State Secrets for Sale: Inside China's Hack-for-Hire Ecosystem

State Secrets for Sale: Inside China's Hack-for-Hire Ecosystem

In the shadowy world of global cyber espionage, secrets are currency and recently, some of China’s most sensitive digital assets hit the open market.

Two recent leaks, dubbed the VenusTech and Salt Typhoon dumps, have peeled back the curtain on a structured, state-affiliated hacking ecosystem operating within China. Posted to DarkForums, the successor to BreachForums, these leaks expose a rare look into the inner workings of the Chinese cyber industrial complex.

The VenusTech Leak: Government-Backed Espionage-as-a-Service

VenusTech, a Chinese cybersecurity firm with ties to government entities, had its internal documents leaked, revealing a chilling level of operational maturity. Among the documents:

• Spreadsheets of targeted countries and agencies, including intelligence objectives in Taiwan, South Korea, India, Croatia, and Thailand.
• Delivery schedules for stolen data for example, recurring access to email server data from the Korea National Assembly, priced at ¥65,000 (about $9,000 USD).
• Proof of commercial espionage-for-hire, with VenusTech selling data and services directly to Chinese government clients.

This wasn’t just a rogue operator. It was a business model complete with pricing, logistics, and government purchase orders.

Salt Typhoon: A Look Inside State-Grade Cyberwarfare

While VenusTech showed the monetization of espionage, Salt Typhoon revealed the infrastructure and people behind the attacks.

Salt Typhoon is a codename for a threat actor group believed to work under China's Ministry of State Security (MSS). This leak included:

• PII of at least 15 Salt Typhoon employees, including names, Chinese ID numbers, phone numbers, and geolocation data all cross-validated with public databases.
• Samples of 242 compromised routers, including Cisco hardware, suggesting widescale surveillance and infrastructure compromise.
• Financial records tracing payments from military front groups (linked to the People’s Liberation Army) to major cybersecurity vendors like Qi’anxin and VenusTech—often funneled through obscure firms such as Sichuan Juxinhe and Huanyu Tiangiong.

One contract even outlined technical services between these shell companies and Tongfang Co., a massive military-linked state-owned enterprise.

A Hacked Supply Chain of Espionage

What these leaks ultimately reveal is the commodification of state-sponsored hacking. China's offensive cyber apparatus isn’t just staffed it’s outsourced, financed, and deeply entangled with supposedly private firms.

And perhaps most concerning: it’s leaky.

Internal, sensitive documents once meant for the eyes of Chinese government agencies—are now floating around criminal forums. This suggests not only operational vulnerabilities but growing discontent, insider threats, or sloppy opsec within China’s hacking machine.

Global Implications

These revelations are more than just intelligence goldmines for researchers—they represent a new era in cyberwarfare, where state secrets can be bought, sold, or leaked with a few clicks.

Key takeaways:

• Cybercrime meets cyberwarfare: The lines are blurred. What was once espionage is now a service with a price tag.
• Front companies are evolving: Many newly exposed vendors have not yet been sanctioned—highlighting gaps in current geopolitical responses.
• Internal leaks are increasing: This may indicate factionalism, poor internal controls, or mounting pressure from within China’s own cybersecurity workforce.

Final Thoughts

The VenusTech and Salt Typhoon leaks might not rival the scale of previous megadumps, but the quality and specificity of the intel is unmatched. For the first time, we’re seeing the receipts who paid, who executed, and who got caught in the middle.

In a world where information is power, these leaks serve as a stark reminder: even the most powerful nations are vulnerable to their own shadows.

 

Brian R Wilson (GigaTech1) 7-10-25