On 16 February 2024, documents from Chinese information-security company i-Soon were leaked on GitHub. TeamT5, a Taiwanese cybersecurity group, located and downloaded the material on 21 February. The documents included contracts, internal meeting records, attack techniques, and evidence that i-Soon worked as a contractor for China’s Ministry of State Security, Ministry of Public Security, and People’s Liberation Army. They described intrusions into government systems, telecommunications companies, and NGO websites in Asia and Europe, with targets including India, Hong Kong, Taiwan, South Korea, and Malaysia; other reporting identified possible targeting in the United Kingdom, Czech Republic, European Union, and United States.
The BBC and NHK independently concluded that the leaked documents were authentic. NHK’s September 2024 investigation found close ties between i-Soon and the Chinese police and reported that the company supplied a manual for manipulating Twitter public opinion, including misinformation campaigns related to Japan’s Fukushima water discharge and a 2023 Taiwanese protest. The leak also exposed alleged deception of Chinese authorities, financial problems, weak product quality, and poor employee treatment. China’s Foreign Ministry denied responsibility and said it opposed cyberattacks, but the claims remain tied to documentary evidence and media authentication. In March 2025, U.S. prosecutors charged several people connected to i-Soon over alleged malicious cyber activity; the Commerce Department seized the company’s domain and VPS and imposed sanctions.
