RH DOSSIER / Cyber network / contractor

APT40 / Hainan Xiandun

Purpose
A cyber-espionage cluster associated with theft of commercially and strategically valuable research. U.S. prosecutors describe Hainan Xiandun as a front used to conceal state involvement. [21]
Size and reach
No reliable total. DOJ’s 2021 case concerned dozens of victim organizations, not a membership census. Hainan Xiandun was already disbanded; the broader APT40 label persists. [21][22]
Why this alignment
Authorities link the activity to Hainan’s State Security Department and the MSS. Stolen research could benefit Chinese industries and state priorities; the criminal charges remain allegations. [21][22]
State nexus: China
STATE NEXUSChina
REPORTED AREAGlobal cyber espionage
LATEST CITED RECORD2024-07-08
RH SOURCE REVIEW13 October 2026

01 / STATE RELATIONSHIP

MSS / Hainan State Security Department

The July 2024 joint advisory attributes APT40 tasking to China's MSS through its Hainan department.

CISA and international partner agencies · 2024-07-08 ↗U.S. Department of Justice · 2021-07-19 ↗

02 / CONTEXT IN THE RECORD

What to know

The 2021 indictment alleges that Hainan Xiandun concealed state involvement. The later advisory describes APT40 activity without reviving that company as a current entity.

U.S. Department of Justice · 2021-07-19 ↗CISA and international partner agencies · 2024-07-08 ↗

Where the evidence stops

The 2021 DOJ record says Hainan Xiandun had already disbanded. Its historical front-company role must not be presented as proof it still operates.

The cited dates establish the scope of this record. They do not confirm current operational capacity, complete membership or a present-day legal designation.

PUBLIC RECORD

Sources

  1. Joint government attribution of APT40 to China's MSS ↗

    CISA and international partner agencies · 2024-07-08

  2. APT40 and the Hainan Xiandun front-company indictment ↗

    U.S. Department of Justice · 2021-07-19