Wednesday, 20 February 2013

Chinese Threat Actor Part 5

Follow up on Mandiant report

Mandiant Report

"Once again, in tracking SH we are fortunate to have access to the accounts disclosed from The rootkit. com account “SuperHard_M” was originally registered from the IP address, within one of the known APT1 egress ranges, and using the email address “”. We have observed the DOTA persona emailing someone with the username mei_qiang_82. The name “Mei Qiang” (梅强) is a reasonably common Chinese last/first name combination. Additionally, it is a common practice for Chinese netizens to append the last two digits of their birth year, suggesting that SuperHard is in fact Mei Qiang and was born in 1982. Unfortunately, there are several “Mei Qiang” identities online that claim a birth year of 1982, making attribution to an individual difficult."

One of the threat actor identified by Mandiant is "SuperHard_M". His name is Mei Qiang and email is ""


Rootkit database



This email is the registrant email at kaixin001 social network

Full Name -  Mei Xiao Qiang ( 梅小强 ), Living in Shanghai

Tianya Chinese Board is also the registrant email at Tianya chinese board but the name linked to this email address is "2005_9_24" and profile information says he is a Male, living in city of ZhengZhou, Henan Province with Date of Birth September 12th 1982, Virgo and this profile is registered on 24 Sep 2005 suggesting that he was in Zhengzhou at this time.

Interesting enough, there is another account on Tianya with the handle "SuperHard_M" which is registered with email address ""

"" is also the registrant email at kaixin social network but the profile is deleted now and we know why :)

Search on reveals he is aged 24 in 2005, that means he is 31 years old now.
He was living in Zhengzhou, Henan province during 2005. In a Job profile, he mentions that his interests are network security and developing hacking tools.

Name: SuperHard_M
Gender: Male
Age: 24
Education: Masters
Tel: 13503456644
Contact Address: Henan Zhengzhou 1001 mailbox 774
PostalCode: 450002
Date: 2005-11-28 08:50:40
Published Username:  SuperHard_M

The mailbox address 1001 mailbox 774, Zhengzhou city, Henan Province belongs to the famous PLA Information Engineering University that implies he was a student at PLAIEU.

Mei Qiang published two journals along with Zhu Yue-Fei related to HTTP Session Hijacking on Switch LAN, Man In The Middle (MITM), ARP Spoof. It is important to note that Zhu Yue-Fei also published articles with Zhang Chang-he

(Credit goes to Tommy for the Journal link)

Read online

SuperHard_M profiles on chinese boards

Weibo Profile 

Lives in Shanghai Pudong area

T QQ Profile

Lives in Shanghai Pudong area and Virgo

Wolf's World

One of the other possible email of SuperHard is


After few hours of this blog post, Mei Qiang's Kaixin profile is deleted and sxsoft profile details are changed.

Saturday, 16 February 2013


People's Liberation Army - Information Engineering University (PLAIEU)

(Content is translated using Google)


Chinese People's Liberation Army Information Engineering University (The PLA Information Engineering University), former PLA Information Engineering University , PLA Institute of Surveying and Mapping, PLA Institute of Electronic Technology merged to form from directly under the General Staff leadership is a key national science and engineering higher military academies. The whole army one of the five comprehensive universities (the other four are: the National University of Defense Technology , PLA University of Science , Air Force Engineering University , Naval Engineering University ). Seeking, innovation and dedication is the motto of the University.

PLA Information Engineering University

Training, Department of Political Affairs, the school, the four organs of the Ministry of the Ministry of Scientific Research, under the Information Systems Engineering, College of geospatial information, password Engineering, College of cyberspace security navigation and air and space targets Engineering University now compiled, the rationale College, commanding officer basic education College letter seven colleges and the Institute of Information Technology. Has three postdoctoral programs, 24 doctoral degree programs (including six one discipline Doctorate), 53 master degree programs. Has three national key disciplines (including one of a national key disciplines), the five army key disciplines, 10 disciplines field is listed as the field of army " 211 Project "key construction disciplines. In addition, the school also has a National Engineering Research Center (National Digital Switching System Engineering Technology Research Center), five Army Key Laboratory of 2 provincial key laboratories, as well as 43 basic and specialized laboratories.

The University has a high-quality teaching and research ability, structured teaching team. It has a large number of countries to the the Professor Gao Jun, the Chinese Academy of Sciences, the Chinese Academy of Engineering, Professor Wang Jiayao Wu Professor Jiang Xing, Professor Xu Qifeng, young experts with outstanding contributions by the army and the experts and professors enjoy special government allowances. Existing teaching and research and engineering and technical personnel, with more than 600 senior professional and technical positions. My school's existing National Science and Technology Award Committee, the State Council Academic Appraisal Group, the National Informatization specifically Advisory Committee members, the National 863 Program information field of the Expert Team 3, Lunar Exploration Science Applications experts 2 Committee experts, the national teachers teaching, outstanding teachers, outstanding scientific and technological workers, one person was "New Century Female Inventors of the Fourth National Innovation Award, a teaching team was named national teaching team 22 enjoy special government allowances, 23 were rated as outstanding teachers, 211 people were army outstanding professional and technical personnel post allowance, 259 people were Yucai Award of the military academies.

Students elegance

Since the establishment of the University, close to the force requirements, closely around the central task of personnel training, and promote the development strategy for education transformation and strong school, level of education and teaching, and improve quality of personnel training, and has won two National Teaching Achievement Award three second prize, army-level teaching achievement award 32; 6 tutorial was named national quality courses, 12 courses were rated as high quality courses in the military, army excellent network courses; 11 achievements have been awarded the National Grand Prix of multimedia educational software. etc. Award; published textbook 200 for more than 16 textbooks as the "Eleventh Five-Year" project national planning materials; College English curriculum reform identified by the Ministry of Education for the whole army's only teaching reform demonstration sites; school assessment The collective work of art for the National Academic Degrees and Graduate Education Management.

University academic atmosphere active research strength, fruitful, is a base for research and innovation in the field of military information. Has undertaken a national army 3000 a number of key issues, including more than 400 of the 863 Program, 973 Program, National Natural Science Foundation of China, and defense major research projects. University since its formation in 1999, has won first prize in three national scientific and technological progress second prize of National Science and Technology Progress (State Technological Invention) 24, 65 armed forces (provincial and ministerial level) first prize for scientific and technological progress. At present, universities in program-controlled exchange, the third-generation mobile communication technology, information security, core router, signal analysis and processing, satellite and microwave communications, computer networks, network communication protocols, spatial positioning, satellite navigation, space remote sensing, digital photogrammetry, strong research strengths and strength in the direction of the simulation engineering, digital cartography, geographic information systems, and some in the international advanced level. Independently successfully developed China's first large-scale digital program-controlled switches HJD-04 exchange system and China's first all core technology with independent intellectual property rights of high-performance IPv6 router, and presided build a national high-speed information demonstration network, the next generation of broadcast networks ( NGB) technology leader. In addition, the development of the Shenzhou series of spacecraft, the successful to simulate landing field three-dimensional terrain contributed to write a new history of China Aerospace brilliant.

The University actively updating educational ideas, closely tracking the development of information science and technology, comprehensive deepen the educational reform, accelerate instantiate teaching, quality of personnel training has been significantly improved, the army now of building transport three thousand much-needed information class talent. University graduate students writing a thesis, was named National Excellent Doctoral Dissertation 5, 16 was named military Excellent Doctoral Dissertation the 33 named army Hits; cadets participated nationwide disciplines reward of more than 170 above the competition won the first prize; trainees Zhao Jing was named "the army's top ten of learning to become pacesetters"; students the Xie Kangmin was the first National Youth Century Talent Competition Gold Award; Meng Xiangbin, Wu Wenbin, graduate trainees has been named " Moving China "Person of the Year, and Meng Xiangbin Central Military Commission awarded the honorary title of sacrificed their lives to save a model officer, Wu Wenbin Central Military Commission awarded the honorary title of the earthquake relief heroic warrior.

The school occupies a total area of ​​nearly 5,000 acres, total construction area of ​​more than 110 million square meters, tidy campus wide, tree-lined, with a good learning environment, headquarters named "garden-style barracks. Schools built GPS experimental field, satellite ground stations, satellites, observatories, Observatory, computing center, swimming pool, shooting range, track and field stadium, indoor sports hall, multi-media classrooms, academic lecture hall, fully supporting the teaching, research and living facilities . The Library is a collection of more than 100 million copies digital literature resources 280TB. Campus built broadband high-speed campus network, dedicated access Internet Education and Research Network INTERNET.

Information Engineering

Located in the Yellow Sea, the northern foot of the Songshan of the Chinese People's Liberation Army Information Engineering University Information Engineering Institute, shoulder the important task of training project of the modernization of national defense technology and scientific research personnel, is a the army key building colleges.

Information Engineering University College of Information Engineering, Higher College of Science and Technology for the the defense modernization cultivation engineering and scientific researchers, and its predecessor, the PLA Information Engineering University, is approved by the State Council, the national key institutions of higher learning. Seven professional Institute jurisdiction of Computer Science and Technology, communications engineering, information science, information studies, command and management of Electronic Science and Technology, Network Engineering Department and the Information Technology Institute, Beijing graduate professional training center. Has two post-doctoral research stations , two one discipline Doctorate seven secondary discipline Doctorate programs, 15 master degree programs, 2 national key disciplines , two Army, one of the key disciplines army Key Laboratory 1 Key Laboratory of Henan Province, five army key construction disciplines areas of expertise, a national engineering centers (National Digital Switching System Engineering Technology Center). Existing School of Computer Science and Technology, network engineering, communications engineering, automation, information engineering, information research and security, electronic engineering, electronics and information engineering , eight four-year undergraduate students nationwide, according to local priorities score merit.

College to inherit and carry forward the fine tradition of the original Information Engineering College 50 years, has a strong school strength and rich experience in education, and the formation of a unique educational advantages in the field of information technology and information security. College adhere to educational policy "toward modernization, the world and the future", focus on updating educational philosophy, extensive application of modern educational technology , continue to deepen the reform of teaching methods and means,

Students elegance

Attaches great importance to the students to innovative thinking and creative ability and improve. In recent years, a number of achievements of the state and the army high-grade teaching achievement awards in International, National Mathematical Modeling, Electronic Design Contest and radio direction finding, since 2002 to 154 won the National Award Championship academic competitions, including a top award , 60 first prize. The trainees Xie Kangmin won the gold medal in 2002, the first national youth century style TV contest. Zhengzhou Jianyuanyilai co-culture of all kinds at all levels more than 20,000 graduates of graduates in short supply, praised by the employer, played an important role in the construction of our military information, and many graduates have become the state-of-the-art technology pillars of the field.

College faculty quality, reasonable structure. 42% of senior professional and technical positions in the Teacher, faculty with doctoral and master's degrees accounted for 89%, with the Chinese Academy of Engineering, Professor Wu Jiangxing represented by a group of renowned experts and scholars in and outside the military. 47 existing doctoral tutor , Master Instructor 147. Dozens of teachers were rated as the young and middle of the country and the army, the country, the military, and Henan Province, outstanding teachers, 61 excellent professional and technical personnel post allowance enjoy special government allowances and the military , 67 military academies Yucai Award. The College also hired 18 academicians from outside the hospital as a part-time professor.

Academic research environment, excellent strength, and fruitful. A National Engineering Center - National Digital Switching System Engineering Technology Research Center, in joint research, scientific and technological achievements into out of the new road. Following since the advent of the 1990s, the college has independently developed China's first large-scale digital program-controlled switches HJD-04 exchange system, a major breakthrough in packet switching, information security, 3G technology and routing technology research areas, there are more than 100 innovative achievements countries, the armed forces or the Provincial Science and Technology Progress Award, which from 2001 to 2004, the fourth consecutive year the National Science and Technology Progress Award, the National Science and Technology Progress Award in 2006, created a new glory of the Institute of Scientific Research.

Institute of Surveying and Mapping

PLA Information Engineering University is a military operational command of the high culture of military training and scientific research, the intermediate military mapping professionals higher engineering professional and technical colleges, formerly known as the 60 years of establishment of the hospital the history of the People's Liberation Army Institute of Surveying and Mapping, by approved by the State Council, one of the national key universities. Existing measurement and navigation of the College of Engineering, Department of Remote Sensing and Information Engineering, Cartography and Geographic Information Engineering, the operational environment and Simulation Engineering, Surveying Engineering and Equipment Department of Measurement and Control Technology and Management, joint schools and the local Health Department and other seven departments and Surveying Engineering Research Institute, has a post-doctoral research stations, six doctoral degree programs, 11 master's degree programs. With a national key disciplines, two army key disciplines, 4 army key construction disciplines field, an army Key Laboratory and one provincial engineering technology center.

With a high-quality, reasonable structure and faculty. Total teaching, research, engineering and technical staff of more than 260 people, including more than 90 people positive vocational staff of 47 people, 82 Fu Gaozhi, doctoral, Master Instructor. Gao Jun Academician of the Chinese Academy of Sciences , the Chinese Academy of Engineering academician Wang Jiayao SURVEYING Academy of Sciences, Fellow of the International Eurasian Academy of money Zeng Bo is a group of well-known scholars, experts and professors. Equipment state-of-the-art educational technology center, satellite observation station, GPS experimental field, the center of the Observatory, remote sensing satellite ground stations, remote sensing image processing , spatial information, data processing centers, teaching facilities. The campus network to achieve hospital-wide sharing of information resources and online teaching. In recent years, the college has a positive commitment to the past more than 500 major research projects of the state and the army, there are more than 120 achievements have been awarded the National Invention Award and the Science and Technology Progress Award, and other awards. Academic teaching and research fully equipped, state-of-the-art facilities, the basic realization of modernization of teaching methods.

The College has more than 60 years of school history, is one of the institutions of our military earliest foreign academic exchanges. Has received the military mapping the delegation of the United States , the United Kingdom, Germany , Canada, Switzerland , Russia, Romania , France, North Korea and other countries, and the famous experts, scholars visit, lecture, study abroad each year of experts, scholars, studies, lectures and participate in International Conference. The distinctive characteristics of school running strong academic atmosphere, elegant campus environment, the country, "the party's ideological and political work of advanced institutions of higher learning" the General Staff "personnel building advanced units" and "Army Class A health units".

Institute of Electronic Technology

 Information Engineering University, Institute of Electronic Technology Polytechnic Army information security technology based combination of command and technology combined with the multi-disciplinary institutions of higher learning. Formerly known as the 50 years of history of the People's Liberation Army Institute of Electronic Technology. The Institute existing command and management system, the Department of Information Research, Information Security, Information Equipment Engineering Department and an Information Security Institute of Technology, has a Key Laboratory of Information Security of Henan Province, a Henan Province Information Security Engineering Research center and a Henan e-commerce Engineering Research Center. A national key disciplines, three army key construction disciplines, three doctoral degree programs, eight master's degree authorization centers. Four four-year undergraduate programs of the existing College of Electronic Science and Technology, Information Engineering (Information Security), security, electronic engineering students nationwide, according to local priorities score merit.

The College has a strong school strength and rich experience in education, characteristics and advantages in cryptography, information security, network engineering, and computer application technology . Institute focus on updating the educational philosophy, the deepening education reform and innovation of the approach, the emphasis on the cultivation of students 'innovative thinking and ability to carry out the students' independent research and other rich classroom activities, numerous international, national college students, graduate students mathematical modeling, English won the first prize in the contest, information security competition, there have been two students have been named "the whole army 10 learning to become pacesetters.

The College has a reasonable structure, quality of teachers, accounting for 40% of the senior professional and technical positions in the faculty ranks, with doctoral and master's degrees accounted for 84%, with a number of disciplines with a solid foundation of theory and higher academic attainments academic leaders, including two "national young and middle," the General Staff outstanding young experts "7, 3 people enjoy special government allowances, seven teachers have been assessed to outstanding teachers in the military, 32 military academies "Yucai Awards. In recent years, the school has undertaken a national army, "863", "973", and the National Natural Science Fund and a number of major research projects by the national army and provincial-level teaching, research first, second and third prize hundred items.

College teaching, research and living facilities. Library, Academic Hall, Experimental Center, Military Sports Pavilion, standard athletics stadium, swimming pool, field training ground, comprehensive service building and other support facilities. Social security services complete living facilities, park CAPE through the hospital campus wide and tidy, rational layout, tree-lined, beautiful environment. The college has been named the "National and cherishing the model unit", "the General Staff learning to become advanced units," the whole army civilization Health barracks "," garden-style barracks, garden-style units ".

Journals published by PLA Information Engineering University

Page 57 of USCC Report provides more information about PLA Information Engineering University

Information Engineering University: The PLA Information Engineering University (PLAIEU), located in
Zhengzhou, Henan Province, is perhaps the military university with the most comprehensive involvement in information warfare and computer network operations training, planning, and possibly also execution.
According to a 2008 PLA Daily description, the school employs 800 professors and senior engineers and 100 part-time professors, serving 55 graduate degree programs.119 Published PLAIEU-sponsored research includes studies on worm propagation, network attack evaluation, kernel-mode rootkits, data hiding, malware behavior detection, and “emergency public opinion control.”

PLAIEU achieved worldwide notoriety in August, 2011 when the user ‘chinesecivilization2’ posted to YouTube a segment of the military-themed television documentary, “The Network Storm is Coming,” broadcast by CCTV-7 on July 16, 2011. The segment showed the live use of an apparent denial of service tool, bearing the title “PLA Information Engineering University” in Chinese, and offering the user a list of “attack destinations” including a Falun Gong website hosted at the University of Alabama in Birmingham (UAB). The broad exposure gained by the video’s YouTube distribution brought considerable attention to the PLAIEU, convincing many that the school sponsored hacking activity outright. However, staff at UAB later commented that the computer identified in the video had not been compromised, suggesting that the video only showed  a simulation. Nevertheless, the video strongly suggests that the PLAIEU is involved in developing software to assist network attack operations. The specificity of the example (a Falung Gong website at an Alabama university) reflects the detailed, real world network reconnaissance that Chinese network security researchers in both academia and government are conducting to further PRC security interests.

PLAIEU researchers are prolific publishers of information security-related material, having issued more than 300 articles in the past two years. Their recent collaborations include those with scholars at Zhengzhou University of Light Industry, PLA Unit 61365, Luohe Medical College, Public Security Marine Police Academy,  Xi’an University of Electronic Science and Technology, Hebei University of Science and Technology, Sichuan University, the National Digital Switching Engineering Center, Nanyang Normal College, and many others. The number and diversity of collaboration partners enjoyed by PLAIEU researchers suggests both aggressive partnership-building on the school’s part and a broad-based reputation for technical expertise.

Although the above key military institutions play important roles in the development of China’s information warfare capabilities, the PLA’s development of new CNO and EW capabilities depends to a substantial degree on collaboration with civilian academic institutions for the modernization of military command and technical talent.

Epoch Times Article - DDOS Software

The screenshots show the name of the software and the Chinese university that built it, the Electrical Engineering University of China’s People’s Liberation Army—direct evidence that the PLA is involved in coding cyber-attack software directed against a Chinese dissident group.

EXPOSED: A picture of the hacking software shown during the Chinese military program. The large writing at the top says 'Select Attack Target.' Next, the user choose an IP address to attack from (it belongs to an American university). The drop-down box is a list of Falun Gong websites, while the button on the left says 'Attack.' (CCTV)

Read Full article here

Monday, 4 February 2013

Chinese Threat Actor Part 4 is an espionage domain which goes back several years connected to

Domain ID:D105044855-LROR
Created On:25-Oct-2004 09:46:18 UTC
Last Updated On:10-Sep-2012 12:39:43 UTC
Expiration Date:25-Oct-2013 09:46:18 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Registrant ID:3D553CC3140BB142
Registrant Name:huge soft
Registrant Organization:hugesoft
Registrant Street1:shanghai
Registrant Street2:
Registrant Street3:
Registrant City:shanghai
Registrant State/Province:S
Registrant Postal Code:200001
Registrant Country:CN
Registrant Phone:+86.21000021
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:
Admin ID:3D553CC3140BB142

The "ug-" sub domains are connected to this guy.

Attribution is the registrant email of This database is leaked and available in public domain.


IP Address:
Latitude, Longitude 31.22222, 121.45806 (31°13'20"N 121°27'29"E)
Connection through CHINA UNICOM SHANGHAI NETWORK is also the registrant email of chinese social networks like, and

He is a member of many chinese boards.

uglygorilla (uglygorilla) on station 2 times, net age [ 17 ] days [ Leo ]
Last: [ August 3, 2004 10:23:38 Tuesday ] from [ ] to the site a visit.

IP Address:
Latitude, Longitude 31.22222, 121.45806 (31°13'20"N 121°27'29"E)

He appears to be a student of Shanghai Jiotang University (SJTU) in 2004

Previous Posts