers, primarily AT&T subscribers, across many states. I found out about it early this morning through a text from a television news network. The producer inquired if I had heard about the widespread network outage. I hadn’t, and I joked that Verizon was unaffected because we were communicating and texting on their network.

Following the conversation, I launched DownDetector, a useful online tool for determining the current health of practically any online or network service. It does not connect to these networks and instead relies on real-time client reports. Nonetheless, DownDetector painted an unsettling picture. At at 4 a.m. ET, all of the main networks experienced a significant increase in outage reports. That spread to smaller networks, which use the big guys’ network infrastructure and were also receiving outage reports.

As I browsed the AT&T, Verizon, and T-Mobile websites, I observed that there were no warnings, only advertisements for smartphone bargains.

I went to social media, where major corporations like AT&T and Verizon frequently interact directly with customers. There was nothing on X (previously Twitter), even in the replies section. Just more positive commentary about their networks, and on Verizon, a thread questioning if Beyonce could break the network (a leftover from her Super Bowl 58 commercial).

I posted something on X to measure the scope of the problem, and the quantity of responses surprised me.

It would be hours before any of the major networks came forward to address the issues. T-Mobile initially said that their network was in good working order. Verizon eventually responded with a similar response. However, I noted that both Verizon and AT&T had begun to respond to customer concerns about X, indicating that there were at least some issues.

Finally, AT&T provided me this formal statement:

“Some of our clients are experiencing wireless service outages this morning. We are working rapidly to restore their service. We recommend you to use Wi-Fi calling while service is restored.”

The “some” component sounded like wishful thinking, given that certain states, such as Texas, appeared to have lost virtually all AT&T service.

Verizon’s reply raised an issue that I had not before considered. A representative informed me that Verizon’s network is operational regularly. Some users encountered problems this morning when calling or messaging with clients served by another carrier. We will continue to watch the situation.”

What the carrier meant was that when a large network, such as AT&T, goes down, it makes it more difficult for other networks to function, therefore calls from Verizon and T-Mobile to AT&T users were also failing. It’s safe to think that Verizon and T-Mobile consumers may register that as their own network breakdown, because there would be no a means for them to learn about AT&T’s troubles.

So, what happened?

Still, the lack of information and explanation has led to some crazy speculation. Customers initially compared the outage to the current Julia Roberts apocalyptic film Leave the World Behind, in which all networks go down as part of the plot.

However, there is no indication that this is a cyberattack.

Some have proposed the possibility of a solar flare. NASA did detect a pair of strong ones in the recent 24 hours, and such flares are known to interrupt communications. However, the length of this outage contradicts that possibility.

Perhaps it is a hardware issue. Perhaps not.

While I understand that AT&T would prefer to do a post-mortem before revealing what caused the Big Outage of 2024, I don’t believe they can wait that long. These providers have already taken much too long to recognize the outage, and in today’s conspiracy theory climate, they cannot afford to keep us in the dark for hours.

Long-term, this may serve as a reminder that our cellular infrastructure is not as robust as we believe it should be. After many of us awoke to find our networks down, AT&T received an equally disturbing wake-up call.