Adversary Intelligence — 2026-05-01

FBI Cyber Chief Warns China MSS Hacker-for-Hire Ecosystem Is Out of Control

FBI Cyber Division Assistant Director Brett Leatherman warned on April 30 that China's network of private companies and contractors cast a wide net to identify vulnerable computers, exploit them, and sell information to the PRC government. He described how MSS-directed contractors operate as both cyber mercenaries selling stolen access to the state and dealers selling it on dark web platforms when the government declines to purchase. The assessment came as the Shanghai State Security Bureau's role directing private firms was exposed through the Silk Typhoon prosecution.

Analysis
Per a single-source Reuters readout of Leatherman's public remarks, the FBI's "out of control" characterization implies the MSS has lost meaningful oversight of how contractors monetize stolen access, allowing state-directed operations to leak into secondary criminal markets without explicit sanction. The Shanghai State Security Bureau's direct role in the Silk Typhoon prosecution provides both the evidentiary architecture and public attribution model for follow-on cases. DOJ will likely unseal at least one additional indictment against named MSS contractors within the next 90 days. Leatherman's extradition warning signals a deterrence pivot toward the contractor tier, the only layer legally reachable. The dark-web commercial layer may instead be deliberate MSS cutout architecture for deniability, not organizational loss of control.

3 sources

FBI: China's hacker-for-hire ecosystem out of control - The Register
Chinese hackers vulnerable to U.S. arrest if they travel, FBI official says - Reuters
FBI Warns of China's Expanding Hack-for-Hire Network Amid Extradition Case - EconoTimes