This threat actor targets U.S. government entities, the defense industrial base, law firms, information technology companies, resource extraction companies, and nongovernmental organizations. Ethical hacking group Intrusion Truth doxed three members of this threat actor: two hackers plus the head of four Chinese companies who is also believed to be an officer of the Chinese Ministry of State Security (MSS). The hackers are believed to be operating as contractors for the Jinan bureau of the Chinese MSS, where they carry out on-demand hacking operations.