APT41__2024__i-soon-data-leaks-en.pdf

Unit 42 analyzed a GitHub-posted data leak from Chinese IT security services company i-Soon (Anxun) that appears to show commercial development and support of espionage tools. The leaked chats, manuals, and artifacts link i-Soon to prior Chinese-affiliated APT campaigns — including a 2022 Comm100 supply-chain trojanization and 2019 Poison Carp activity — and reveal use or distribution of known malware/control panels (Treadstone, ShadowPad), associated IPs, domains and a sample SHA256.