A Hainan intelligence bureau allegedly used a front company to run a global technology-hunting campaign

01 / Executive brief

Executive summary

The United States alleged that from 2011 through 2018, officers of the Hainan State Security Department—a provincial arm of the PRC Ministry of State Security—used Hainan Xiandun Technology Development Company as a front to recruit and manage hackers. Four named defendants were charged with a campaign targeting companies, universities, research institutes, governments, and other organizations. S1 S3 S5

The alleged target list read like a strategic technology portfolio: submersibles and autonomous vehicles, aircraft servicing, chemicals, genetic sequencing, Ebola research, and railway information, among other sectors. U.S. agencies and the United Kingdom's National Cyber Security Centre publicly attributed the activity to APT40 and published technical indicators, but the indictment has not produced trial findings; the named individuals are presumed innocent unless proved guilty. S2 S4 S5 S6

FBI wanted poster showing three identified APT40 defendants and a silhouette for a fourth — document
The FBI's official APT40 poster identifies Zhu Yunmin, Wu Shurong, Ding Xiaoyang, and Cheng Qingmin; no photograph is shown for Cheng. A wanted poster records accusations, not convictions.
Federal Bureau of Investigation · Public domain U.S. government work ↗

02 / The vignette

What happened

A front company supplied the operating layer

According to the indictment, Hainan intelligence officers coordinated hackers through Hainan Xiandun rather than operating only under visible government names. The company allegedly helped recruit technical personnel, provide a workplace, and give state-directed activity a commercial exterior. S4 S5

The campaign followed useful technologies

Victims were not confined to one defense contractor or one country. Prosecutors alleged intrusions against dozens of organizations in at least twelve countries and identified targets spanning maritime systems, aviation, biomedicine, transportation, and research. That breadth is the central vignette: cyber access can be managed as a continuing collection program rather than a one-company theft. S1 S2 S5

Attribution is not adjudication

CISA, the FBI, and the United Kingdom's National Cyber Security Centre released attribution statements or technical advisories linking tools and methods to APT40, while the FBI published a wanted poster naming Zhu Yunmin, Wu Shurong, Ding Xiaoyang, and Cheng Qingmin. Those are official allegations and attributions. Because no cited judgment establishes guilt, this file uses allegation language throughout and does not count the case as adjudicated. S2 S3 S4 S6

03 / Anatomy

How access became transfer

This six-part framework asks the same questions of every file. Each stage carries its own evidence state; a listed stage can be alleged, inferred, interrupted, disputed, or not established. The structure does not manufacture a completed transfer or harm.

01

Relationship context Officially alleged or attributed

Front-company structure alleged

Hainan intelligence officers allegedly used Hainan Xiandun to recruit and employ hackers. S4 S5
02

Access assessed Officially alleged or attributed

Remote entry into victim networks

Advisories attributed exploitation, credential theft, and other intrusion techniques to the campaign. S2 S4
03

Acquisition assessed Officially alleged or attributed

Strategic data targeted

The indictment alleged collection from technology, research, government, and industrial victims. S5
04

Movement assessed Officially alleged or attributed

Network exfiltration alleged

Compromised infrastructure allegedly enabled information to move from victim systems to campaign operators. S4 S5
05

Downstream use assessed Not established

Intelligence objective attributed; downstream use not established

U.S. and allied authorities attributed the campaign to a PRC intelligence bureau seeking strategic and commercial information, but the cited record does not establish how any acquired information was later used. S2 S5 S6
06

Consequences assessed Documented

Names, indicators, and charges published

The United States unsealed charges and agencies released defensive indicators, but no conviction followed in the cited record. S2 S3 S5 S6

04 / Evidence boundary

What is established—and what is not

Established in the record

U.S. authorities formally charged four people and publicly attributed the campaign to the Hainan State Security Department. S2 S3 S5 S6
Government advisories published technical behaviors and indicators associated with APT40 to support network defense. S2 S4

Uncertain, limited, or unresolved

The charges have not been adjudicated in the cited record; the named defendants are presumed innocent and the alleged victim counts and objectives have not been tested at trial. S3 S5

Subject response / procedural context

The reviewed U.S. sources present the indictment and attribution. They do not contain an adjudicated response from the defendants or a trial-tested PRC government account. S2 S5 S6

05 / Sequence

Timeline

2011

Campaign period begins

The indictment alleged that the charged conspiracy operated from at least 2011. S5
2018

Charged campaign period ends

The public charging document described activity continuing through 2018. S5
2021-07-19

Indictment and advisories released

DOJ, FBI, CISA, and partners named the actors and published attribution and defensive guidance. S2 S3 S4 S5 S6

06 / People and institutions