PHNOM PENH -- Hackers at a Chinese state-linked security contractor targeted government agencies across Southeast Asia for years, a major document leak shows, revealing rare details of cyberespionage in countries where Beijing has strong political and economic ties.

The hacks -- which appear to have penetrated state systems in Thailand, Vietnam, Malaysia, Indonesia, Myanmar and Cambodia, as well as private companies -- add to a long pattern of Chinese actors attacking smaller, more vulnerable neighbors to keep tabs on hot-button issues and glean information about Western tech companies operating in the region, experts said.

"China is a great power and has deep interests in Southeast Asia," said Gatra Priyandita, a Southeast Asia expert at the Australian Strategic Policy Institute's (ASPI) International Cyber Policy Centre. "They want to know what's going on, and cyber tools help in supporting their efforts to win over officials. There's also an interest in sensitive information and intellectual property."

In mid-February, more than 500 files from Shanghai-based security contractor I-Soon, also known as Anxun, were anonymously posted online. The rare document dump quickly spread among media and cybersecurity experts who verified the authenticity of those files. Chinese police said they were investigating how the data were leaked.

One spreadsheet contained about 80 targets that I-Soon infiltrated, nearly one-third of them in Southeast Asia. A total of eight Thai government agencies were listed as hacking targets between 2020 and 2022, including the National Intelligence Agency and Ministry of Interior, plus two state-owned telecom companies and the country's biggest mobile operator.

A handful of Malaysian agencies also appeared in the documents, as well as government targets in Vietnam, Indonesia, Cambodia and Myanmar, and a telecommunications operator in the Philippines.

Thai, Malaysian, Indonesian and Vietnamese officials did not respond to requests for comment.

The hacks varied in their timing and scope. In some cases, notes explained the access I-Soon achieved, such as "hundreds of machines in the domain" and "office network" for Cambodia's Financial Management Information System site, a World Bank-backed project that serves as the country's central budget and finance apparatus.

Ministry of Economy and Finance spokesperson Meas Soksensan told Nikkei Asia via text that he had not heard about the I-Soon hacks before deleting his message and writing, "There has never been a problem. The security system we built is strong and secure."

Experts told Nikkei it was not clear if some dates in the spreadsheet referred to when hacks began or ended and said some operations could be ongoing. U.S.-based cybersecurity company Palo Alto Networks has documented links between I-Soon's tactics and previous Chinese-state-affiliated advanced persistent threat (APT) campaigns, which are designed to remain undetected for long periods of time.

The I-Soon office, also known as Anxun, in Chengdu.    © AP

Although the spreadsheet did not name specific clients, other documents showed that I-Soon had contracts with several Chinese government entities, including the country's top police agency.

Networks in Hong Kong and self-ruled Taiwan, which China claims as its territory, also appear to have been targeted, as well as overseas Chinese dissidents.

Southeast Asia has weathered Chinese cyberespionage since at least the mid-2000s. In recent years, researchers have documented schemes that successfully targeted regional ministries and grabbed thousands of emails from the Association of Southeast Asian Nations (ASEAN), relying on tactics such as "backdoor" malware in software updates and e-mail phishing, designed to trick users into divulging private information.

Hacks often corresponded with geopolitical developments that concern China, such as ASEAN meetings or flare-ups in the South China Sea, where Beijing and its neighbors have overlapping claims.

Information from foreign affairs ministries, which I-Soon targeted in Thailand, Indonesia and Vietnam, is of particular interest, along with defense ministries, said Abdul Rahman Yaacob, a research fellow at the Lowy Institute's Southeast Asia Program.

"The main point of doing these attacks, especially in these specific government departments or ministries, is to understand and get data on their strategic assessments, their military developments, and their security," he told Nikkei.

Hacking is not limited to governments. By 2020, private entities in Southeast Asia -- including universities and companies -- made up 15.4% of worldwide APT targeting as opposed to just 3.6% in 2014, according to a 2022 report from ASPI.

That may be because Chinese hackers are interested in penetrating Western tech giants, but struggle to do so directly, said ASPI's Priyandita.

"Because it's hard to get to Microsoft, they may target a company in Thailand that's doing business with Microsoft," Priyandita said. "They may get access to potential information that will find vulnerabilities within the supply chain for Microsoft, and get to the IP (intellectual property) that way."

Yet, Southeast Asian governments and companies rarely acknowledge security breaches in public -- and sometimes deny them -- because of the technical and legal challenges in identifying and attributing them to Chinese state actors, analysts said.

Even for cyber-mature countries such as Singapore, "the pace, the magnitude, and the frequency of some of these attacks is just overwhelming," said Elina Noor, senior fellow at the Carnegie Endowment for International Peace's Asia Program. "There's also understandably a lack of political will in calling out the perpetrators, even if they're able to identify who the perpetrators are," she added.

Still, ASEAN has pushed to make cybersecurity a bigger priority. In 2018, it became the only regional association to adopt the United Nations' 11 norms of state behavior in cyberspace. More recently, it launched a center for cooperation among ASEAN defense establishments against cyberattacks.

"There will be more attacks, by state or non-state actors, to find the weak points and extract data from ASEAN countries," said Lowy Insitute's Yaacob. "The main issue now is whether ASEAN can effectively develop their capabilities to protect their digital economies and strategic interests."