Everybody hacks everybody

https://www.forbes.com/sites/joshpearce/2025/11/15/why-farmers-are-shielding-their-crops-with-solar-panels/

Man, the Snowden leaks had examples of 5th to 6th party docs retrieved from hacking intelligence agencies who had hacked intelligence agencies who... You get the point

5 eyes countries literally spy on their own citizens by proxy, retrieving information from each others' agencies directly

https://spycloud.com/blog/state-secrets-for-sale-chinese-hacking/

China’s state-sanctioned data collection and intelligence apparatus is leaky. We have observed a vast ecosystem of corrupt insiders siphoning data from China’s state-sponsored data collections apparatus and selling it on the black market. This threat activity most acutely affects Chinese citizens, whose personal data is readily available to any paying customer.

Cybercriminals from the Sinosphere appear to be increasingly present in Western digital crime spaces. This trend seems to be somewhat driven by Chinese scam and smishing actors aggressively and successfully targeting overseas victims. We frequently observe Chinese-language actors re-sharing (or sometimes taking and attempting to re-sell) data breaches from English-language forums in Chinese-speaking communities.

Countries like China rely a lot of independent local groups doing the dirty job so they can shield their national reputation by "taking care of" individual groups as they become a liability. Russia and others do it too. Everybody hacks everybody. Some of these groups target both foreigners and their own. Sometimes for domestic spying, sometimes just for plain scams.