US charges Chinese nationals in cyberattacks on Treasury, dissidents and more

U.S. authorities unsealed indictments charging multiple Chinese nationals, including officers of PRC security services and employees of the commercial firm i-Soon, with a decade-long cyberespionage and hacking-for-hire operation tied to APT activity (linked to APT27 / Silk Typhoon). The report alleges these actors used tools like PlugX, leased VPS infrastructure, exploited vulnerabilities (including an Ivanti flaw), exfiltrated and brokered stolen data (including a 2024 U.S. Treasury intrusion), and sold access to Chinese state agencies; U.S. agencies seized domains, issued sanctions and placed bounties.