2025 Top 20 Chinese Cybersecurity Enterprises

Introduction

#

On December 29, 2025, the Internet Society of China (中国互联网协会, ISC, an industry association affiliated with MIIT) published the China Internet Enterprise Comprehensive Strength Index (2025). Buried in Appendix 3 of the 39-page report is the 2025 Top 20 Chinese Cybersecurity Enterprises (2025年中国网络安全前二十家企业), the officially sanctioned, publicly celebrated face of Chinese cybersec.

Cross-referenced against contractor leaks, US sanctions, and published APT attributions, the list is more revealing than the ISC likely intended.

The Top 20 (full ranked list)

#

Translated from Appendix 3 of the ISC PDF (company names translated for this post). Brand names are from the report; English names follow each firm’s own usage where it exists.

Firms with off-record / contractor footprint

#

These are the firms where public reporting links them, at varying distances, to offensive operations, contractor work, or state-aligned intelligence collection.

• #1 Qihoo 360: On the US Commerce Entity List since June 2020, on BIS’s finding of “a significant risk of becoming involved in activities–the procurement of commodities and technologies for military end-use in China,” and on the DoD’s Chinese-military-tied list since 2022. 360 publishes attribution work against Western APTs, and its CEO credits the company’s exposure of CIA and NSA hacking programmes for the US sanctions.
• #2 Topsec (天融信): In ThreatConnect’s 2015 Anthem-hack attribution work¹, C2 infrastructure for the Anthem breach (attributed to Deep Panda) resolved to a topsec2014.com domain registered from TopSec_2014@163.com. Topsec is described as a PLA vendor with military clearance.
• #4 QiAnXin (奇安信): Grew out of 360’s enterprise-security business. Per The Wire China’s i-Soon investigation², a wholly-owned QiAnXin subsidiary invested in i-Soon in 2018 and remained the second-largest investor at ~13%; leaked documents show i-Soon occasionally subcontracting on QiAnXin government contracts. QiAnXin also owns the Pangu Lab (iOS-jailbreak / Bvp47) following a 2021 merger, and Natto Thoughts traces Pangu’s head TB as QiAnXin’s “key point of contact” with i-SOON’s CEO.
• #6 Venustech (启明星辰): In late May 2025, two datasets surfaced on DarkForums: the VenusTech Data Leak and the Salt Typhoon Data Leak. Per SpyCloud³, the samples appear to document offensive hacking services for Chinese state customers, including what appears to be a contract to deliver four data drops a month from the Korean National Assembly’s email server at 65,000 yuan ($9,000) a month, plus targets in Hong Kong, India, Taiwan, South Korea, Croatia, and Thailand. BankInfoSecurity⁴ covered the broader Salt Typhoon contractor angle. The dataset’s full provenance has not been independently verified outside the original brokers.
• #9 H3C (新华三): Majority-owned (81% since September 2024) by Unisplendour (紫光股份); HPE announced the sale of its remaining stake in December 2025. Its semiconductor subsidiary, New H3C Semiconductor Technologies, was added to the BIS Entity List in November 2021 as a supplier supporting “the military modernization of the People’s Liberation Army.”
• #14 SDIC Intelligence / Meiya Pico (国投智能 / 美亚柏科): On the US BIS Entity List since October 2019 for Xinjiang surveillance, and on OFAC’s Non-SDN Chinese Military-Industrial Complex Companies List since 2021. Developer of the Massistant mobile-forensic extraction tool used by Chinese police to siphon SMS, GPS, photos, contacts, and encrypted-app data from seized phones. Per Recorded Future⁵, also trains Tibetan police on hacking techniques.

The remaining 14 firms in the Top 20 sell into government, defense, and SOE markets, but public English-language reporting does not attribute them as contractors to MSS, MPS, or PLA hacking operations. Selling into the classified market is not the same as running offensive operations from those positions.

Notable absences

#

Who isn’t on the podium is the more interesting question.

• KnownSec (知道创宇): The November 2025 leak exposed a turnkey offensive toolchain, a global key-target library, and alleged exfiltration (95GB of Indian immigration data, 3TB of LG U+ call records, 459GB of Taiwan road-planning data). Absent from the top 20. The cybersecurity ranking scores firms on seven dimensions (business scale, innovation, security-assurance capability, growth, profitability, social responsibility and credit), not on tradecraft.
• i-Soon / Anxun (安洵信息): The Chengdu firm at the center of the February 2024 GitHub leak and the March 2025 US DOJ indictment of eight i-Soon employees plus two MPS officers. Not on the list, but its second-largest investor, QiAnXin, is at #4.
• Wuhan Xiaoruizhi (武汉晓睿智): DOJ-named MSS front in the March 2024 APT31 indictment of seven Chinese nationals: “In approximately 2010, the HSSD created a front company, Wuhan Xiaoruizhi Science & Technology Co., Ltd. … to carry out its computer intrusion activities.” Not on the list.
• Sichuan Silence (四川无声): OFAC-sanctioned December 2024. Integrity Tech / 永信至诚: sanctioned January 3, 2025 as a Flax Typhoon contractor. Sichuan Juxinhe (四川聚信和): sanctioned January 17, 2025 as a Salt Typhoon contractor. None on the list.

The pattern: firms that get burned in Western indictments and sanctions don’t appear on the ISC’s celebration list. The CICCI filters for scale and respectability. Burned contractors don’t make the cut, but at least one of their investors (QiAnXin) does.

US sanctions overlay

#

Of the official top 20: #1 Qihoo 360 is on the BIS Entity List (2020) and the DoD Chinese-military-tied list (2022); #9 H3C has its semiconductor subsidiary New H3C Semiconductor on the BIS Entity List (November 2021); #14 SDIC Intelligence (Meiya Pico) is on both the BIS Entity List (2019) and OFAC’s NS-CMIC list (2021). That is three of the top twenty with current US export-control or sanctions designations (H3C via subsidiary). The other seventeen are not formally sanctioned, though Topsec (#2) and QiAnXin (#4) sit close to state hacking in public reporting (Topsec via the Anthem domain overlap and its PLA partnership, QiAnXin as an i-Soon investor), and leaked samples allegedly show Venustech (#6) selling offensive services.

Of the top twenty firms that China’s officially-affiliated industry body crowned in December 2025, six turn up in US sanctions lists or offensive-cyber reporting: 360 (Entity List + DoD list), Topsec (Anthem-hack infrastructure), QiAnXin (i-Soon’s second-largest investor and Pangu’s parent), Venustech (subject of the 2025 VenusTech dark-web leak, and listed as a potential customer in the separate Salt Typhoon leak), H3C (semiconductor subsidiary on the Entity List), and SDIC Intelligence/Meiya Pico (Entity List + OFAC NS-CMIC). The CICCI is not a tradecraft index: it weights scale, innovation, growth and profit. And yet almost a third of the list has a documented state-security shadow. The list isn’t trying to be a contractor catalogue; it just happens to read like one if you cross-reference it.