RH DOSSIER / Cyber network / contractor

APT31 / Wuhan XRZ

Purpose
A China-linked cyber-espionage cluster targeting officials, critics and strategically important businesses. Treasury identifies Wuhan XRZ as a front company supporting its activity. [20]
Size and reach
Total personnel unknown. Treasury describes intelligence officers, contract hackers and support staff operating against international targets; named defendants are only a documented subset. [20]
Why this alignment
Treasury says Hubei’s State Security Department established Wuhan XRZ and that APT31 operates on its behalf. This is a security-service and contractor relationship. [20]
State nexus: China
STATE NEXUSChina
REPORTED AREAGlobal cyber espionage
LATEST CITED RECORD2024-03-25
RH SOURCE REVIEW13 October 2026

01 / STATE RELATIONSHIP

MSS / Hubei State Security Department

Treasury identifies Wuhan Xiaoruizhi as an MSS front and describes APT31 operations on behalf of the Hubei State Security Department.

Where the evidence stops

APT31 is an analytic label; Wuhan XRZ is a named company. The combined entry avoids counting them as two independent forces or treating the names as exact legal synonyms.

The cited dates establish the scope of this record. They do not confirm current operational capacity, complete membership or a present-day legal designation.

PUBLIC RECORD

Sources

  1. APT31 and the Wuhan XRZ front company ↗

    U.S. Treasury · 2024-03-25