Mint ·
Science and technology
How a Chinese hacking firm tapped AI to supercharge cyber-spying
Internal company materials illustrate an AI-powered effort to make pilfered foreign government documents digestible for police; targets include Russia, Pakistan.
Some of China’s scrappiest hackers-for-hire are evolving into full-service private intelligence agencies, exploiting advances in artificial intelligence and other technologies to put stolen secrets of foreign governments at the fingertips of the country’s security agencies.
A trove of internal data belonging to a China-based cybersecurity company, reviewed by The Wall Street Journal, provides a new window into an evolution that international cybersecurity experts have tracked in recent years.
Even the Vatican appeared to attract ZRON’s interest.
A message that was apparently sent from the Vatican’s Secretary of State email address is marked April 23, 2025, two days after Pope Francis’ death, and includes an attachment with letterhead indicating it is from Taiwan’s Embassy to the Holy See. The attachment lists three Taiwanese delegates who planned to attend the pope’s funeral and their flight details. All three were later photographed at the funeral.
The Vatican is one of a small coterie of governments that officially recognizes Taiwan, which Beijing claims as part of China.
The foreign ministries of the Philippines and Taiwan declined to confirm or deny the authenticity of the hacked materials. Both said they pay serious attention to the security of their computer systems.
The Vatican and the foreign ministries of Pakistan and Russia didn’t respond to requests for comment.
Document summaries ZRON supplies to prospective clients sometimes include sensitive personal information. One entry names U.S. officials who had applied for temporary visas to enter Pakistan, along with their visa tracking numbers. Other entries contain foreign citizens’ passport numbers.
The State Department said it wouldn’t comment on the authenticity or content of alleged leaked or hacked material.
It wasn’t immediately evident how many of the documents that were described in summaries were obtained by ZRON or whether they had been supplied to customers. In some cases, specific email addresses were listed alongside document summaries as sources.
The company’s internal chats show employees trying to market the AI platform to prospective customers.
“AI can handle the risk assessments and recommendations in the reports; we only need to provide the source material,” one staffer wrote in an internal chat in early 2025. “This could lead to a qualitative leap in both the quality and quantity of our reports.”
ZRON isn’t alone in offering easy-to-use intelligence to Chinese police. Last year, cybersecurity researcher Marc Hofer found unprotected police servers of two domestic surveillance platforms with similar features, including one designed to help local police track the movements of foreigners in the skiing destination of Zhangjiakou.
State-sponsored hacking and surveillance by Chinese companies may not be new, but advances in AI, data storage and data processing have amplified what such groups are able to deliver, said Hofer, who independently reviewed a portion of the ZRON data.
“It’s a new tool with a new level of power,” he said. “The hammer has become bigger, so they can wield it much more.”
Write to Josh Chin at Josh.Chin@wsj.com, Gabriele Steinhauser at Gabriele.Steinhauser@wsj.com and Tripti Lahiri at tripti.lahiri@wsj.com