XJP
Attribution profile
- Type
- Criminal
- Location
- China
- Known incidents
- 2 incidents
- Sources
- 2 sources
- First seen
- 2022-07-04
- Last seen
- 2022-08-10
- Updated
- 2026-10-17 05:22
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor, known by the aliases XJP and ChinaDan and operating from China, has been observed monetizing stolen personal data. In July 2022 the actor claimed to have exfiltrated approximately 22 terabytes from a Shanghai law enforcement database hosted on Alibaba Cloud, citing an exposed ElasticSearch instance resulting from leaked credentials in a government developer’s blog post, and offered the data for sale. In August 2022 the actor advertised the sale of personal information belonging to 48.5 million users of Shanghai’s COVID‑19 health mobile application on a hacker forum, pricing the dataset at $4,000. Both incidents demonstrate a financially motivated focus on health and government sectors in Shanghai, with the initial access vector involving misconfigured cloud services and credential exposure. No public attribution to a state sponsor or criminal group has been made.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 2 sources.