A Chinese national operated an online gambling website in Singapore, while also providing technical support and taking a share of profits from an international cyberattack group. He also instructed others to infiltrate a server hosting company’s system, stealing and selling personal data of citizens from various countries, ultimately resulting in a prison sentence of two years and eight months.
The 43-year-old defendant, Sun Qiao, faced a total of 21 charges, including illegal acquisition of personal data, violations of the Computer Misuse Act, and offenses under the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act. On Tuesday (the 10th), he pleaded guilty to 10 of the charges, while the remaining charges were taken into consideration during sentencing.
Case details revealed that in April 2023, Sun Qiao moved to Singapore with his wife and daughter, registering Xunshan Pte Ltd under the pretense of software development and IT consulting, though no real business operations took place.
Between February and May 2024, he, together with several foreign nationals, operated an online gambling website targeting South Korean gamblers, earning about 30,000 to 70,000 USDT per month.
In September of the same year, Singapore’s Criminal Investigation Department conducted a nationwide raid and arrested six men suspected of involvement in an international cyberattack group, with Sun Qiao among them. Police seized several electronic devices and approximately USD 850,000 worth of cryptocurrency from his residence.
Investigations revealed that three Chinese nationals were recruited to carry out malware attacks on overseas websites from a bungalow in Singapore. During this period, they frequently consulted Sun Qiao on technical issues and, after receiving a reward of 3 million USDT, shared the proceeds with him, netting him about SGD 980,000 worth of cryptocurrency.
Additionally, since July 2024, Sun Qiao hired his Chinese friend Li Fengchu (41) to hack websites and steal personal data, paying at least 10,000 USDT in return. The pair targeted the Korean server hosting provider Ehost, planted malware, and obtained about 3,000 user accounts and passwords. As further operations required additional passwords, they later commissioned others to continue the attack.
The prosecution also noted that Sun Qiao cooperated with an individual codenamed “cca c13” to exploit online vulnerabilities to hack multiple websites, implanting malware, modifying source code, and inserting hidden keywords to inappropriately promote his gambling website.
Regarding personal data transactions, a Malaysian man, Xiao Jinshen (42), introduced Sun Qiao to Jiang Jianhui (39, Malaysian). Jiang expressed interest in purchasing Thai citizens’ data. Sun Qiao claimed to have about 1 million records and provided a sample of 9,369 names and phone numbers. Testing showed that some numbers could be reached and could receive SMS messages.
Subsequently, Jiang further requested Malaysian, Thai, and Vietnamese citizen data. In September 2024, Sun Qiao sent a file containing information of 6,800 Vietnamese individuals and received a transfer of 20,000 USDT, but was arrested before he could collect the funds.
Jiang Jianhui and Xiao Jinshen were arrested after entering Singapore in September 2024 and had earlier been sentenced to 14 weeks in prison each.
In addition, as early as August 2023, Sun Qiao had also sold the personal data of 1,000 South Korean citizens to other online gambling operators. After his arrest, he remained in custody until the case concluded.
Case details revealed that in April 2023, Sun Qiao moved to Singapore with his wife and daughter, registering Xunshan Pte Ltd under the pretense of software development and IT consulting, though no real business operations took place.
Between February and May 2024, he, together with several foreign nationals, operated an online gambling website targeting South Korean gamblers, earning about 30,000 to 70,000 USDT per month.
In September of the same year, Singapore’s Criminal Investigation Department conducted a nationwide raid and arrested six men suspected of involvement in an international cyberattack group, with Sun Qiao among them. Police seized several electronic devices and approximately USD 850,000 worth of cryptocurrency from his residence.
Investigations revealed that three Chinese nationals were recruited to carry out malware attacks on overseas websites from a bungalow in Singapore. During this period, they frequently consulted Sun Qiao on technical issues and, after receiving a reward of 3 million USDT, shared the proceeds with him, netting him about SGD 980,000 worth of cryptocurrency.
Additionally, since July 2024, Sun Qiao hired his Chinese friend Li Fengchu (41) to hack websites and steal personal data, paying at least 10,000 USDT in return. The pair targeted the Korean server hosting provider Ehost, planted malware, and obtained about 3,000 user accounts and passwords. As further operations required additional passwords, they later commissioned others to continue the attack.
The prosecution also noted that Sun Qiao cooperated with an individual codenamed “cca c13” to exploit online vulnerabilities to hack multiple websites, implanting malware, modifying source code, and inserting hidden keywords to inappropriately promote his gambling website.
Regarding personal data transactions, a Malaysian man, Xiao Jinshen (42), introduced Sun Qiao to Jiang Jianhui (39, Malaysian). Jiang expressed interest in purchasing Thai citizens’ data. Sun Qiao claimed to have about 1 million records and provided a sample of 9,369 names and phone numbers. Testing showed that some numbers could be reached and could receive SMS messages.
Subsequently, Jiang further requested Malaysian, Thai, and Vietnamese citizen data. In September 2024, Sun Qiao sent a file containing information of 6,800 Vietnamese individuals and received a transfer of 20,000 USDT, but was arrested before he could collect the funds.
Jiang Jianhui and Xiao Jinshen were arrested after entering Singapore in September 2024 and had earlier been sentenced to 14 weeks in prison each.
In addition, as early as August 2023, Sun Qiao had also sold the personal data of 1,000 South Korean citizens to other online gambling operators. After his arrest, he remained in custody until the case concluded.