{
	"id": "3871ef72-2692-41a4-a8ea-44666fb4ed11",
	"created_at": "2026-04-06T00:18:49.974735Z",
	"updated_at": "2026-04-10T03:21:07.905098Z",
	"deleted_at": null,
	"sha1_hash": "4d99105512bbe99ccfbd0690fac95290e26258cb",
	"title": "Who is Mr Ding?",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 419267,
	"plain_text": "Who is Mr Ding?\r\nBy intrusiontruth\r\nPublished: 2020-01-14 · Archived: 2026-04-02 10:34:19 UTC\r\nWe started by stating that Chinese APTs have a blueprint that us applied in multiple regions across China: contract\r\nhackers and specialists, front companies, and an intelligence officer. Applying this blueprint in Hainan, we\r\nsurfaced inter-linked companies recruiting for people with hacking and specialist IT skills.\r\nWe have identified that Professor Gu Jian is connected to the front company Hainan Xiandun and supported some\r\nof their activities from his position at Hainan University. But his was more of a supporting role. Who was in\r\ncharge?\r\nWang Tian, Manager Jiang, and Mr Chen\r\nJob adverts for Hainan Tengyuan, Hainan Yili and Hainan Xiandun list Wang Tian (王天) and Manager Jiang (蒋\r\n经理) as contacts of the companies. We have been unable to identify much more about these individuals.\r\nHainan Xiandun – Manager Jiang\r\nHainan Tengyuan – Wang Tian\r\nHainan Yili – Wang Tian\r\nhttps://intrusiontruth.wordpress.com/2020/01/14/who-is-mr-ding\r\nPage 1 of 3\n\nMr Chen\r\nAn advert on Sichuan University’s website for a Penetration Test Engineer position at Hainan Xiandun lists ‘Mr\r\nChen’ (陈先生) using 2918588955[at]qq.com and telephone number 13198985613 as the contact person.\r\nHainan Xiandun – Mr Chen\r\nMr Chen is seen on a number of job adverts for these Hainan front companies. While it’s unclear who Mr Chen is,\r\nthe website registrant for one of the front companies which we identified, Hainan Yanwu, is listed as a Mr Chen\r\nYanwu (陈彦武).\r\nHainan Yanwu historical WHOIS\r\nAre any of these contacts real people?\r\nThe number of contacts listed and the re-use of telephone numbers raised our suspicions. We started to think that\r\nperhaps some, or all, of these contact names were fictitious. We reached out to our trusted network of contributors\r\nand posed the question: who was the real owner of these telephone numbers and email addresses?\r\nSo, who is Mr Ding?\r\nWhile researching the phone numbers from these companies, one of our contributors turned up this information\r\nlinking phone number 15638338966 (you’ll remember that from an earlier job advert for Hainan Xiandun, in the\r\nname Mr Chen) with a new e-mail address: dxy0015@163.com.\r\nRelationship between 15638338966 and dxy0015@163.com\r\nWhy is that e-mail address important? Because this information, from a frequent flyer account, shows that\r\ndxy0015@163.com and the phone number belong not to a Mr Wang, or a Mr Jiang, or a Mr Chen, but to a Mr\r\nDing Xiaoyang (丁晓阳), who is very much a real person.\r\nhttps://intrusiontruth.wordpress.com/2020/01/14/who-is-mr-ding\r\nPage 2 of 3\n\nDing Xiaoyang’s name (丁晓阳) appears in this e-mail from Hainan airlines to dxy0015@163.com\r\nWe are extremely grateful to our contributor for their diligent work in finding this information. Our thanks also go\r\nout to Mr Ding for not changing his password after it had been leaked online.\r\nIn summary: in some cases the contacts for these front companies in Hainan may be aliases. Other than\r\nHainan University academic Gu Jian, the only individual that we have been able to link to the adverts is the\r\ntrue owner of one of the telephone numbers: Hainan resident Ding Xiaoyang.\r\nIs Ding the person in charge of these front companies? Does Ding have connections to the Chinese State?\r\nWe know the answer, he knows the answer, do you?\r\nDiscover more from Intrusion Truth\r\nSubscribe to get the latest posts sent to your email.\r\nPost navigation\r\nSource: https://intrusiontruth.wordpress.com/2020/01/14/who-is-mr-ding\r\nhttps://intrusiontruth.wordpress.com/2020/01/14/who-is-mr-ding\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"MISPGALAXY"
	],
	"references": [
		"https://intrusiontruth.wordpress.com/2020/01/14/who-is-mr-ding"
	],
	"report_names": [
		"who-is-mr-ding"
	],
	"threat_actors": [],
	"ts_created_at": 1775434729,
	"ts_updated_at": 1775791267,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4d99105512bbe99ccfbd0690fac95290e26258cb.pdf",
		"text": "https://archive.orkl.eu/4d99105512bbe99ccfbd0690fac95290e26258cb.txt",
		"img": "https://archive.orkl.eu/4d99105512bbe99ccfbd0690fac95290e26258cb.jpg"
	}
}