A look at Intrusion Truth, an anonymous group that since last April has been posting info about alleged members of state sponsored Chinese hacking unit APT10
Since April last year, a group calling itself ‘Intrusion Truth’ has trickled out the real names of hackers working for Chinese intelligence. Tweets: @josephfcox , @josephfcox , @josephfcox , @gossithedog , @josephfcox , and @x0rz Tweets: Joseph Cox / @josephfcox : For background, APT10 (the group that Intrusion Truth is currently doxing) is one of the most prolific Chinese cyber-espionage operations going right now. Targets Managed Service Providers to move onto ultimate victims. Their scale makes them stand out https://motherboard.vice.com/ ... pic.twitter.com/ms4NRpVaCr Joseph Cox / @josephfcox : Doxing via an anonymous blog is not going to have the same impact as ‘doxing’ in a US DOJ indictment, obviously. But Intrusion Truth's motive isn't necessarily for grand changes to China's hacking policy. Doxing can disrupt or dissuade individual hackers https://motherboard.vice.com/ ... pic.twitter.com/1GHNxaAFFY Joseph Cox / @josephfcox : New: interviewed Intrusion Truth, the mysterious group doxing hackers working for Chinese intel - sources confirm Intrusion Truth's data overlaps with non-public info on APT10, including names - idea is to make life more difficult for individual hackers https://motherboard.vice.com/ ... pic.twitter.com/hGjifoAWcY Kevin Beaumont / @gossithedog : So I suggested this may be a nation state last week. It's probably a bad idea as it's all fun and games until somebody starts doxxing your own agents. https://motherboard.vice.com/ ... Joseph Cox / @josephfcox : This is the building where Intrusion Truth says an alleged Chinese APT10 hacker goes. Based on (hacked?) Uber receipts. I couldn't confirm the receipts, but source with knowledge said the city is correct https://motherboard.vice.com/ ... pic.twitter.com/nu3Vk1m9rW @x0rz : Doxing APT members is the new hack back https://motherboard.vice.com/ ... #cyber #threatintel
Context & Ripple Effects
Intrusion Truth's campaign fits a pattern Motherboard has tracked all year: outsiders pulling back the curtain on state hacking crews without waiting for governments. In May, a hacker claimed to have stolen internal data from ZooPark, an Iran-linked APT targeting Android devices across the Middle East — evidence that the people behind these operations can be reached and exposed by civilians, not just indicted by prosecutors.
APT10 matters because of scale and technique: as Joseph Cox's reporting notes, it compromises managed service providers to pivot into their downstream victims, making it one of the most prolific Chinese cyber-espionage operations running. The doxing names individuals inside a unit whose supply-chain tradecraft would later be echoed in warnings like Microsoft's 2023 disclosure of Chinese state hackers inside US critical infrastructure, and in analyses of China's evolving approach that increasingly leans on private-sector hackers.
First-order effects
- Alleged APT10 operators now have their real names attached to their work publicly, ending the anonymity that lets intelligence-linked hackers move between contracts and cover employers.
- Managed service providers — APT10's preferred entry point — face immediate pressure to prove they are not the weak link customers get breached through.
Second-order effects
- The ZooPark data theft showed state hacking groups can be penetrated and exposed from outside; Intrusion Truth's naming campaign gives threat-intel researchers a second proof point, likely encouraging more independent attribution rather than waiting for DOJ indictments.
- Chinese intelligence's growing reliance on private-sector and contract hackers means each exposed individual raises recruitment and operational-security costs across the whole ecosystem, not just APT10.
Third-order effects
- If anonymous collectives keep successfully identifying state hackers, attribution shifts structurally from government announcements toward crowdsourced exposure, changing how both Beijing and Washington calculate the cost of deniable operations.
- Persistent personal exposure of operators points toward a longer contest over the human layer of state hacking — where China's shift to distributed private-sector talent makes unit-level takedowns harder but individual doxing more damaging.
The trend: Attribution of state-sponsored hacking is migrating from government indictments toward anonymous independent researchers who name individual operators directly.