Chanming Tatum
Welcome to Memetic Warfare.
We’ll start this week with new posts from Intrusion Truth. These posts expose Guangdong Chanming, a Chinese cyber contractor, as Intrusion Truth does:
Guangdong Chanming’s patents are indicative of their activity:
The OSINT side here is interesting too - Intrusion Truth links to public PLA acquisitions data showing that Guangdong Chanming is a PLA contractor, selling the above software to the PLA.
From here, they pivot to the corporate filings to find two shareholders: Dai Zhoujun and Wang Huiping. Magically, Intrusion Truth finds phone numbers tied to them - I wonder how! When Intrusion Truth has solid OSINT data, including breached data, they show it, so I assume they don’t have solid open-source data as to how they found these phone numbers.
They then pivot on the username derived from the email, boywhp, to find a Github repository and from there to VirusTotal on a domain exposed in some of the forks - great OSINT here, which emphasizes that when they have public data, they show it:
From the binaries, they find a unique bash command. As one does in this space, when you find something unique, you fingerprint it and pivot, which they of course do. That leads them to “bulbature”, known malware tied to a few Chinese threat actors:
This makes things a bit clearer:
From here, Intrusion Truth then claims that RedRelay is in fact the product that Guangdong Chanming sells, including to one unit in Haidian, a district of Beijing.
Haidian is apparently the northern Virginia of China, hosting the PLA Cyberspace force as well as other units. Intrusion Truth then correlates customers (PLA Units) of Guangdong Chanming’s software to possible APTs:
This takes us to the second post, available here. Intrusion Truth pivot from commercial tooling to uncover an APT group and attribute them to a PLA unit.
Intrusion Truth then moves to a “trusted source” coming across a “collection of files” while tracking Chinese threat actors, as one does. Could it be an exposed directory or something public-facing? Sure. Could it just as easily be the result of cyber or interception? Also sure.
Those files included information that show ties between APT 15 and a PLA unit, the 8th TRB.
The “eDiary” shows those ties, including customer information on unit 61046, providing a physical address.
We also get apparently their logs, showing some of their targets:
Intrusion Truth’s commentary on this speaks for itself and the goals behind the post:
From here, Intrsuion Truth looks for unique ways to correlate APTs to RedRelay users. One of the ways was the term “vpnkerio”, a domain used apparently exclusively by APT15. They found a hit for it in the same eDiary file.
That then leads to their conclusion:
Intrusion Truth then summarizes: APT 15 is a PLA unit, enabled by Guangdong Chanming. They also hint that they will be looking more at the PLA going forward and not just focusing on the MSS, so that’s a point to look for going forward.
Well, that was interesting. Content aside, which is fascinating and mostly open-source as usual, I wanted to point out the linguistic component.
These posts were written in British English - using things like the added “u” in favourite and so on. Intrusion Truth has not been consistent about that stuff in the past, and while it could be explained by them having one British member, I think it’s more of an affectation than a real habit - just look at their past inconsistencies (as pointed out to me by ChatGPT):
The 2021 article is titled “An (in)Competent Cyber Program” while repeatedly using “cyber programme” in the body.
A 2023 post uses “main character organization,” “laser-flavor,” “specializes,” “cozying,” “labor force,” and “square meters.” Some instances of “Center” and “organizations” occur in translated official titles, but “laser-flavor” and “main character organization” are unquestionably narrative prose. APT31 archive containing the post.
The 2024 I-Soon post mixes “organizations” with British “analysed,” “emphasise,” “mobilise,” and “organisations”—again showing inconsistency rather than a rigid style sheet. 2024 post.
Come on guys, be more consistent here.
That’s it for this week, thanks for reading.