KnownSec Data Breach: Inside China's State-Sponsored Cyber Arsenal

In early November 2025, a massive data breach at Knownsec, a prominent Chinese cybersecurity firm with government connections, exposed over 12,000 classified documents revealing the company’s role in state-sponsored cyber operations. The leak¹, summarised early by Chinese security blogger Mrxn², offers a rare look at the offensive tooling and targeting a Chinese security vendor marketed to state customers — though NetAskari, which reviewed the circulating screenshots, judged that most of the material is law-enforcement forensics and that the full dataset has not been seen.³

Who is KnownSec?

#

Knownsec (北京知道创宇信息技术股份有限公司) was founded in August 2007 and made its name in cloud-based security monitoring and defence. The Beijing company took strategic investment from Tencent in 2015 and had grown past 900 staff by the time of the leak.⁴

KnownSec holds high-level status within Chinese cybersecurity infrastructure, designated as a “first-class” (甲级) CNCERT emergency service support unit⁵ for 2024-2025, having previously been classified as a “national-level” unit from 2021-2023. This official recognition indicates deep integration with China’s government cybersecurity apparatus.

The Breach Discovery

#

The leaked materials, originally from a 2023 dataset, were briefly uploaded to GitHub in early November 2025 before being removed for platform policy violations. According to NetAskari’s analysis³, the full dataset subsequently migrated to darknet markets where it is being sold commercially. An ImgBB album containing 63 screenshots⁶ from the leaked materials has circulated among security researchers.

While reports suggest³ the leak “didn’t hold any extreme sensitive information,” the exposed documentation reveals KnownSec’s extensive product offerings to Chinese security agencies and the scope of their offensive cyber operations.

The Offensive Arsenal

#

The leaked documents expose a comprehensive suite of offensive capabilities that KnownSec developed and deployed:

GhostX Framework

#

The crown jewel of the leaked materials is the GhostX attack suite, featuring “Un-Mail,” described as an email interception and exploitation platform¹. This tool uses XSS techniques to harvest login credentials across multiple email providers including Gmail, Yahoo, and Chinese services. The framework represents a turnkey solution for credential theft and email surveillance.

Remote Access Trojans (RATs)

#

The leak revealed multi-platform RAT capabilities⁷ targeting Linux, Windows, macOS, iOS, and Android systems. A Windows Trojan module documented in the materials supports keylogging, screen capture, and command execution, reportedly designed to “bypass major Chinese antivirus programs.”¹ Android malware code was specifically designed to extract message histories from Chinese chat applications including WeChat and QQ, as well as Telegram.

Network Exploitation Tools

#

Documentation detailed WiFi intrusion methods including MITM attacks, ARP spoofing, and exploitation of the KRACK vulnerability³ (a 2017-era WPA2 weakness). While not cutting-edge techniques, their inclusion demonstrates systematic capability development for multiple attack vectors.

ZoomEye: Global Infrastructure Mapping

#

ZoomEye³, KnownSec’s network scanner similar to Shodan or Censys, claims to scan the entire IPv4 address space in just 7-10 days. Combined with their “Passive Radar” packet capture analysis tool for military asset mapping, this represents a formidable reconnaissance capability for identifying critical infrastructure globally.

Malicious Hardware

#

Perhaps most concerning is documentation of physical attack tools, including a malicious power bank that, depending on which report you read, covertly moves data to or from a connected victim device.⁴ These hardware implants extend cyber operations into the physical domain.

Global Targeting Scope

#

The most damaging revelation came from the “key target library” document, which showed KnownSec mapped critical infrastructure across multiple nations³, focusing on military, telecommunications, energy, and political systems.

The leaked structured datasets included LinkedIn profiles organized by country¹ (“linkedin_brazil,” “linkedin_southafrica”), exposing professional contact information and occupational details suitable for intelligence targeting and social engineering operations.

Over 20 countries⁸ appeared in the target lists. India, Japan, Vietnam, Indonesia and the United Kingdom featured prominently, alongside Nigeria.

Documented Successful Operations

#

The breach also contained what is alleged to be a record of successful operations. A spreadsheet listing 80 overseas targets⁷ included specific data theft operations:

• 95GB of Indian immigration data – allegedly stolen in 2024⁸, including border infrastructure mapping
• 3TB of call records from South Korean telecom LG U Plus – a massive telecommunications surveillance operation
• 459GB of Taiwan road planning data – infrastructure intelligence collection

If the spreadsheet is genuine, these figures would put KnownSec beyond capability development and into active intelligence collection — but every outlet reporting them calls them alleged, and no researcher has published the underlying data.

Implications for Cybersecurity

#

This breach illuminates the blurred boundaries between China’s commercial cybersecurity sector and state intelligence operations. As BotCrawl put it (quoted in the net4people thread⁵), this disclosure is “comparable to a major defense contractor having its classified weapon blueprints stolen and publicly sold.”

The revelation that a “trusted” cybersecurity vendor with legitimate commercial operations simultaneously develops offensive tools and maintains targeting databases raises fundamental questions about supply chain security. Organizations that use KnownSec products such as ZoomEye should at least ask what a vendor with these state customers can see of their data.

The leak also exposes the systematic nature of Chinese cyber operations – from reconnaissance tools scanning the entire internet, to exploitation frameworks, to hardware implants, to alleged data exfiltration at the terabyte scale. This represents a mature, industrial-scale cyber espionage capability.

China’s Official Response

#

Beijing has officially denied the reports. A Foreign Ministry spokesperson stated⁴ she was unaware of any KnownSec breach, reaffirming that “China firmly opposes and combats all forms of cyberattacks in accordance with the law.” This denial follows China’s typical pattern of disavowing cyber espionage allegations despite mounting evidence.

Conclusion

#

The KnownSec breach provides a rare, detailed look into the infrastructure supporting state-sponsored cyber operations. While individual tools may not represent cutting-edge technology, the systematic integration of reconnaissance, exploitation, and data exfiltration capabilities – backed by targeting databases spanning continents – reveals a sophisticated operation.

For defenders, this leak offers valuable intelligence about adversary tools, techniques, and targeting priorities. Organizations in the documented target countries, particularly those in critical infrastructure sectors, should review their security postures with the assumption that similar mapping and targeting operations may be ongoing.

The incident underscores an uncomfortable reality: the line between commercial cybersecurity services and state intelligence operations can be vanishingly thin, particularly in authoritarian regimes where government direction of private enterprise is standard practice. As research into China’s cyber ecosystem⁹ shows, “Red Hackers” and their commercial successors have long operated at this intersection.

The full scope of the KnownSec leak remains incompletely analyzed, as few researchers have accessed the complete dataset³. As more details emerge, expect deeper insights into the tools, targeting, and operations conducted under the guise of legitimate cybersecurity services.