Cyber Threat Actor: Intrusion Truth

Intrusion Truth is an anonymous collective of cybersecurity analysts that specializes in publicly identifying and doxing individuals associated with Chinese state-sponsored cyber-espionage groups. Operating under the single alias "Intrusion Truth," the group has systematically exposed members of multiple advanced persistent threat (APT) clusters, including APT3, APT10, and APT17. Their investigations consistently link these actors to specific local bureaus of China's Ministry of State Security (MSS), portraying them as contractors performing on-demand hacking operations. The group's methodology involves publishing detailed personal and professional information about suspects, a practice that has gained credibility through independent verification by firms like Recorded Future and subsequent U.S. Department of Justice indictments. While their own location is not explicitly stated beyond references to Chinese cities in their reports, their focus remains on threat actors with documented ties to China.

The collective's most consequential work involves a series of exposés that directly facilitated legal action by U.S. authorities. In 2017, they revealed APT3 as operating through a company named Boyusec, identified as a contractor for the Guangdong provincial MSS bureau; this assertion was later corroborated and led to DOJ charges in November 2017. A parallel outcome followed their 2018 disclosure concerning APT10, resulting in December 2018 indictments. Their 2019 report on APT17 extended this pattern, naming three individuals in Jinan, Shandong province, as officers or contractors for the Jinan MSS bureau. These campaigns highlight Intrusion Truth's strategic role in enabling accountability for state-affiliated cyber actors through public naming and evidence compilation. The group does not develop malware or conduct intrusions themselves; instead, they function as an independent investigative entity whose research has repeatedly triggered official governmental responses. Their continued activity indicates a persistent focus on unmasking the human infrastructure behind Chinese APT ecosystems, though no further specifics about their internal operations or future targets are detailed in available sources.