Adversary Intelligence — 2026-07-29

Researchers Link Chinese Vendor Guangdong Chanming to PLA RedRelay Covert Cyber Attack Network

BLUFIndependent corroboration of Intrusion Truth's single-chain attribution linking Guangdong Chanming to PLA Unit 61046 is unlikely within 90 days, leaving network defenders without a validated second indicator set.

Intrusion Truth reported on July 27 that Guangdong Chanming Technology, a Chinese firm with no public website or product listings, holds patents for anonymizing, tunneling, and mobile-data-extraction tools 1. Procurement records cited in the report list the firm as supplier of an "Anonymous Network System" to a PLA unit in Beijing's Haidian District, home to the PLA Cyberspace Force, part of a broader 2024-2025 customer roster that also included China's Ministry of Public Security 12. Researchers traced a phone number and email address linked to shareholder Wang Huiping to a GitHub-hosted tool called FCN, whose code shares an unusual Linux command with the WHIPWEAVE malware tied to the RedRelay, or ORBWEAVER, network, and whose strings turned up directly inside Guangdong Chanming's own "STN" anti-traceability product 13. Intrusion Truth further linked RedRelay's use to the APT cluster tracked as APT15 or Ke3chang and to PLA Unit 61046 and the Cyberspace Force's 8th Bureau, an attribution Cyber Security News said should be weighed against independent evidence 13.

Analysis
Independent corroboration of the RedRelay-to-APT15/Unit 61046 attribution from a source other than Intrusion Truth is unlikely within 90 days. The Guangdong Chanming-to-WHIPWEAVE chain rests on a leaked email address, a forked GitHub repository, and one shared Linux command, threads few outside researchers can replicate without matching breach-data access. Confidence is low given the narrow single-chain sourcing, with Cyber Press, Cyber Security News, and GBHackers only republishing Intrusion Truth's findings rather than independently verifying them, and no competing technical review of the FCN-to-WHIPWEAVE code overlap yet exists. The shared command and code overlaps may instead reflect common reuse of open-source networking utilities across unrelated Chinese developers rather than a deliberate state procurement pipeline. Absent corroboration, network defenders should not reallocate threat-hunting resources to prioritize blocking xfconnect.com-associated infrastructure or treat WHIPWEAVE detections as tied to Unit 61046.
4 sources
  1. Dear Diary, Today I found a Ghost in the Network - Intrusion Truth
  2. Researchers Link Chinese Cyber Vendor to PLA's RedRelay Covert Attack Network - Cyber Press
  3. Researchers Say a 'Ghost' Chinese Company Built the Network Hiding PLA Cyberattacks - Cyber Security News
  4. Chinese Hackers Use RedRelay Multi-Hop Network to Conceal Global Cyber Operations - GBHackers

View in full brief →

UNCLASSIFIED // OPEN SOURCE