English:APT31 Research on people and company

 

 



 

about APT31(aka. ZIRCONIUM、Violet Typhoon、JUDGMENT PANDA、BRONZE VINEWOOD、Red keres、TA412), 

U.S. and the U.K. have announced indictments and sanctions concerning the company and seven hackers.

 

Seven Hackers Associated with Chinese Government Charged with Computer Intrusions Targeting Perceived Critics of China and U.S. Businesses and Politicians

2024年3月25日

www.justice.gov

 

 

PDF files ↓

1.  https://www.justice.gov/opa/media/1345141/dl?inline

2.  https://www.gov.je/SiteCollectionDocuments/Industry%20and%20finance/Annex%20-%20Cyber%20-%20250324.pdf

 

 

This article is ...

武汉晓睿智科技有限责任公司(Wuhan Xiaoruizhi Science and Technology Company, Limited、Wuhan XRZ)

and

Ni Gaobin (倪高彬)
Weng Ming (翁明)
Cheng Feng (程锋)
Peng Yaowen (彭耀文)
Sun Xiaohui (孙小辉)
Xiong Wang (熊旺)
Zhao Guangzong (赵光宗)

Here is a survey of the seven hackers above.

 

 

I also include below the articles about APT31 by intrusiontruth for reference.

What’s Cracking at the Kerui Cracking Academy?

intrusiontruth.wordpress.com

 

The Illustrious Graduates of Wuhan Kerui   

intrusiontruth.wordpress.com

 

All roads lead back to Wuhan… Xiaoruizhi Science and Technology Company

intrusiontruth.wordpress.com

 

Trouble in Paradise 

intrusiontruth.wordpress.com

 

Introducing Cheng Feng 

intrusiontruth.wordpress.com

 

MiSSing links 

intrusiontruth.wordpress.com

 

 

 

First, here are the findings on 武汉晓睿智科技有限责任公司(Wuhan Xiaoruizhi Science and Technology Company, Limited、Wuhan XRZ).

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

统一社会信用代码:91420100551956105K

组织机构代码:55195610-5

工商注册号:420100000183295

location:武汉市东湖新技术开发区华师园北路16号2楼

注册资本:25.00万元

establishment:2010-03-08

CEO:邓智勇 → 王鸿业?

e-mail address:xrz_zp@163.com

 

・Job openings are posted and internships are offered on 华中农业大学(Huazhong Agricultural University)'s website.(2019-05-10)

fld.hzau.edu.cn

 

・Job openings published in 武汉工程大学(Wuhan Institute of Technology).(2017-2-27)

archiver.yingjiesheng.com

 

reference:

https://b2b.baidu.com/fland/072D73730637276A1F0E760F75751A1906171D3901077062027796F0F8FDFBF9F8F9F9FCFCF8F0FCFFF8F9FCA2

 

https://www.jobui.com/company/16335615/

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

 

 

Next are the findings on the seven hackers.

 

 

Ni Gaobin (倪高彬)

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

・38 years old

・male

・date of birth:27/10/1985

・place of birth:Jingzhou Municipality, China(中国湖北省荆州市)

・公民身分番号:421003198510272917

・address:中国湖北省

 

◎Information not clear if this is the same person

・苍南县清和铝塑徽章有限公司

・上海三睦新材料有限公司

・泸州市龙马潭区友邻汽车保养经营部

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

 

 

Weng Ming (翁明)

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

・37 years old

・male

 

◎Information not clear if this is the same person

・武汉安链信息技术有限公司

・武汉市青山区凌恒诚贞科技信息经营部

・一种基于高精度地图的车道偏离预警系统及方法(A lane departure warning system and method based on high-precision map)、一种基于高精度地图的360度全景影像增强系统(A 360-degree panoramic image enhancement system based on high-precision maps)、一种基于高精度地图的个性化巡航控制系统(A personalized cruise control system based on high-precision maps)

・武汉市青山区亿修到家建材经营部

・武汉市洪山区康帅餐饮店

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

 

 

Cheng Feng (程锋)

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

・34 years old

・male

・worked at 武汉晓睿智科技有限责任公司(Wuhan XRZ)

・On 13/6/2019, he sent an email to an address believed to be Kerui Cracking Academyy(武汉科锐软件安全教育机构)'s email address.
 →send from intelsmile@outlook.com  to Edua@info.com

reference:

Introducing Cheng Feng 

intrusiontruth.wordpress.com

 

・e-mail address:intelsmile@outlook.com

・In August 2017, he created a task named "做了什么 apt31 物联网."

・Possibly related to 58[.]55[.]127[.]233.

  March 2015~:webmail[.]dnsapple[.]com

  April 24, 2017~:clibcom[.]com

www.virustotal.com

 

・Cheng Feng (程锋)'s social insurance record(2013-03-01)

https://archive.is/jrMBK/655e3443b65116d6cf060e92138efa70bd1a8f49.webp

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

 

 

Peng Yaowen (彭耀文)

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

・38 years old

・male

・worked at 武汉晓睿智科技有限责任公司(Wuhan XRZ)

 

◎Information not clear if this is the same person

・武汉思颉科技有限公司

reference:

www.zhipin.com

 

・武汉首印数字科技有限公司

・北京海风智能科技有限责任公司

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

 

 

Sun Xiaohui (孙小辉)

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

・38 years old

・male

・He is 执行董事 and 总经理 in 武汉六合天工科技有限公司(Wuhan Liuhe Tiangong Science & Technology、Wuhan Liuhe).

 

武汉六合天工科技有限公司(Wuhan Liuhe Tiangong Science & Technology、Wuhan Liuhe)

location:武汉市青山区同兴村张家田村北302号523室

contact:89512988@qq.com

Number of Employees:2

establishment:2016年6月13日

注册资本:10万元人民币

CEO:孙小辉

监事:伍奇帮

company type:有限责任公司(自然人独资)

统一社会信用代码:91420107MA4KMUPN10

组织机构代码:MA4KMUPN-1

注册号:420107000151726

reference:

b2b.baidu.com

www.kanzhun.com

 

 

◎Information not clear if this is the same person

・武汉华源天诚科技有限公司の関連

・武汉文龙正源投资有限公司の関連

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

 

 

Xiong Wang (熊旺)

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

・34 years old

・male

・worked at 武汉晓睿智科技有限责任公司(Wuhan XRZ)

・Graduates of 武汉科锐软件安全教育机构(Wuhan Kerui Cracking Academy)

https://archive.is/rtbet

  →科锐19期

reference:

The Illustrious Graduates of Wuhan Kerui   

intrusiontruth.wordpress.com

 

・He is 董事 in 长武汉东澜天创文化传播有限公司 ?

 

・Xiong Wang (熊旺)'s social insurance record(2016-05-01)

https://archive.is/0SMHG/63f2cbaab7f5396a2d4870d09759317c1d3e5b6d.webp

 

・linkedin(It is not known if this is the person in question.)

https://www.linkedin.com/in/%E6%97%BA-%E7%86%8A-366920144/

 

◎Information not clear if this is the same person

武汉优思贝文化艺术传媒有限公司

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

 

 

Zhao Guangzong (赵光宗)

ーーーーーーーーーーーーーーーーーーーーーーーーーーー

・38 years old

・male

・worked at 武汉晓睿智科技有限责任公司(Wuhan XRZ)

・date of birth:12/11/1985

・place of birth:Jingzhou Municipality, China(中国湖北省荆州市)

・公民身分番号:421003198511121539

・address:中国湖北省

 

Zhao Guangzong (赵光宗)'s social insurance record(2015-11-01)

https://archive.is/jrMBK/0ab595b3a6d498359a183a11eff85e437e424e14.webp

ーーーーーーーーーーーーーーーーーーーーーーーーーーー