Investigating Chinese Intelligence Firm Zhenhua Data

Editorial note, 7 August 2026. This investigation was first published on 17 September 2020, at shadowmap.com/security-research/investigating-chinese-intelligence-firm-zhenhua-data/. It is reproduced here at its new address essentially as it was written, and nothing in it has been brought up to date. The systems described, the findings and the assessments are all as at September 2020, and much of the infrastructure discussed was taken offline in the weeks that followed. The platform screenshots that accompanied the original are not reproduced; several of them show individual records drawn from the OKIDB dataset. ShadowMap's present-day work in this area is described under dark web monitoring and threat intelligence.

Stories of Chinese Intelligence Firms leveraging Big Data Analysis, Social Media Platforms, LinkedIn, Mobile Devices, SIGINT, etc are all over the internet. However the recent stories about the Zhenhua Data Leak in the Indian Express caught our attention, and we pointed our ShadowMap platform at it to get more insight on the Zhenhua Data operation.

After several days deep in this rabbit hole of vague corporations, a wide range of collection systems and some genuinely interesting correlation use-cases, we have put together a fairly detailed picture of the Zhenhua Data operation.

On the surface Zhenhua Data looks like "just another" firm capturing, processing and selling publicly available information. The story changes rapidly once you look further.

This post covers four sections: Data Collection, Data Correlation, Identified Targets and Conclusion.

Zhenhua Data & Affiliates

According to the Zhenhua Data website, which has been taken offline but is still accessible via ShadowMap: "Zhenhua Data focuses on integrating overseas data and information to provide services for domestic institutions". Alongside Shenzhen Zhenhua Data Information Technology Co., Ltd. (china-revival.com), which has already received wide-spread coverage, we also found the involvement of Weiju (aggso.com) & SocialDataMax (socialdatamax.com).

Weiju started out as a "location-based, instant messaging application that enables users to chat with nearby strangers.". The last update on its website, in 2015, mentions "Public opinion monitoring and early warning", "Communication analysis statistics", etc.

Several of the underlying platforms are credited to "Beijing Juwei Hezhi Information Technology Co., Ltd.", which has a very limited public presence but is listed online as "Juwei Hezhi is a company that analyzes social media big data".

Data Collection

Zhenhua Data runs a large number of data collection platforms. These cover the standard social media platforms such as Twitter, LinkedIn, Facebook, TikTok, VK, Instagram etc. They also monitor a wide range of media outlets, news websites, news aggregators such as Reddit, etc.

They also seem to have private sources of data such as near real-time movement of warships, satellite tracking and troop movements. We found references to private feeds with access to data from "affiliate apps & websites", but have not been able to discover or access these portals directly.

Some examples of the collection systems that are publicly accessible:

LinkedIn. This system continuously searches LinkedIn for a range of keywords and downloads the matching profiles, photos, etc.

TikTok. This system monitors specific target accounts and downloads all videos, comments, user relationships, etc in near real time. A lot of the accounts being monitored are related to US Army recruitment and active duty forces.

Reddit. This system monitors specific subreddits such as /r/politics to continuously track news stories, upvotes, users, etc.

Forum Discussions. This system monitors a wide range of internet forum discussions, scraping all posts being made, data about the users and the sentiment of each post.

Databases of Key Individuals & Organisations. This system maintains a real-time list of key Mobile Applications, Media Organisations, Think Tanks, Social Media accounts, etc.

Tracking Global Risk Events. This system tracks a number of global risk events such as Weapons of Mass Destruction, Extreme weather events, Climate change mitigation and response, Network Attack, etc.

Data Correlation

Some of the Data Collection systems would sit within the scope of any average social media big data company. The use-cases and correlations we found are where it gets interesting.

Internet Big Data Military Intelligence System

This was one of the first systems our platform discovered with a direct link to Zhenhua Data, and it tells a very different story from the "social media monitoring" cover that has been used. The platform appears to have four subsystems: Internet Information Collection System, Big Data Cleaning & Processing System, Foreign Army Internet Intelligence System & Key Group Monitoring and Analysis System.

Digging further, we found another platform that pulls several of the private and public data collection systems together into military intelligence.

Real-time War Ship Monitoring & Correlation Platform

This platform tracks near real-time movements of both commercial and military naval ships. It can also correlate a wide range of information such as Social Media information of the crew on-board each vessel, photos and videos from individuals and official social media accounts, news stories, weapons manifests, historical location data, etc.

The strike chain functionality tracks key personnel as well, and links them back to the much talked about OKIDB (Overseas Key Information Database), which holds more relevant and correlated data on each individual target.

The screens we captured from this platform covered warship monitoring, weapons information for individual naval warships, warship port information, tracking of naval officers on-board via their social media accounts, and the strike chain view of key personnel.

Correlating Social Media Data with OKIDB

Zhenhua Data also has Social Media Relationship Query tools that analyse target social media accounts and their relationships with other individuals, and give access to the additional data stored about each individual in the OKIDB.

Each of the millions of members has a "Character ID" and a page in the OKIDB that holds more detail about them, their social media accounts, their families, their businesses, their relationships, etc. The OKIDB contains data about politicians, royalty, business leaders, journalists, members of think tanks, research scientists, etc.

Beyond these, hundreds of other such systems are online but sit behind login pages, or have been taken offline since the media attention started. ShadowMap has not accessed them.

Some of the other systems that are online but sit behind login pages:

• Customer Data Collection Center
• Global Public Opinion Monitoring System
• Crowdsourcing Platform
• Think Tank System
• Resource Download System

Identified Targets

The OKIDB has been covered in-depth by several media organisations that have dissected the list of targets in detail. Generally speaking the OKIDB seems to contain information about anybody that has any level of influence or is affiliated with any such person. The influence is determined on the basis of social media relationships, news mentions, face recognition in public photographs, etc.

We also found several target keyword lists that are actively being used as part of the data collection platforms and seem to be focusing on a wide range of keywords related to Hong Kong. These include key events such as "2019 Prince Edward station attack", monikers used for well-known protestors, phrases such as "Trying to decrypt" and hundreds of political individuals on both sides.

Conclusion to the Zhenhua Data Story

After studying the ShadowMap reports for Zhenhua Data, we are reasonably certain that everything we have seen so far is only scratching the surface of the Data Collection and Internet Intelligence Systems in place.

Most folks brush off concerns around social media monitoring as the "price of admission". Privacy and security professionals understand the true risks and have been raising warnings for years, from something as simple as when Fitbit tracking app Strava disclosed the location of secret US army bases, to modernising and automating the process of gaining "kompromat" on a target.

The technology and capabilities we have seen with Zhenhua Data show that the dystopian future George Orwell's 1984 warned us about is here to stay. Whether it is silencing political opponents, quashing protests, spreading misinformation to influence elections or attacking enemy militaries, Big Data Surveillance systems will continue to have a significant role to play in geo-politics.