Li Xiaoyu and Dong Jiazhi
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 2 incidents
- Sources
- 1 source
- First seen
- 2015-03-01
- Last seen
- 2020-01-01
- Updated
- 2026-10-15 10:29
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Li Xiaoyu and Dong Jiazhi are two Chinese nationals identified by the U.S. Department of Justice as contractors for China’s Ministry of State Security. Operating from China, they have conducted a decade‑long hacking campaign that began in September 2009 and targeted high‑tech manufacturing firms, pharmaceutical companies (including COVID‑19 vaccine developers), makers of educational software and medical equipment, defense contractors, Department of Energy facilities, and human‑rights activists in the United States, Australia, Germany, Japan, South Korea and other countries. Their objectives, as stated in indictments and official statements, were to steal trade secrets, intellectual property and other valuable business information for the benefit of the Chinese government, to extort victims for financial gain, and to provide passwords of activists to a Chinese government contact. Initial access was gained by exploiting publicly disclosed vulnerabilities in widely used software, often taking advantage of newly announced flaws before patches were applied, focusing on web servers and software‑collaboration programs. After establishing a foothold they deployed password‑stealing malware, installed backdoor software for further command and control, and exfiltrated data by compressing stolen files into archives and altering file extensions to evade detection, sometimes hiding malware and stolen data in recycle bins. They also returned to compromised networks years later to harvest additional information. Notable publicly reported operations include the March 2015 intrusion at the Hanford Site nuclear waste complex in Washington State that led to their discovery, and the early‑2020 attempts to compromise biotech firms in Maryland, Massachusetts and California researching coronavirus vaccines and a California firm producing coronavirus testing kits.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 1 source.