The Knownsec Leak: China's Cyber-Espionage Exposed

The November 2025 leak from Chinese contractor Knownsec continues to yield insights into state-aligned cyber-espionage operations. DomainTools’ analysis reveals an integrated offensive platform combining ZoomEye (40,000+ component fingerprints), TargetDB (mapping 378 million IPs across critical infrastructure), and toolkits like GhostX (browser exploitation), Un-Mail (webmail takeover), and Passive Radar (internal network reconstruction). Resecurity’s deep dive covers over 12,000 internal documents, including RATs and surveillance data on targets in 20+ countries, with Taiwan, Japan, South Korea, and the US among them. Taken together, they position Knownsec as a core node in China’s contractor-driven cyber state, well beyond a conventional security vendor.