Recruited to Work in Singapore, Chinese Hackers Used RATs to Target Gambling Sites and Harvest Foreign Government Information

Chinese Hackers Sent to Singapore for Cryptocurrency Job End Up Behind Bars

Three Chinese men were arrested in Singapore after being engaged by a Ni-Vanuatu citizen to conduct cyberattacks on gambling websites and a Chinese SMS service company, ultimately receiving US$3 million (S$3.9 million) in cryptocurrency for their work.

The men, Yan Peijian, 39, Huang Qin Zheng, 36, and Liu Yuqi, 33, were sentenced on 5 November 2025 to jail terms ranging from 28 months and one week to 28 months and four weeks for misusing computer systems and offences linked to organised crime.

What Were They Hired To Do

The trio had been recruited by 38-year-old Xu Liangbiao, who offered them work in Singapore.

Yan, with a background in IT and website development, and Liu, a self-taught web designer, joined Huang in travelling to Singapore in September 2022.

Xu arranged for false work permits in their names, which the men assumed were legitimate, as they believed Xu was handling the administrative process.

Once in Singapore, the men were taken to the premises of supposed employers to learn about the businesses for cover stories.

They never actually worked at these companies.

Instead, they were housed in a Mount Sinai bungalow from May 2023, paid monthly salaries of around S$2,000 to maintain a false employment front, and provided additional funds for daily expenses and rental payments totalling S$33,000, organised by Xu’s subordinate Chen Yiren.

How the Operations Were Carried Out

Xu tasked the trio with probing gambling sites and SMS service companies for vulnerabilities, conducting penetration attacks, and exfiltrating personal information.

Initially targeting user data from gambling websites to advertise his own services, Xu later shifted focus to Yi Mei, a Chinese SMS service provider, aiming to hijack two-factor authentication systems.

Source: Pixabay

The trio divided responsibilities by system type: Yan focused on Linux systems, Huang on web systems, and Liu on Windows.

They gathered domain and sub-domain data, scanned for vulnerabilities using open-source tools, categorised weaknesses by severity, and exploited them either through data extraction or deploying malware, including remote access trojans (RATs).

Authorities discovered malware-related files on their devices, including source codes for RATs, IP addresses linked to plugX malware, and tools associated with Shadow Brokers, a hacking group known for leaking US National Security Agency vulnerabilities.

While plugX is linked to state-sponsored hacker groups, the men claimed no knowledge of such associations.

What They Managed to Access

Although they attempted to avoid government sites, one laptop contained messages discussing vulnerable domains, including five Australian, Argentinian, and Vietnamese government websites.

Another contained a confidential email between Kazakhstan’s Ministry of Foreign Affairs and Ministry of Industry and Infrastructure Development.

Other data included personal details from gambling site users, traffic volumes from Yi Mei, and Philippine power company customer information.

Epic Failures or Serious Offences

The defence argued that the trio lacked prior hacking experience and did not succeed in their objectives.

Mr Lee Teck Leng, representing Huang and Liu, said,

“Prior to their arrival in Singapore, they had never even tried hacking before. When they came to Singapore, they did not have any technical expertise to hack computers.”

Yan’s lawyer, Mr Kelvin Ong, described the men as “basically epic failures” who did not meet their “key performance indicators”.

The court, however, highlighted that the men were the “main engine” of Xu’s illicit cyber operations.

Deputy Public Prosecutor Hon Yi emphasised that their well-funded and organised work posed reputational damage to Singapore, especially given the foreign government-related data found on their devices.

Electronic devices were confiscated by the Singapore Police Force following islandwide raids on 9 September 2024. (Source: Singapore Police Force)

Mr Hon said,

“This is not just amongst the general global public, but also on a government-to-government basis.”

Financial Rewards and Arrest

The trio received US$3 million in cryptocurrency from Xu for their efforts, agreeing to split it among themselves and share a portion with another hacker, Sun Jiao, who operated independently in Singapore.

On 9 September 2024, police raided the Mount Sinai bungalow, seizing the three men along with hundreds of RATs, malware, and virtual machines.

Stacks of cash were also seized during the raids. (Source: Singapore Police Force)

Xu had left Singapore in August 2023 and remains at large.

Sentences Handed Down

On 5 November 2025, the court sentenced Yan and Huang to 28 months and one week in jail each, while Liu received 28 months and four weeks.

All three had pleaded guilty to multiple charges, including computer misuse and offences linked to organised crime, marking the end of a high-profile cybercrime case that demonstrated the sophistication and international reach of illicit hacking operations.