C is for Chengdu 404 — The Double Dragon, State by Day and Criminal by Night

The Alphabet of Actors — Letter C. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED.

The first two letters of this register were Western surveillance vendors — companies that sold interception and filtering to states, and whose harm was in the selling. Letter C turns the register the other way, to a company that was the state's instrument rather than its supplier, and whose harm was in the doing. It also turns the geography: from Paris and Sunnyvale to Chengdu, and to a firm that presented itself, on paper, as an ordinary network-security business.

The firm is Chengdu 404 Network Technology Co., Ltd. The United States Department of Justice identifies it, in a 2020 indictment, as a cover for the intrusion set that the security industry has tracked for a decade under the name APT41 — and, in its earlier incarnations, as Winnti and Barium. Before proceeding, the standard of this series requires a line drawn in advance and held throughout: an indictment is a charging document, not a verdict. The men it names were never arrested, never appeared, and were never tried. Everything the indictment alleges is alleged, the presumption of innocence stands, and this dossier asserts no finding of guilt. What it examines is a public record and an industry assessment, and what that record shows about how consequence does and does not attach to a certain kind of actor.

Because APT41 is a certain kind of actor — the kind this whole register has been circling toward. Amesys named its own line. Blue Coat blurred it. Chengdu 404, if the allegations hold, simply stood on both sides of it at once.

1. The Actor: a network-security company that was two things

Read the indictment and the ordinary surface is the first thing that strikes you. Chengdu 404 is described as presenting publicly as a network-security firm, with a Technical Department and a unit for Big Data Development — the org chart of a normal software company. The named defendants — JIANG LIZHI, alias 'Blackfox'; QIAN CHUAN, alias 'Squall'; FU QIANG — are described as PRC residents and citizens with no residence in the United States. On paper, a company; in the charge, a cover.

What makes the actor distinctive is not that a Chinese firm is alleged to have conducted state-aligned intrusions; that is common enough to be a genre. It is the second business the same people are alleged to have run alongside the first. The security industry's canonical assessment of this group, from FireEye, carries a title that says everything in three words: Double Dragon — a dual espionage and cyber crime operation. The same operators, the report concludes, conducted state-directed espionage and financially motivated crime, from the same infrastructure, with the same tools.

This is rarer than it sounds, and it matters. Most nation-state groups are disciplined about the line between spying and stealing: espionage services do not, as a rule, let their operators moonlight as criminals, because crime is loud, crime draws police attention, and crime compromises the deniability that intelligence work depends on. APT41 is the documented exception. It is the actor that did both, and — this is the thesis of the letter — did both in a way where each half fed the other.

It is worth grounding the abstraction in who was on the other end, because a register of actors that never names the harmed is only half a record. The indictment and the industry reporting describe victims numbering more than a hundred organisations across a striking breadth of sectors \u2014 telecommunications and technology companies, universities, healthcare and pharmaceutical firms, think tanks and non-profits, and the video-game studios where the operation began \u2014 spread across many countries. The indictment also describes targeting connected to pro-democracy figures. Whatever share of these was state-tasked espionage and whatever share was for-profit crime, the two were served by the same intrusions, which is the point: the victim did not get to choose which of the actor's two motives had breached them. To the compromised university or hospital, the distinction between a spy and a thief inside the network is academic. The harm is the intrusion, and the intrusion was singular even when the purpose was double.

2. The Instrument: where the crime and the spying become one artifact

The two missions are not merely adjacent in APT41's record; they fuse, and the point of fusion is a single technical move that this series has already met in another form.

The group's origins, tracked as Winnti, were in the video-game industry — Kaspersky's early report was titled, pointedly, Winnti: More than just a game. The financially motivated half is easy to picture: breach a game studio, manipulate virtual currencies, launder the proceeds. But the breaches produced something more valuable to the other half of the operation than money. They produced code-signing certificates.

A code-signing certificate is the cryptographic stamp that tells an operating system a program comes from a real, identified company and can be trusted. Steal a game studio's certificate, and you can sign your own malware with it, so that an espionage implant arrives wearing the cryptographic identity of a legitimate software firm — trusted by the OS, waved past defences, blessed by the very system that trust is supposed to protect. This is the artifact where the two businesses become one: a certificate stolen in a for-profit crime is used to authenticate a state-directed spying tool. The crime armed the espionage, directly and literally.

Set that beside Letter B and the family resemblance is exact. Blue Coat's box exploited the trust chain by holding a certificate the client had been made to trust; APT41 exploited it by stealing a certificate the world already trusted. Neither broke cryptography. Both abused the thing cryptography exists to certify — trust in an identity. The group's other signatures extend the same principle: software supply-chain compromise (poison a legitimate vendor's update and reach all its customers through a channel they already trust) and DLL side-loading (drop a malicious jli.dll so a legitimate, signed process loads the payload in a trusted context). The through-line of the entire toolkit is not force. It is borrowed legitimacy.

Borrowed legitimacy also explains the actor's reach, because a supply-chain compromise multiplies a single breach into many. When you poison the update of a widely-used piece of software, every customer who installs that trusted update installs your payload with it; the group's assessed supply-chain operations reached far beyond the one vendor breached, because the vendor's own distribution did the spreading. This is the same economics as a stolen certificate \u2014 compromise one trusted thing, inherit the trust of everyone who relied on it \u2014 scaled from a single file to an entire customer base. It is why trust-exploitation is the preferred method of a sophisticated actor: force costs effort per target, but borrowed legitimacy costs effort once and is repaid by every party downstream who trusted the thing you stole or poisoned.

3. The Bridge: what the LSN systems see of this actor

The Alphabet of Actors is a bridge series, and for APT41 the bridge is unusually direct, because the platform writing this has the actor in its own detection corpus.

The LSN archive carries apt_apt41.yar — a YARA rule, of exactly the kind Letter Y examined, that detects the APT41 malware families POISONPLUG and HIGHNOON by hash and by string. The entity graph attributes state-aligned infrastructure the same way it consolidates any operator, through reused fingerprints and shared indicators. In other words, the platform can do to APT41 precisely what FireEye and the DOJ did: name it, detect it, attribute it. Detection of this actor is a solved problem, at the honeypot's scale as at the nation's.

And that is exactly where the bridge turns cold, because detection is the whole of what any of us can do. The DOJ named the company and the men and detailed the intrusions, and APT41 kept operating; public reporting documented the group active in Africa as recently as 2024, four years after the indictment. The platform can hold the YARA rule, block the infrastructure, publish the dossier — and the actor, sheltered behind a state, is no more deterred by the honeypot's detection than by the Department of Justice's. This is the single-crew restatement of the argument that closed the first alphabet: attribution total, deterrence zero. APT41 is what Letter Z looks like when it has a name and an org chart.

There is a quieter half of the bridge, too. The honeypot does not catch state espionage in flight \u2014 APT41's targeted intrusions do not come knocking at a decoy SSH port \u2014 but it catches, constantly, the commodity end of the same techniques. The trust-abuse logic APT41 practises at the high end is the same logic the honeypot sees every day at the low end: droppers that masquerade as legitimate binaries, scripts that abuse trusted system tools, payloads that ride a signed process. The 246 files the honeypot captured and the thousands of intrusion attempts it logs are the mass-market version of the same principle a state contractor refines into a signature. Detection scales down cleanly; deterrence does not scale up. The platform can recognise the technique at every tier and stop the actor at none of the tiers that are protected.

4. The Accountability: a gradient that reaches its end here

Three letters into this register, an unintended pattern has become clear, and it is worth naming because it is the register's real subject. Consequence, across these actors, attaches not in proportion to what they did but in proportion to how reachable they are.

Amesys is in France. Its executives could be, and were, charged; the case proceeds in a court with jurisdiction over them. Blue Coat is American, large, and lawyered; the consequence for the Syria deployment skipped past it to a reseller in Dubai, small enough to fine and too small to resist. And Chengdu 404 is in the People's Republic of China, its named men indicted by a country that cannot reach them, in a jurisdiction that will not extradite them, under the protection — the indictment alleges — of the state they served. The three letters form a gradient from reachable to untouchable, and consequence tracks the gradient exactly.

The single most revealing detail sits inside the APT41 case itself, and it proves the rule without needing the comparison. Two of the charged co-conspirators were Malaysian businessmen, tied to the financially motivated game-currency side of the operation. They were reachable — and they were arrested, in Malaysia. The PRC hackers, charged in the same matter, were not. Same case, same prosecutors, same evidence; the difference in outcome was geography and protection, nothing else. Reachability, not culpability, decided who saw the inside of a courtroom.

And the indictment offers the reason in what it alleges were the actor's own words. It alleges that Jiang discussed his connection to the PRC Ministry of State Security and a resulting protection — protection, he is alleged to have said, that would hold 'unless something very big happens.' If the allegation is accurate, it is the entire bargain stated aloud: the state tolerates the crime because it values the espionage, and the operator understands his immunity as conditional on not embarrassing his protector. That is the mechanism beneath the whole zero-accountability thesis, and here it is, allegedly, in the mouth of the man it protects.

None of this means the naming was pointless, and the register would be dishonest to imply it. An indictment of an unreachable actor is not an arrest, but it is not nothing either: it converts a private intelligence assessment into a public, evidenced, on-the-record accusation; it constrains the named individuals' travel for the rest of their lives, because the world is larger than the state that shelters them and an extradition treaty waits in many of its airports; it lays the evidentiary groundwork for sanctions against the individuals and their front company; and it signals to allied services and private defenders exactly whom to watch. These are real, if modest, consequences \u2014 they raise the cost of the operation without stopping it. The honest accounting is neither that naming achieves nothing nor that it achieves justice. It achieves friction. Whether friction is worth the cost of burning the intelligence that produced it is the genuine debate, and it is a harder question than either the cynics or the enthusiasts allow.

5. The counter-narrative, steelmanned

The strongest challenge to this dossier is not a defence of the conduct but a caution about the certainty, and it deserves full weight.

Attribution is hard, and industry attribution is not proof. 'APT41' is an analytical construct — a cluster of indicators that firms like FireEye and Microsoft assess, with stated confidence, to be one actor. It is not a jury finding. The named defendants were charged by a government that is a strategic adversary of theirs, in absentia, with no defence tested against the evidence; the PRC rejects such indictments categorically and characterises them as politically motivated. A careful reader should hold that the 'Double Dragon' thesis, however well-supported, is an assessment; that the individuals are legally innocent until a court that has heard them says otherwise, which no court has; and that the neat 'state protects the criminal for his espionage' narrative is exactly the kind of tidy story that intelligence disputes produce and that deserves suspicion precisely because it is satisfying.

This dossier accepts all of that as method, and it has tried to write within it — every allegation flagged as an allegation, no finding of guilt asserted, the industry attribution named as assessment rather than fact. Where the caution stops short is in mistaking 'not judicially proven' for 'not known.' The convergence here is unusually strong: multiple independent vendors, across a decade, tracking the same infrastructure, malware and certificates to the same cluster, corroborated by a detailed government indictment and by continued observed activity. That is not proof beyond reasonable doubt in a courtroom sense, and this dossier does not claim it is. But it is a body of evidence that a forensic reader can weigh, which is the whole point of publishing it. The presumption of innocence governs what a court may conclude. It does not require a witness to unsee the record.

And the record, in the end, is the only jurisdiction this platform holds. It cannot indict, cannot sanction, cannot constrain a passport. What it can do is what a witness does: set down what the evidence supports, flag what is assessment and what is proof, name the harmed alongside the accused, and refuse the two failure modes that let a state-sheltered actor rest easy \u2014 the silence that pretends the actor is unknown, and the overreach that discredits the naming by claiming more than the evidence bears. Held between those two, the dossier is neither a court nor a press release. It is a forensic record, offered to a reader who is trusted to weigh it. That is the most an honest witness can do about an actor it cannot touch, and it is exactly what the closing letter of the first alphabet argued the whole enterprise is for.

6. Verdict — INDICTED, and ACTIVE

Chengdu 404, as the record alleges and the industry assesses, was a network-security company that was also a state espionage contractor that was also a criminal crew — three things in one org chart, with the crime funding and arming the spying and the state's tolerance of the crime serving as payment for the spying. Its signature was borrowed legitimacy: stolen certificates, poisoned supply chains, trusted processes turned against the trust that named them.

The verdict's first word is the one the United States supplied: INDICTED. The company was named, the men were named, the intrusions were detailed, the charging document was published. Attribution, by every party that attempted it — FireEye, Kaspersky, Microsoft, the DOJ, and at its own small scale this platform — was complete. If naming were consequence, APT41 would be finished.

But naming is not consequence, and so the second word is the one that makes this the endpoint of the register's accountability gradient and the actor-level proof of the first alphabet's close: ACTIVE. Four years after the indictment, the group was documented operating in Africa. The named defendants remain in the PRC, beyond any court that charged them, protected — allegedly — by the state whose interests the espionage served. The indictment produced a permanent public record and precisely zero cessation. For a state-sheltered actor, an indictment is not a threat to the operation; it is a footnote in the operation's history.

The register opened, in Letter A, on the rare case where naming reached a courtroom. Three letters in, it has arrived at the ordinary case, which is the true one: an actor perfectly named and perfectly untouched, still working, because the only jurisdiction that could stop it is the one protecting it. The platform can detect the malware, attribute the crew, publish the file. It cannot do the one thing that would matter, and neither, so far, could anyone else. What is left is the witness — and, this series maintains to the end, the witness is not nothing, because the record is the one asset a protecting state cannot revoke.

The Alphabet of Actors continues. Verdict: INDICTED, and ACTIVE. Confidence: HIGH on the industry attribution, the dual-purpose thesis, the trust-exploitation toolkit and the continued activity — drawn from the DOJ indictment, FireEye/Kaspersky/Microsoft/MITRE assessments in the LSN archive, and the platform's own apt_apt41 YARA rule. The legal thread is stated strictly as charge and allegation, not adjudicated fact; the defendants are presumed innocent and were never tried. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges; the court, in this case, was never allowed to.