I is for I-Soon — When State Hacking Became a Product Catalog

The Alphabet of Harm, letter I. A modality-bridge dossier: one entry in the OSINT archive, carried forward to what our own systems catch today, closed with a verdict — ENDED, CONTINUES, or MUTATED.

Verdict: MUTATED.

The Eleven-Year Photograph

Some harms are best understood as a before-and-after photograph taken of the same subject, years apart, under the same light. Letter I is one of those.

The before is 2013. Mandiant publishes APT1: Exposing One of China's Cyber Espionage Units, and for the first time the public sees, in forensic detail, a nation-state hacking operation with its mask off. It is a military unit — People's Liberation Army Unit 61398 — housed in a tower in the Pudong district of Shanghai, running on fiber-optic infrastructure that state-owned China Telecom provided "in the name of national defense," staffed by English-proficient soldiers, stealing terabytes from a hundred and forty companies across twenty industries. State espionage, performed in-house, by the state, in uniform.

The after is February 2024. A cache of internal documents from a company called i-SOON — Anxun Information Technology, also of Shanghai — appears on GitHub, and the public sees the same operation photographed again eleven years later. Except now it is not a military unit. It is a private contractor. The espionage is a product: a catalog of intrusion services, remote-access tools, and stolen-data access, sold to Ministry of Public Security and Ministry of State Security bureaus the way a software vendor sells licenses. The soldiers have become employees. The employees, per the leaked chat logs, complain about their pay.

That is the letter. The harm — Chinese state cyber-espionage — did not end when Mandiant tore the mask off APT1 in 2013. It mutated: from a military unit into a market. This is what commercialized statecraft looks like when the invoice leaks.

1. What the Archive Holds — The Military Origin Form

The LSN library holds the origin point in full: Mandiant's APT1 report, the document that made "APT" a household acronym.

Read for its form rather than its indicators, APT1 is a portrait of espionage as a state function performed by state personnel. Mandiant's tells are organizational, not just technical:

• Uniformed attribution. APT1 was assessed to be PLA Unit 61398 — a numbered military unit, not a criminal crew or a front company.
• State-provided plumbing. The unit operated from purpose-built facilities in Shanghai's Pudong New Area, on "special fiber-optic communication infrastructure provided by state-owned enterprise China Telecom in the name of national defense." The state didn't just direct the operation; it laid the cable.
• Salaried, screened staff. The role required personnel "proficient in the English language" — a hiring specification, the signature of an institution with a payroll and a job description.
• Industrial scale. Sustained, multi-year campaigns; 6.5 terabytes exfiltrated by a single persona; roughly 140 victims across 20 major industries.

This is the harm in its first form: vertically integrated. The state sets the objective, employs the operators, owns the infrastructure, and keeps the take. Mandiant's radical act was to prove that a government was doing this — to put a unit number and a building on an abstraction. The assumption, in 2013, was that exposure would raise the cost and slow the harm.

Method note. APT1 is HIGH confidence — Mandiant's attribution is one of the most thoroughly corroborated in the field's history, and the report is authoritative on the military, in-house form of the harm. What the archive does not contain is a document called "the i-SOON leak"; the library holds the origin (APT1) and the state's own framing (Microsoft, ODNI), while the i-SOON leak itself is treated below as the widely-reported public event whose shape the archive's trajectory predicted.

2. The Mutation — i-SOON's Catalog

In February 2024, someone posted i-SOON's internal life to GitHub, and the second photograph developed.

i-SOON (Anxun Information Technology) was not a unit. It was a firm — a private company in the cybersecurity contracting business, and what it contracted for was offensive cyber capability sold as a service. The leaked material read like the internal documents of any struggling B2B vendor, except the product was intrusion:

• A catalog. Product sheets for remote-access trojans and implants, intrusion-as-a-service engagements, and access to already-stolen data — packaged, described, and priced.
• Government clients. The buyers were Ministry of Public Security (MPS) and Ministry of State Security (MSS) bureaus and provincial police departments. The state was no longer the operator; it was the customer.
• A target menu. Leaked lists spanned roughly twenty countries and regions — India, Thailand, Vietnam, South Korea, Mongolia, Hong Kong — alongside domestic and diaspora targeting relevant to Uyghur and Tibetan communities.
• A grim workplace. Internal chat logs revealed thin margins, low pay, long hours, gambling, and sagging morale — the mundane texture of a company that happened to sell espionage.

Set the two photographs side by side and the mutation is exact:

The state did not stop hacking after APT1. It outsourced it — and in outsourcing it, gained deniability, price competition, and scale.

3. Why a Market Is Worse Than a Unit

The instinct is to read commercialization as a softening — surely a struggling contractor with morale problems is less fearsome than a PLA military unit. The opposite is true, and the reason is structural.

A unit can be exposed. A market re-sources. When Mandiant exposed Unit 61398, it named a building and a roster; there was a specific thing to sanction, indict, and disrupt. When the harm lives in a market of interchangeable contractors, exposing one — even leaking it wholesale, as happened to i-SOON — removes one supplier from a field of many. The demand side (the ministries) simply re-sources to the next vendor. The harm is no longer attached to a unit that can be dismantled; it is attached to a procurement pattern that regenerates.

Commercialization lowers the human threshold. A military espionage unit recruits ideologically-screened soldiers. A contractor hires whoever will take the salary. The i-SOON chat logs are the evidence: espionage against foreign governments and diaspora dissidents, executed as unglamorous, underpaid piecework by employees worrying about gambling debts. The moral distance between the workplace and the target collapses — not because the workers are monstrous, but because commoditization turns a grave act into a day job. That is a more scalable form of harm than one requiring true believers.

Deniability becomes a feature you can buy. When the operator is the state, attribution is damning. When the operator is a private company, the state gains a layer of plausible separation — an invoice instead of an order, a vendor instead of a unit. The mutation didn't just change who does the work; it changed how cleanly the state can deny it.

The Price List — Espionage at Race-to-the-Bottom Margins

The single most disorienting thing in the i-SOON material is not the targets. It is the prices. A leak of a state espionage operation ought to read like a defence budget; the i-SOON documents read like a struggling vendor's sales pipeline, and the numbers are startlingly small.

The reporting on the leak described access to individual mailboxes and accounts, and bespoke intrusion engagements, changing hands for sums that would embarrass a mid-market SaaS contract — access to a single high-value target's communications priced in the low tens of thousands of dollars, some data sets and softer targets far cheaper. The internal chatter showed staff haggling over contract values, chasing unpaid invoices from government clients, and grumbling that the work did not pay what the risk deserved. State-grade espionage, it turned out, was being executed on the margins of a commodity IT-services business.

That economic detail is not colour; it is the mechanism of the whole letter. Cheap espionage is scalable espionage. When breaking into a foreign ministry costs a state the price of a mid-level salary rather than a covert-operations program, the volume of targeting that becomes affordable expands enormously. The race to the bottom on price — multiple contractors underbidding each other for government work — does not make the harm less serious; it makes it more abundant. The same commoditization that letter H documented at the tooling layer, and that the surveillance letters documented at the vendor layer, here reaches the espionage layer: when the unit cost of intrusion collapses, intrusion stops being rationed. Every ministry office that could once afford one operation can now afford ten, from whichever contractor bids lowest this quarter.

4. The Market Explains the Fog

There is a decade-old frustration in threat intelligence that letter I quietly resolves.

Analysts have never been able to cleanly separate Chinese APT groups. The names overlap; the tools are shared; MITRE ATT&CK's catalogue of China-based intrusion sets — APT1, APT17 ("Deputy Dog"), Mustang Panda / Stately Taurus and the rest — is a tangle of groups that borrow one another's malware and infrastructure until the boundaries dissolve. Mandiant flagged the problem in 2013: researchers "focus on writing about tools that are shared between multiple Chinese APT groups without differentiating between the various actors."

i-SOON explained why the boundaries blur. In a contractor market, the same operators, the same tooling, and the same access are resold across multiple "groups" and multiple government clients. What analysts labelled as distinct APTs may in many cases be the same vendor's product surfacing under different banners for different buyers. The naming fog is not an analytic failure — it is the signature of commercialization. The unit of analysis was wrong: we were tracking actors when we should have been tracking suppliers.

This is the same lesson letter H taught at the tooling layer — that a thousand IPs can be one tool — moved up to the organizational layer: a dozen "APTs" can be one contractor. Find the persistent thing (the vendor) behind the disposable one (the group name).

5. The Bridge — What Our Systems Actually Catch

Honesty about scope, as in every letter, and here the honesty is stark: our sensors do not catch i-SOON. i-SOON's operations are bespoke, targeted, and aimed at ministries, telecoms, universities, and dissidents — not at a honeypot in a 44m² apartment in Iași. Nothing on the LSN wire is an i-SOON implant, and it would be a fabrication to imply otherwise.

What our systems catch is the commodity floor of the same national ecosystem. The honeypot's China dossier:

And the source infrastructure is the tell. The top ASNs are not obscure bulletproof hosts — they are the state-telco backbones:

This is not i-SOON. It is the automated, low-value tier — commodity scanning and brute-forcing — that runs on the same carrier plumbing Mandiant noted China Telecom provided to APT1 "in the name of national defense." The espionage market and the commodity-scan floor share the same national stack. A defender at the edge sees only the bottom of it; but the bottom sits on the same infrastructure as the top. The stack is continuous, from homelab-noise all the way up to ministry-espionage — which is precisely why letter I can be told from a honeypot at all. We do not see the catalog. We see the plumbing it runs on, busy at its cheapest layer.

6. The Same Shape as the Surveillance Letters

Step back and i-SOON snaps into a pattern this alphabet has already drawn twice.

Letter C (covert collection) and letter G (Greece / Cytrox Predator) documented the surveillance market: capabilities once held in-house by states, spun out to private vendors — Amesys, HackingTeam, NSO, Cytrox/Intellexa — who sell them as products, compete on price, and let the state hide behind a commercial invoice. i-SOON is the offensive-intrusion twin of that market. Predator sold phone implants to states; i-SOON sold network intrusion to state bureaus. The nouns differ — surveillance versus espionage, implant versus RAT — but the market shape is identical:

• A state capability is spun out to private vendors.
• The vendors sell it as a product, on a catalog, at a price.
• Competition and outsourcing blur state responsibility behind a receipt.
• Exposing one vendor does not end the harm, because the demand re-sources.

This is the through-line stitching the two halves of the alphabet together. The surveillance letters and the espionage letters are describing the same economic mutation applied to different technical modalities. Somewhere in the 2010s, the business model of state-sponsored digital harm shifted from operated to procured — and i-SOON is the leak that showed the procurement paperwork.

The Human Targets on the Menu

A price list is abstract until you read what was being priced. The i-SOON target material was not confined to rival governments and telecoms; it reached individual people, and the categories are where the letter stops being an economics lesson.

The leaked targeting relevant to Uyghur and Tibetan communities, to Hong Kong, and to diaspora and civil-society figures abroad is the part of the record that matters most and that we handle most carefully. These are not enterprise networks whose breach is a matter of intellectual-property loss. They are populations whose surveillance connects, in the broader documented record, to detention, coercion of relatives, and transnational repression. That a struggling contractor could be commissioned to help locate and monitor members of a persecuted minority, as a line item, for a fee — that is the specific gravity commoditization adds to the harm. It removes the friction. It turns the targeting of a diaspora dissident into a task ticket.

We state this the way we state everything in this alphabet: as record, not verdict. The i-SOON documents show the categories on the menu; independent reporting and prior human-rights documentation supply the context for why those categories are grave. We do not dramatize the victims, invent their fear, or claim knowledge of specific operational outcomes we cannot see. We hold up what the leak contained — that human beings, sorted by ethnicity and dissent, appeared as targets in a commercial contractor's paperwork — and we leave the moral weight of that fact where it belongs, with the person reading it. Vectors don't lie. They also don't grieve. That part is ours to do, or the reader's, and not the document's.

7. What We Do and Don't Claim

Precision about the limits, because this letter reaches further from our sensors than most.

What is HIGH confidence: APT1's military, in-house form (Mandiant, exhaustively corroborated). The existence and general contents of the i-SOON leak — the catalog, the government clients, the multi-country target menu, the morale-poor chat logs — are widely and independently reported public threat intelligence. The commodity floor on our honeypot (931 Chinese IPs on state-telco backbones) is our own direct measurement.

What is MEDIUM or lower: the precise contractual chain between i-SOON and specific ministry offices; the exact mapping of which leaked target belonged to which client; and — most importantly — the link between our commodity-scan floor and the espionage tier. That link is shared infrastructure, not shared operation. The 931 honeypot IPs run on the same national plumbing as the espionage ecosystem; they are not i-SOON's operators, and we do not claim they are. It is a statement about the continuity of the stack, not about attribution of the scanning to the contractor.

What we refuse to do: narrate the human targets for them. The diaspora communities in i-SOON's target lists are real people, and the record of their targeting is grave. We present that record and leave the judgment where it belongs — with the reader. Vectors don't lie; they also don't editorialize.

8. The Verdict — MUTATED

Chinese state cyber-espionage did not end when Mandiant exposed APT1 in 2013. Anyone who believed exposure would raise the cost enough to stop it was answered, eleven years later, by i-SOON: the harm had simply changed form. From an in-house military unit it became an outsourced contractor market — state-operated espionage turned into state-procured espionage, complete with a product catalog, government purchase orders, and a workforce grinding through targeted intrusions for a modest salary.

That is a mutation in the strict sense this alphabet uses it: not the end of the harm, and not its simple continuation, but its transformation into a more resilient form. The unit form could be exposed and, in principle, dismantled. The market form absorbs the exposure of any single vendor and re-sources the demand to the next — which is exactly why the i-SOON leak, for all its detail, did not end the thing it revealed. You cannot indict a market.

And it rhymes with the whole alphabet. Letter C's collection metastasized. Letter G's surveillance mutated from appliance to implant. Letter I's espionage mutated from unit to catalog. The common verb is the same: the harms of the surveillance-industrial and espionage-industrial worlds do not get closed; they get commercialized — and a commercialized harm is a market, and a market does not die when you expose one of its firms.

Verdict: MUTATED — state hacking became a product, and the product outlived the exposure of the unit that first performed it.

The Alphabet of Harm is a modality-bridge series: each letter takes one entry from the OSINT archive — truth as it was recorded at the time — and carries it forward to what the LSN sensor mesh, honeypot, and web-threat telemetry catch today, then closes with a verdict. We include what the record and the vectors show. We do not judge; we let the reader judge. I is for I-Soon. Next: J.