#threathunting
I'm currently doing a writeup on the I-S00N Chinese government spyware data leak in real time over on the bird site. Buckle up there are a lot of juicy information.
https://twitter.com/AzakaSekai_/status/1759326049262019025
安坂星海 Azaka 🐼 VTuber (@AzakaSekai_) on X

#threatintel someone just leaked a bunch of internal Chinese government documents on GitHub https://t.co/BO8N64A7kF

X (formerly Twitter)

I'm done typing out most of the details from this ONE pdf file on the bird site. Key highlights includes

- Twitter information dumper (DMs, email, phone number, etc.)
- RATs designed for Windows, macOS, Linux, iOS, and Android.
- Claims to support all iOS versions without jailbreaking (keep in mind this was in 2020 - not sure if it still applies).
- Specifically crafted devices for attacking internal networks, designed with portability in mind.
- Specialized hardware for agents working overseas to establish a Tor-like network.
- APT attack scenario framework
- "Skywalker": User lookup database used to look up IRL user data including phone number, name, email, etc.; the said data can then be fed into an in-development system to look up their Twitter, Facebook, etc.

Please do go through the Twitter post, as there are a lot more screenshots there for this specific document.

All of this information was found in a product manual dated 2020 in the leak.

#apt #threatintel

The rest of the repo seems to be mostly low-res screenshots (presumably thumbnails?) of various WeChat logs, and random camera shots of random notes.
> "you sure you can take it down?"
> "of course"
> "if not i'll return/refund immediately"
> "80% chance of pwning it"
> "mail server! mail server!"
> "can bypass traffic monitoring"
North Macedonia related documents
Username `Tozsyj`
Some RAR password
Some poor person's Facebook reset password page
Another one - also note that this and the last one's Facebook design is quite old. Might be from ages ago.
Something about Indian Employees' Provident Fund Organisation

> Please double check if the 4 organizations are correct:
> afaps.mail.go.th Army Headquarters
> asean2019.go.th Association of South‐East Asian Nations
> navy.mail.go.th Ministry of Defense Navy
> railway.co.th Thailand Railway

> There are multiple 数字经济与社会部, please check which one do you want:

Email addresses belonging to Loxinfo and Chiang Mai University

Data sheet, presumably containing the records for each of the listed companies.

> Myanmar MPT Telecommunication - 11GB - user information, including phone number and name
> Vietnam Airlines - 1004MB - user flight information, including passenger ID, work title, destinations, etc.
> Vietnam unnamed company - 38.9MB - user information including address, email address, password, login details, names, etc.
> Myanmar unnamed company - 4.03GB - phone numbers etc.

"client says NATO might not be possible"

Edit: Part 2 https://infosec.exchange/@still/111954965043069948

Still (@[email protected])

Part 2 as I think I hit Mastodon's thread length limit.

Infosec Exchange
@still keep up the good work 👍
@still 名字看起來應該是是維吾爾人😜​
@still I would like to read about this, but I can't see Twitter posts. Has this been reposted anywhere else or is there a blog article?
@jackemled https://threadreaderapp.com/thread/1759326049262019025.html best i've got for you is someone else doing the unrolling
Thread by @AzakaSekai_ on Thread Reader App

@AzakaSekai_: #threatintel someone just leaked a bunch of internal Chinese government documents on GitHub github.com/I-S00N/I-S00N/ From the looks of it, it looks like a bunch of spyware developed by the company 安洵信...…

@still wow, great work, thank you for the time and effort you put into this
@still wow great work going through all this. Can you see any unique methods or capabilities if compared to other similar (chinese state sponsored) actors? Or anything of special interest? I have looked through all of your thread but im not any expert myself, but curious.

@still I think everyone is missing the good stuff.

Look at the BEELINE files.

The Lat and Long are reversed (I think). Interesting locations.
Interesting headings ... not sure the data matches ....