Counterintelligence & Tradecraft — 2026-04-28

Treasury Sanctions Shanghai Cyber Actor and Data Broker Who Sold Stolen US Critical Infrastructure Data

The Treasury Department's Office of Foreign Assets Control on April 28 designated Shanghai-based malicious cyber actor Zhou Shuai and his company Shanghai Heiying Information Technology for illegally acquiring, brokering, and selling data from highly sensitive US critical infrastructure networks. Zhou Shuai collaborated with previously sanctioned China-backed cyber actor Yin Kecheng, selling exfiltrated data and access to compromised networks since at least 2018. Victims included technology companies, a defense industrial base contractor, a communications service provider, an academic health system, and a government municipality. In 2020, Zhou Shuai appeared to be working from intelligence requirements targeting the United States, Russia, and Western Europe.

Analysis
Per OFAC's designation announcement, Zhou Shuai and Shanghai Heiying occupied a commercial brokerage layer within China's state-affiliated cyber apparatus, monetizing exfiltrated access and data in collaboration with previously sanctioned actor Yin Kecheng. Victim sectors, including defense contractors, communications providers, health systems, and municipal governments, map to PRC ISR priorities and indicate systematic rather than opportunistic collection. Zhou's 2020 requirements spanning the US, Russia, and Western Europe suggest simultaneous servicing of multiple clients, though that profile is at least as consistent with commercial brokerage for non-state buyers as with formal PRC direction. Additional network members are likely to face Treasury designation within the next 12 months, consistent with OFAC's pattern of incremental dismantlement.

1 sources

Treasury Sanctions China-based Hacker Involved in Compromise of Sensitive US Victim Networks - US Treasury