Welcome back Intrusion Truth readers, it’s been a little while. We hope you’ve spent the time reflecting on our findings from our previous set of articles on suspicious happenings in and around Wuhan. We don’t know about you, but even after six articles we felt we had some unfinished business with Wuhan Xiaoruizhi and friends. So, we put together the remaining information we had to give you a few more interesting snippets on APT31’s operational infrastructure.
For our first annex, we will tackle a lead that was buried in the information leaked by our disaffected Xiaoruizhi insider, of articles 4 and 5. That employees of Xiaoruizhi (AKA APT31 actors) had moved to new companies in 2020.
We set out to investigate these claims and see if we could identify some, or all, of the follow-on destinations of Xiaoruizhi’s class of 2019. And, we are pleased to report, we had a pretty good run.
Let’s begin with the link that was most straightforward to piece together. A company we named, briefly, in an earlier article.
A touch of in-depth Googling on some of the known Xiaoruizhi actors brought up the below spreadsheet, which proved to be a goldmine. A spreadsheet of Wuhan City-based individuals in receipt of employment/training subsidies, which, luckily for us, includes the companies they are employed by. Poring through this enormous document, we hit the jackpot. Wuhan Shenzhou Human Resources Development Services.
As of October 2020, no less than 12 Xiaoruizhi actors who we named previously were now on the books of Wuhan Shenzhou Human Resources Development Service.
We again see some familiar characters – graduates of Wuhan Kerui Cracking Academy who left feedback. Xiong Wang, Li Yilong, Hu Jiaxing (who we did not name but can be found on Kerui’s website) and Huang Zhen. Moving onto a human resources department can’t have been part of their plan following their elite hacker training, right?
Wuhan Shenzhou Human Resources appears to be legitimate, at least in the sense that it’s probably a real company. It’s got its own website, which is a start, on which it claims to have 500 square meters of office space and a labor force of 4,000 people. Impressive.
WSHRS claims to specialize in labor dispatch, labor outsourcing, subcontracting, and headhunting, among a number of other noble pursuits. But this provides a clue. The practice of labor dispatch in China is a process by which employees are hired through an employment services agency and contracted out to an end user, as opposed to the traditional practice of direct employment. The workers sign contracts with the employment services agency, rather than the end user of their services. It’s our best guess here at team I-T that Wuhan Shenzhou Human Resources now acts as labor dispatch for these 12 APT31 employees, and dispatches them out to – well – APT31 or as others may know it; the MSS’ Hubei State Security Department’s cyberespionage program.
Hubei Chuangxin
Our next front company came to us via the gift that has given generously throughout this investigation. Social insurance. Specifically, the social insurance records for Liao Xuliang and Zhou Yin.
For our purposes, the most interesting rows of these documents are at the very bottom right. For both Liao and Zhou the entry marked 201912, i.e. the insurance contribution for December 2019, was registered to Wuhan Xiaoruizhi. But from 202001, January 2020, onwards, insurance contributions are registered to Hubei Chuangxin Human Resources Department.
Readers, if you’re anything like us, the span of your interest in Chinese Human Resources Service providers will be limited, so we will spare you too much detail here. But it certainly looks, per the screenshots below, like Hubei Chuangxin provides labor dispatch services in exactly the same way as Wuhan Shenzhou, that is, most probably contracting Liao and Zhou back to the MSS (APT, oops – sorry; typo…..)
Wuhan Juge/Hubei Win Future
Moving on. A contributor speaking on condition of anonymity provided us with information that a further 12 former employees of Wuhan Xiaoruizhi Science and Technology were now in receipt of subsidies under a separate company, Wuhan Juge Enterprise Management:
- Chang Zhen 常振
- Zhang Chaofeng 张超锋
- Wang Guangcan 万光灿
- Tu Meng 涂梦
- Yan Wenlong鄢文龙
- Gu Chengwu 顾成武
- Liu Chencheng 刘晨成
- Huang Jin 黄金
- Zuo Hequn 左鹤群
- Li Haiqing 李海青
- Yuan Hongxi 苑红曦
- Hou Qiang 侯强
Wuhan Juge appears to have a number of branches across Wuhan City, and has a wildly diverse business portfolio, which includes (deep breath): Enterprise management, marketing planning, human resource services, loading and unloading, general cargo warehousing services, storage (excluding dangerous goods!), communication engineering construction and maintenance, and, most randomly, sales of automobiles. Seriously impressive range for a company staffed in large part by APT31.
Digging into the shareholders and management of Wuhan Juge we found something interesting. The main shareholders are as follows:
- 武汉云栖传媒有限公司 Wuhan Yunqi Media Co. Ltd. – main shareholder.
- 腾飞 Teng Fei
- 王道强 Wang Daoqiang
All three are also shareholders of another company called Hubei Win Future Enterprise Management AKA Hubei Win Future Technology. Similarly, the legal representative, GAN Chunyan, is the same for both companies, as is the registered phone number, 18995647475:
So, there is considerable overlap in personnel/management between Juge and Win Future. Hubei Win Future, according to a congratulatory article about a semi-recent recruitment drive, is a human outsourcing company of China Telecom. It focusses on the recruitment of technical personnel and providing technical talent services for China Telecom’s business.
According to the article, prospective employees can expect to enjoy all of China’s most significant holidays as leave. Lucky them.
We had a source do some digging into Hubei Win Future to see if the overlap with Juge held any significance for us. And what do you know? We found another Xiaoruizhi employee. Cheng Feng. Looks like Wuhan Yunqi Media, Teng Fei and Wang Daoqiang own an APT front company empire!
Sensing we were on to something, we continued to look at Hubei Win Future and found a new link. A phone number registered to Hubei Win Future, 18995647475 was also registered to one Hubei Junxinda.
Furthermore, historic ownership data demonstrated that Hubei Junxinda was once a 25% shareholder of Hubei Win Future; and Hubei Win Future has been, according to internal reports, Hubei Junxinda’s principle supplier (although of what, we don’t know – perhaps personnel?):
Hubei Junxinda looks like a real company; various websites list numerous employees and a number of the projects that Junxinda has won and in-depth reports such as the one above pore over its finances. It also has its own website:
A friend of I-T investigated their premises on our behalf, and found a secure facility at Hubei Junxinda’s address. Here is some imagery of their entrance hall:
Here, we have to admit, our curiosity was piqued, but we ran out of road. We didn’t find any additional APT31/Xiaoruizhi employees and were not able to uncover any more on the goings on behind closed doors at Wuhan Juge, Hubei Win Future, and Hubei Junxinda. Any tips, give us a shout.
So, referring back to our original list of Xiaoruizhi employees, we’ve collated as many of their follow-on destinations as we can.
| Chinese | Pinyin | Destination after Xiaoruizhi |
| 曹锦芳 | Cao Jinfang | ? |
| 常振 | Chang Zhen | Wuhan Juge Enterprise Management |
| 程鼎 | Cheng Ding | ? |
| 程锋 | Cheng Feng | Hubei Win Future |
| 顾成武 | Gu Chengwu | Wuhan Juge Enterprise management |
| 侯强 | Hou Qiang | Wuhan Juge Enterprise Management |
| 胡嘉祥 | Hu Jiaxiang | Wuhan Shenzhou Human Resources |
| 黄增辉 | Huang Zenghui | Wuhan Shenzhou Human Resources |
| 黄震 | Huang Zhen | Wuhan Shenzhou Human Resources |
| 黄振 | Huang Zhen | ? |
| 李海青 | Li Haiqing | Wuhan Juge Enterprise Management |
| 李家诚 | Li Jiacheng | Wuhan Shenzhou Human Resources |
| 李圣胜 | Li Shengsheng | Wuhan Shenzhou Human Resources |
| 李义龙 | Li Yilong | Wuhan Shenzhou Human Resources |
| 廖绪良 | LiaoXuliang | Hubei Chuangxin Human Resources |
| 刘晨成 | Liu Chencheng | Wuhan Juge Enterprise Management |
| 刘宏伟 | Liu Hongwei | Wuhan Shenzhou Human Resources |
| 马欢 | Ma Huan | Wuhan Shenzhou Human Resources |
| 唐星昭 | Tang Xingzhao | Wuhan Shenzhou Human Resources |
| 涂梦 | Tu Meng | Wuhan Juge Enterprise Management |
| 万光灿 | Wan Guangcan | Wuhan Juge Enterprise Management |
| 王意军 | Wang Yijun | Wuhan Shenzhou Human Resources |
| 魏耀斌 | Wei Yaobin | Wuhan Shenzhou Human Resources |
| 熊旺 | Xiong Wang | Wuhan Shenzhou Human Resources |
| 鄢文龙 | Yan Wenlong | Wuhan Juge Enterprise Management |
| 杨鑫 | Yang Xin | Wuhan Shenzhou Human Resources |
| 苑红曦 | Yuan Hongxi | Wuhan Juge Enterprise Management |
| 张超锋 | Zhang Chaofeng | Wuhan Juge Enterprise Management |
| 张立业 | Zhang Liye | Wuhan Shenzhou Human Resources |
| 赵光宗 | Zhao Guangzong | ? |
| 周鑫 | Zhou Xin | Hubei Chuangxin Human Resources |
| 左鹤群 | Zuo Hequn | Wuhan Juge Enterprise Management |
We still have few gaps, but we are pretty pleased that we have been able to piece together as much as we have.
Now, we may never know what happened at Xiaoruizhi at the end of 2019 that caused APT31 to pursue a mass career change. Perhaps Xiaoruizhi had simply served its time as an APT front and the powers that be needed to move APT31 into different administrative structures.
Any light that our readers can shed would, as always, be gratefully received.
Article Link: Wuhan Xiaoruizhi Class of ‘19 – Intrusion Truth