Also (according to the DIA, so not sure how trustworthy self-reporting is) they withheld the information about the defector from the CIA and FBI over concerns they were compromised by the Chinese. IF that's true that's a pretty sure indication that they're at least partially white hats.

I can't think of a good reason for them to have this entire event chain and to lie about suppressing the info or the likes. If they had the ability to, they'd have the ability to do other things that I'd figure make more sense from a black-hat perspective.