In Part 1 and Part 2 of our ZRON leak reports, we evaluated the sources of the leaked data and cross-checked Chinese-language open-source information about ZRON. We then analyzed ZRON’s full product catalogue, customer accounts, and use of artificial intelligence (AI). In particular, we highlighted which provincial Public Security Bureaus and related Ministry of Public Security entities were interested in ZRON’s products and services. Finally, we assessed that the ecosystem connecting government and intelligence agencies with China’s commercial hackers for hire — for-profit cybersecurity companies — largely resembles what we identified in the 2024 i-SOON leak. At the same time, we argued, this environment is evolving, as competition among vendors intensifies and government agencies face uncertain budgets, tighter procurement processes, and organizational restructuring.
How did ZRON navigate this complex environment? As the Natto Team previously noted, the i-SOON leak – whose documents dated from 2020 to 2022 – vividly depicted the intricate relationships among information security companies, China’s public security and state security agencies, other government bodies, and the military. Within this landscape, information security firms have cultivated an ecosystem in which they engage with diverse government entities, operating both collaboratively and independently. In some instances, these companies competed fiercely and actively recruited talent from one another; in others, they collaborated to manipulate contract bidding processes. Like i-SOON, ZRON leveraged a network of cybersecurity companies to serve its clients and maximize profits. As a member of this ecosystem, ZRON has also contributed to the state’s cyber capabilities.
Unlike the i-SOON leak, however, the ZRON leak revealed two factors that increasingly shape demand for cybersecurity products and services: government clients’ performance-assessment requirements and a tiered open-source intelligence adoption system spanning regional, ministerial-level and top-level intelligence consumers. For ZRON and other companies in the ecosystem, these factors have created stronger incentives to develop offerings that meet government clients’ needs.
In Part 3 of the ZRON leak series, we first characterize the companies mentioned in the leak. What kind of companies are they, and what are their relationships with ZRON? How does this ecosystem likely function? Next we examine the Chinese government clients in particular, highlighting the tiered open-source intelligence adoption system and increasing role of performance-assessment requirements – which roughly correspond to key performance indicators (KPIs) of Western parlance. How do these developments drive government intelligence collection? Finally, we look at the expansion of China’s cybersecurity industry and ask what it means for China’s overall cyber capabilities.
For the full list of companies identified in the ZRON leak, please contact the Natto Team at [email protected].
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<p>
<a href="https://www.nattothoughts.com/p/the-zron-leak-part-3-what-does-it" rel="noreferrer" target="_blank">
Read more
</a>
</p>
Article Link: The ZRON Leak, Part 3: What Does It Take for a Little Fish to Survive Among Sharks?