What happens when a seemingly harmless news email gives hackers access to a computer? For the China-based hacker group Admin@338, this was a key part of its documented cyber espionage campaigns.
An expert take by HakTechs, HakTechs.com Lead Analyst
Admin@338 is a cyber threat group known for targeting financial institutions, policy organizations, government-related entities, and media outlets. Security researchers have linked it to targeted phishing attacks, malicious Microsoft Office documents, and remote-access malware designed to gather information from infected computers.
But there is an important distinction. Although several China-linked hacking operations made headlines in 2024 and 2025, not all belonged to Admin@338. This guide examines the group’s documented history, attack methods, known targets, and connections that can actually be supported by public evidence.
Key Takeaways
- Admin@338 is a China-based cyber espionage group tracked as G0018 in the MITRE ATT&CK knowledge base, with publicly documented activity dating back to at least 2013.
- Targeted phishing was a major attack method. The group used news stories and carefully written emails to persuade recipients to open malicious attachments.
- Poison Ivy, LOWBALL, and BUBBLEWRAP are among the malware tools associated with the group’s historical operations.
- The 2015 Hong Kong media campaign demonstrated how attackers could misuse Dropbox to communicate with infected computers.
- Recent APT31, Salt Typhoon, and Treasury-related cases must be distinguished from Admin@338. Public reporting cited here does not establish that these operations belonged to the same group.
Who Is the Admin@338 Hacker Group?
Admin@338 is a China-based threat actor primarily associated with cyber espionage. Cyber espionage involves secretly accessing computers, accounts, or networks to obtain information that may have political, economic, or intelligence value.
The group appears in the MITRE ATT&CK database as G0018. MITRE documents its use of targeted phishing, malware, and system-discovery techniques.
Unlike ransomware gangs that demand payment to restore encrypted files, Admin@338’s reported operations have focused on information gathering and unauthorized network access.
When Did Admin@338 First Appear?
Public research about Admin@338 dates back to at least October 2013. Early investigations described a threat actor targeting organizations involved in finance, economic policy, trade, and political activity.
The Council on Foreign Relations Cyber Operations Tracker identifies suspected targets that included Hong Kong pro-democracy organizations, financial institutions, and a U.S.-based think tank.
These targets suggest an interest in sensitive economic and political information. However, identifying a group’s geographic origin does not automatically establish the identities of its individual members or prove that every operation was directly ordered by a government.
Who Are the Known Members of Admin@338?
The group’s public threat-intelligence profiles describe its tools, targets, and techniques more clearly than its membership.
There is no reliable basis in the cited Admin@338 research to identify Zhou Shuai or Yin Kecheng as the group’s founders or confirmed operators. Both individuals appear in separate U.S. government cases involving malicious cyber activity, but that should not be treated as proof of Admin@338 membership.
What Is the Documented History of Admin@338 Cyber Attacks?
Admin@338 became known through campaigns that exploited people’s interest in important events. Instead of relying only on complex technical attacks, its operators used convincing messages to make harmful files appear worth opening.
The following timeline highlights the group’s best-documented historical activities.
| Period | Documented Activity | Significance |
|---|---|---|
| 2013 | Cyber espionage targeting financial, political, and policy-related organizations | Established the group’s early targeting patterns |
| March 2014 | Phishing emails used the disappearance of Malaysia Airlines Flight MH370 as bait | Demonstrated how breaking news could support targeted malware delivery |
| August 2015 | Phishing campaign targeted Hong Kong media organizations | Used malicious Office documents and LOWBALL malware |
| December 2015 | FireEye published technical analysis of the Hong Kong campaign | Documented Dropbox-based command-and-control communication and additional malware activity |
How Did Admin@338 Exploit the MH370 News Story in 2014?
In March 2014, the disappearance of Malaysia Airlines Flight MH370 attracted enormous international attention. Admin@338 used that public interest to create convincing phishing messages.
According to FireEye’s historical research, attackers sent a malicious document referencing the missing flight to a government target in the Asia-Pacific region on March 10, 2014.
The document delivered a variant of Poison Ivy, a remote-access Trojan capable of providing attackers with control over an infected computer.
Researchers also documented an attempted attack against a prominent U.S. think tank on March 14. That campaign used a malicious executable disguised as video-related content about the missing aircraft.
The lesson is simple: a familiar news story can make a dangerous attachment seem believable. Attackers do not always need to invent an unusual story when a genuine event already has people’s attention.
What Happened During the 2015 Hong Kong Media Campaign?
In August 2015, attackers sent targeted emails to newspapers, radio stations, and television organizations in Hong Kong.
The messages were written in Traditional Chinese and referenced local political and university-related events. This made the emails more relevant to their intended readers.
FireEye reported that the attached Microsoft Office documents exploited CVE-2012-0158, an older software vulnerability. Opening a malicious document on a vulnerable system could allow unwanted code to execute.
The attack installed malware known as LOWBALL, which used Dropbox for communication with the attackers. FireEye assessed that Admin@338 may have been responsible for the operation.
The full investigation is available in FireEye’s December 2015 analysis, published through Mandiant.
What Cyber Attack Tactics Does Admin@338 Use?
Admin@338’s documented techniques show how several relatively familiar methods can work together in a sophisticated intrusion.
The typical sequence involved attracting a target’s attention, delivering malware, collecting information, and using remote communication channels to continue operating on a compromised computer.
1. Spear Phishing Through Convincing Emails
Spear phishing means sending a deceptive message tailored to a particular person or organization.
Admin@338 used subjects tied to real events, including the MH370 disappearance and political developments in Hong Kong. These details increased the chance that recipients would trust the message.
Common elements of this attack style include:
- Emails designed to resemble legitimate news, notices, or invitations.
- Microsoft Office attachments carrying harmful code.
- Subjects matched to the target’s professional or political interests.
- Malicious files presented as useful documents or media.
2. Exploiting Vulnerabilities in Microsoft Office
During the Hong Kong campaign, attackers used CVE-2012-0158, a vulnerability affecting older Microsoft software components.
This allowed specially crafted documents to execute malicious code on vulnerable computers. An organization that failed to apply available security updates could remain exposed long after the vulnerability became publicly known.
Although the vulnerability was old even in 2015, it remained useful against unpatched systems. This shows why software updates matter just as much as recognizing suspicious emails.
3. Installing Remote-Access Malware
Admin@338 has been associated with several malware families, each serving a particular role in an intrusion.
| Malware | Main Function | Why It Matters |
|---|---|---|
| Poison Ivy | Remote-access Trojan | Allows attackers to control compromised systems and collect information |
| LOWBALL | Backdoor using Dropbox communication | Allows attackers to send instructions and receive information through a legitimate cloud service |
| BUBBLEWRAP | More capable backdoor | Supports continued access, system information collection, and additional functionality |
A backdoor is software that provides hidden access to a computer. Once installed, it may let an attacker return without repeating the original phishing attack.
4. Discovering Accounts, Files, and Network Information
After gaining access, Admin@338 operators performed reconnaissance. This means collecting details about the infected computer and the surrounding network.
MITRE records show the group using ordinary Windows system commands to investigate:
- User accounts: Identify local and domain accounts that might provide additional access.
- Files and directories: Discover documents, folders, and potentially valuable information.
- Operating system details: Identify system versions and configurations.
- Network connections: Understand the computer’s active connections and environment.
- Permission groups: Determine which accounts may have administrative privileges.
These activities are not automatically malicious because administrators also use system-discovery tools. The warning sign is their unexpected use by suspicious processes, particularly after a malicious attachment has executed.
How Did Admin@338 Use Dropbox to Hide Malware Communication?
One of the most interesting parts of the 2015 investigation was LOWBALL’s use of Dropbox.
Normally, Dropbox stores and synchronizes legitimate files. LOWBALL abused the service as a command-and-control channel, meaning a way for attackers to communicate with infected computers.
Instead of relying only on an unfamiliar malicious server, the malware communicated through a widely used cloud platform.
How Did the LOWBALL Attack Work?
- Initial infection: The target received and opened a malicious Office attachment on a vulnerable Windows computer.
- Malware execution: LOWBALL was installed and began communicating through Dropbox using its application programming interface (API).
- Remote instructions: The attackers placed files containing commands in a Dropbox account.
- Information collection: The infected computer processed instructions and collected system information.
- Results returned: The malware uploaded information for the attackers to retrieve.
- Further compromise: Attackers could introduce additional malware, including BUBBLEWRAP, when they needed more capabilities.
FireEye observed communication over HTTPS, the encrypted connection method also used by legitimate websites. The group could therefore blend some malicious traffic with normal internet activity.
Importantly, Dropbox itself was not the malware. The attackers were misusing a legitimate service. FireEye reported working with Dropbox to investigate the abuse and implement countermeasures.
The same investigation identified another apparently similar operation that might have involved up to 50 targets. However, FireEye stated that it lacked enough evidence to confirm Admin@338 was responsible for that separate activity.
Was Admin@338 Behind the Major China-Linked Cyber Attacks of 2024 and 2025?
Several significant cyber espionage cases involving China-linked actors received international attention during 2024 and 2025.
These included attacks against U.S. telecommunications providers, the Treasury Department, and political targets. However, the available evidence does not justify treating all these incidents as Admin@338 operations.
What Was the Connection to APT31?
On March 25, 2024, the U.S. Department of Justice announced charges against seven Chinese nationals accused of participating in APT31 cyber espionage operations.
According to the Justice Department announcement, the alleged campaign extended over approximately 14 years and targeted political figures, businesses, and critics of the Chinese government.
Prosecutors described more than 10,000 malicious emails as part of the broader operation.
Those allegations concern APT31. They do not establish that Admin@338 sent those emails or participated in the same campaign.
What Was the Salt Typhoon Campaign?
Salt Typhoon is a separate China-linked cyber espionage activity associated with compromises of U.S. telecommunications and internet service providers.
The campaign raised serious concerns because telecommunications infrastructure carries sensitive communications and related information.
On January 17, 2025, the U.S. Treasury Department sanctioned Sichuan Juxinhe Network Technology Co., Ltd., citing its direct involvement in Salt Typhoon activity.
The same announcement sanctioned Yin Kecheng for his involvement in the compromise of Treasury systems.
The January 2025 Treasury announcement identifies these actors and their respective activities, but does not establish that Salt Typhoon was an Admin@338 campaign.
Who Were Zhou Shuai, Yin Kecheng, and Shanghai Heiying?
On March 5, 2025, the Treasury Department announced additional sanctions against Zhou Shuai and Shanghai Heiying Information Technology Company, Limited.
According to the official Treasury statement, Zhou established Shanghai Heiying in 2010. The company employed individuals identified by U.S. authorities as China-backed malicious cyber actors, including Yin Kecheng.
Treasury alleged that Zhou and Yin collaborated in obtaining, brokering, and selling stolen information. Their reported victims included a defense contractor, technology businesses, a communications provider, an academic health system, and a local government organization.
The Justice Department also announced charges against Zhou and Yin, while the State Department offered a reward of up to $2 million for information leading to their arrest or conviction.
These are significant developments in U.S. efforts to counter cyber espionage. Nevertheless, they should not be presented as confirmed Admin@338 operations without specific supporting attribution.
How Do These Threat Actors Differ?
| Threat Actor or Entity | Documented Association | Important Distinction |
|---|---|---|
| Admin@338 | Historical espionage campaigns using phishing, Poison Ivy, LOWBALL, and BUBBLEWRAP | Tracked separately as MITRE G0018 |
| APT31 | Long-running espionage campaign described in March 2024 U.S. indictments | The indictment does not establish Admin@338 involvement |
| Salt Typhoon | Intrusions involving telecommunications infrastructure | Not established as an Admin@338 operation |
| Zhou Shuai and Yin Kecheng | Cyber intrusions and stolen-data brokerage described in 2025 U.S. government actions | No confirmed Admin@338 membership established by those announcements |
| Shanghai Heiying | Company sanctioned in March 2025 for its association with Zhou Shuai | Its founding is not evidence of Admin@338’s founding |
The same caution applies to Flax Typhoon and claims involving Cisco vulnerability CVE-2023-20198. Such incidents require their own attribution evidence rather than being automatically included in Admin@338’s attack history.
How Can Organizations Protect Themselves Against Admin@338-Style Attacks?
The techniques documented in Admin@338 investigations remain useful examples for understanding modern phishing and malware threats.
Organizations can reduce their exposure by combining basic security practices with monitoring and a clear incident-response process.
Which Preventive Security Measures Matter Most?
- Keep software updated. Install supported operating-system, browser, Microsoft Office, and security updates. Replace unsupported software that no longer receives fixes.
- Strengthen email protection. Scan attachments, filter suspicious messages, restrict unnecessary executable file types, and block untrusted Office macros where appropriate.
- Use phishing-resistant multi-factor authentication. Methods such as passkeys and FIDO2 security keys can strengthen account protection. MFA does not prevent malware from executing on an already compromised device.
- Monitor endpoints. Endpoint detection and response (EDR) tools can help identify suspicious programs, unexpected child processes, and unusual system activity.
- Review cloud-service activity. Watch for unexplained data transfers, unusual application connections, and unauthorized use of approved cloud platforms.
- Limit account permissions. Give users and applications only the access they need. Separate sensitive systems to reduce the damage if one device becomes infected.
- Train employees to report phishing. Teach people to verify unexpected attachments, even when messages refer to genuine news or familiar organizations.
- Maintain tested backups. Keep protected backups and confirm that important files and systems can be restored after an incident.
These measures align with established defensive guidance from the Cybersecurity and Infrastructure Security Agency (CISA). No single tool can eliminate the risk, especially when an attacker combines technical vulnerabilities with social engineering.
What Should You Do If an Admin@338-Style Intrusion Is Suspected?
If a company detects suspicious malware activity, it should follow its established incident-response procedures rather than immediately deleting everything or reinstalling systems without investigation.
- Isolate affected devices: Disconnect suspicious endpoints from the network using approved incident-response procedures to limit further access.
- Preserve evidence: Retain relevant alerts, logs, files, and system details needed for investigation.
- Investigate accounts and connections: Check for unusual logins, unexpected cloud communications, and unauthorized administrative activity.
- Remove unauthorized access: With security-team guidance, revoke compromised sessions, reset affected credentials, remove malicious software, and close the original entry point.
- Verify recovery: Confirm that affected systems are clean, properly updated, and monitored before restoring normal operations.
Organizations handling sensitive government or business information should also consider applicable incident-reporting and notification requirements.
Is Admin@338 Still an Active Cyber Threat?
Admin@338 remains listed in security threat-intelligence databases, including MITRE ATT&CK. However, a group’s continued appearance in a database does not by itself prove that it conducted a new attack in 2025 or 2026.
The most clearly documented Admin@338 campaigns discussed here occurred during 2013–2015. Public reporting reviewed for this article does not establish a new Admin@338 campaign responsible for the separate high-profile incidents discussed above.
Threat actors can change tools, infrastructure, and operating methods over time. Some may also be tracked under different names by different security companies. Reliable attribution therefore requires technical evidence rather than similarities in nationality, targets, or general attack techniques.
For defenders, the practical priority is to watch for suspicious behavior and address known weaknesses instead of focusing exclusively on one group name.
Conclusion: What Can We Learn From Admin@338?
Admin@338’s history shows that cyber espionage does not always begin with an unusually complex attack. A convincing email, an unpatched application, and a hidden remote-access program can provide attackers with a path into sensitive networks.
Its documented use of Poison Ivy, LOWBALL, BUBBLEWRAP, and legitimate cloud infrastructure also demonstrates why organizations need more than basic antivirus protection.
The most useful response is layered security: keep software updated, protect accounts, strengthen email defenses, monitor unusual activity, and prepare for incidents before they occur.
Just as importantly, understanding cyber threats requires accurate attribution. Admin@338, APT31, Salt Typhoon, and the individuals sanctioned in 2025 should not be treated as interchangeable names without supporting evidence.
Frequently Asked Questions
Is Admin@338 a Chinese hacker group?
Yes. Security researchers classify Admin@338 as a China-based cyber espionage group. The Council on Foreign Relations identifies China as its suspected state sponsor, but this does not establish the identity or government relationship of every individual involved.
Which organizations did Admin@338 target?
Documented targets included financial institutions, organizations involved in economic and trade policy, a U.S. think tank, government-related targets, and Hong Kong media organizations. These targets often handled politically or economically sensitive information.
What malware did Admin@338 use?
Researchers have associated the group with Poison Ivy, LOWBALL, and BUBBLEWRAP. These tools supported remote access, communication with infected systems, information collection, and additional malware deployment.
Was Admin@338 responsible for the Salt Typhoon attacks?
There is no established attribution in the sources cited here connecting Admin@338 to the Salt Typhoon telecommunications campaign. Salt Typhoon should be treated as a separate threat activity unless credible evidence demonstrates a connection.
Did Admin@338 exploit Cisco routers?
The group’s primary MITRE profile documents phishing, malicious documents, and Windows-focused malware activity. It does not establish that Admin@338 carried out the Cisco router attacks attributed to other threat operations.
Can Admin@338-style malware bypass antivirus software?
Some malware can avoid detection, particularly when attackers use unfamiliar files, legitimate system tools, or trusted cloud services. Updated endpoint protection, behavior monitoring, email security, and careful access controls help reduce this risk.
What is the best way to recognize a targeted phishing email?
Be cautious of unexpected attachments, unusual requests, unfamiliar sender addresses, and messages that pressure you to act quickly. A message can still be malicious even when it discusses a genuine event or appears professionally written.
Are individuals and small businesses also at risk?
Yes. Although Admin@338 historically targeted specific organizations, phishing and remote-access malware are broader threats. Individuals and small businesses should keep devices updated, use strong account protection, and avoid opening unverified attachments.
