{ "id": "cd8efdc9-796b-4554-a305-38a265efe28f", "created_at": "2026-04-06T00:15:15.283272Z", "updated_at": "2026-04-10T03:27:17.957645Z", "deleted_at": null, "sha1_hash": "ca3a2352f9ce0e64f3ed4edf9916fd8cf0af51b3", "title": "What is the Hainan Xiandun Technology Development Company?", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2404363, "plain_text": "What is the Hainan Xiandun Technology Development Company?\r\nBy intrusiontruth\r\nPublished: 2020-01-09 · Archived: 2026-04-05 17:09:06 UTC\r\nThis blog has previously shown that by starting with an APT it is possible to identify the individuals and\r\ncompanies responsible for conducting their attacks and the State actors behind them. We have also shown that you\r\ncan start with the State and work backwards to the APT.\r\nAPT groups in China have a common blueprint: contract hackers and specialists, front companies, and an\r\nintelligence officer. We know that multiple areas of China each have their own APT.\r\nAfter a long investigation we now know that it is possible to take a province and identify front companies, from\r\nthose companies identify individuals who work there, and then connect these companies and individuals to an\r\nAPT and the State.\r\nHainan Province\r\nOur previous research showed that science and technology companies Boyusec, Huaying Haitai, Antorsoft, and\r\nothers were fronts for Chinese MSS-sponsored APT activity. If you take the blueprint above and search for it\r\nelsewhere, an interesting and increasingly bizarre series of links begin to emerge.\r\nNorthern China has received much, presumably unwelcome, attention from this blog already. For our next\r\nexample, let’s look South, as far South as we can while remaining in China. Hainan – a semi-tropical island\r\nparadise conveniently located for Chinese tourists, known for its production of rubber and iron ore, its rocket\r\nlaunches, and its views over the South China Sea. What it is not internationally famous for, is global technology\r\ncompanies.\r\nHainan Xiandun Technology Development Company\r\nSearch for science and technology companies in Hainan who have also posted job adverts for penetration testers\r\nand you will quickly find 海南仙盾科技开发有限公司, the Hainan Xiandun Technology Development Company.\r\nA job advert for a penetration tester position at Hainan Xiandun posted on the the Sichuan University Faculty of\r\nComputer Science website on 5 January 2018 describes Hainan Xiandun as a “fast-growing high-tech information\r\nsecurity company”.\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 1 of 14\n\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 2 of 14\n\nAdvert for Hainan Xiandun\r\nHere is a second advert for the same company from the College of Foreign Languages at Hainan University\r\nadvertising for female English translators, ideally party members:\r\nSecond advert for Hainan Xiandun\r\nHowever, multiple other technology companies based in Hainan use identical company descriptions and job\r\nadverts.\r\nHainan Yili Technology Company\r\nHainan Yili – 海南毅立科技有限公司 – describes itself as a fast growing, high-tech information security\r\ncompany which is committed to becoming a leading manufacturer of information security products and services in\r\nChina.\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 3 of 14\n\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 4 of 14\n\nAdvert for Hainan Yili Technology Co Ltd\r\nHainan Tengyuan Technology Company\r\nHainan Tengyuan – 海南腾远科技有限公司 – also describes itself as a fast growing, high-tech information\r\nsecurity company which is committed to becoming a leading manufacturer of information security products and\r\nservices in China.\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 5 of 14\n\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 6 of 14\n\nHainan Kehua Information Technology Company\r\nAnd that’s not all. Hainan Kehua – 海南科华信息科技有限公司 – also describes itself as a fast growing, high-tech information security company which is committed to becoming a leading manufacturer of information\r\nsecurity products and services in China.\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 7 of 14\n\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 8 of 14\n\nHainan Yanwu Technology Development Company\r\nA little more research uncovers Hainan Yanwu – 海南彦武科技开发有限公司 – a company which also describes\r\nitself as a fast growing, high-tech information security company which has become a leading provider of\r\ninformation security services in China.\r\nOf course, this could all be a coincidence. Perhaps this company description is the first result on Baidu for “how\r\nshould I describe my new technology company”. But it isn’t.\r\nMore links emerge\r\nMore links are evident in these job adverts. A Hainan Xiandun advert for an English translator lists\r\n3414477607[at]qq.com as the contact email.\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 9 of 14\n\nHainan Xiandun advert showing 18976445013 and 341447767@qq.com\r\nThis is the same email address that was seen on the advert for a Network Security Development Engineer for\r\nHainan Yili above:\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 10 of 14\n\nHainan Yili advert (crop of above) showing 18976445013 and 341447767@qq.com\r\nThere are more links; the contact person Wang Tian (王天) from the job advert above can also be seen on this\r\nadvert for Hainan Tengyuan:\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 11 of 14\n\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 12 of 14\n\nEight other linked technology companies in Hainan\r\nFive companies with overlapping contact details, job and company profiles, and named individuals. This is a little\r\nsuspicious, but there might remain a chance that it is all completely explainable. Thirteen companies though starts\r\nto move beyond even the broadest realms of credulity and positive thinking. Taking the registration details for\r\nHainan Tengyuan we can then find a further eight linked technology companies in Hainan.\r\nRegistration details for Hainan Tengyuan showing phone number and address at 10 Haixiu Road\r\nCompany 6: Hainan Dingwei Digital Technology Company shares a telephone number and address with\r\nHainan Tengyuan – 19808984669 and No. 10 Haixiu Road\r\nCompany 7: Haikou Fengshang Digital Technology Company shares a telephone number and address with\r\nHainan Tengyuan and Hainan Dingwei.\r\nCompany 8: Hainan Hualian Anshi Intelligence Engineering Company shares a telephone number and\r\naddress with Hainan Tengyuan, Hainan Dingwei, Haikou Fengshang.\r\nCompany 9: Hainan Jiaxi Technology Company shares a telephone number and address with Hainan\r\nTengyuan, Hainan Dingwei, Haikou Fengshang, and Hainan Hualian Anshi.\r\nCompany 10: Hainan Xinhuaheng Technology Company shares a telephone number (19808984***) with\r\nHainan Tengyuan, Hainan Dingwei, Haikou Fengshang, Hainan Hualian Anshi, and Hainan Jiaxi and and is\r\nco-located in the same building.\r\nCompany 11: Haikou Jianhui Li Network Technology Company shares a shareholder with Hainan Xiandun\r\n(Fu Chuanli – 符传礼).\r\nCompany 12: Hainan Xin Yousheng Digital Technology Company shares a legal representative and\r\nshareholder with Hainan Dingwei (Fu Zhidao – 符致道 and Wu Chunai – 吴春爱), shares a telephone\r\nnumber with Hainan Tengyuan, and is also located at No. 10 Haixiu Road.\r\nCompany 13: Haikou Xindahai Computer Technology Company shares a shareholder with Hainan Hualian\r\nAnshi and Hainan Jiaxi (Fu Deqing –  符德清 and Wu Li – 吴丽）and is also located at No. 10 Haixiu\r\nRoad.\r\nHainan cover companies recruiting for offensive cyber skills\r\nLooking beyond the linked contact details though, some of the skills that these adverts are seeking are on the\r\naggressive end of the spectrum. While the companies stress that they are committed to information security and\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 13 of 14\n\ncyber-defence, the technical job adverts that they have placed seek skills that would more likely be suitable for red\r\nteaming and conducting cyber-attacks.\r\nIt could be argued that SQL injection and other penetration skills could be used for defensive purposes, to stress\r\ntest defences for example. But this job advert posted by Hainan Tengyuan is also looking for someone with a track\r\nrecord of sharing hacking exploits as well as specific experience with Windows Trojan shellcode development and\r\nPE encryption. The question we should be asking is: who develops their own encrypted executable files?\r\nIn summary, we have multiple companies with identical descriptions and job adverts, overlapping contact\r\ndetails and office locations, but different names, recruiting for offensive hacking skills. Like Boyusec,\r\nHuaying Haitai, Antorsoft, and others, these companies have very little presence on the Internet outside of\r\nthese adverts.\r\nWe know that these companies are a front for APT activity.\r\nYou all know where this story is going, and in the next articles we will show you some of we got there…\r\nDiscover more from Intrusion Truth\r\nSubscribe to get the latest posts sent to your email.\r\nSource: https://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nhttps://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company\r\nPage 14 of 14", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "references": [ "https://intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-development-company" ], "report_names": [ "what-is-the-hainan-xiandun-technology-development-company" ], "threat_actors": [ { "id": "761d1fb2-60e3-46f0-9f1c-c8a9715967d4", "created_at": "2023-01-06T13:46:38.269054Z", "updated_at": "2026-04-10T02:00:02.90356Z", "deleted_at": null, "main_name": "APT3", "aliases": [ "GOTHIC PANDA", "TG-0110", "Buckeye", "Group 6", "Boyusec", "BORON", "BRONZE MAYFAIR", "Red Sylvan", "Brocade Typhoon" ], "source_name": "MISPGALAXY:APT3", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434515, "ts_updated_at": 1775791637, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/ca3a2352f9ce0e64f3ed4edf9916fd8cf0af51b3.pdf", "text": "https://archive.orkl.eu/ca3a2352f9ce0e64f3ed4edf9916fd8cf0af51b3.txt", "img": "https://archive.orkl.eu/ca3a2352f9ce0e64f3ed4edf9916fd8cf0af51b3.jpg" } }