Twitter restricts account of Intrusion Truth, which doxxes suspected Chinese hackers

Twitter did not immediately respond to a request for comment.

Twitter on Tuesday moved to restrict the account of a mysterious group that has published details on suspected state-sponsored hackers from China.

The group, Intrusion Truth, had spent recent days hinting that it would go public with new allegations against possible hackers, teasing followers with messages like “Watch this space” and “Who’s excited? We are.” The identity of the person or group behind Intrusion Truth has remained elusive since it started publishing information in 2017, including missives about how Chinese technology companies allegedly supported espionage on Beijing’s behalf.

Intrusion Truth’s Twitter account suggested it would publish new information on Wednesday about “hackers based in Chengdu,” a city in southwestern China. Twitter, though, plastered a warning on the account, saying that the account was “temporarily restricted” because “there has been some unusual activity.” Users still could access the page at press time Tuesday, though they would need to click through to see the tweets, as FireEye vice president John Hultquist noticed.

A Twitter spokesperson attributed the move to an anti-spam measure, as the Intrusion Truth page had been mostly dormant for a period of months only to return with a sudden uptick of tweets.

“We regularly deploy anti-spam challenges across the service to protect the public conversation, as was the case here,” the company said. “The account holder may be asked to provide additional information (e.g., a phone number) to verify their account.”

The company has taken a more aggressive approach in recent months to users who leverage their accounts to violate its terms of service. Twitter famously banned former President Donald Trump in January, for instance, and regularly takes action against accounts that engage in government information operations or try to amplify the QAnon conspiracy movement, among other examples.

Twitter also has enforced its policy against the spread of hacked materials. In July 2020, the social media firm suspended the account belonging to @DDoSecrets, a WikiLeaks-style group that had published 269 GB of data that appeared to be stolen from hundreds of U.S. police agencies.

A March 2019 policy also forbids Twitter users from publishing “other people’s private personal information without their express authorization and permission.”

Intrusion Truth published its most recent post in January 2020, saying the cyber-espionage group APT40 — which has conducted operations to support Chinese military efforts, according to FireEye — is run by a department of China’s Ministry of State Security. The post, published on a WordPress blog, linked some activity to a man named Ding Xiaoyang, an alleged computer specialist and intelligence agent said to reside in China’s Hainan province.

Update, 8:57pm ET: This story has been updated to include a response from Twitter. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure