Chinese cybersecurity firm Knownsec suffers massive data breach exposing state-linked hacking operations

A major cybersecurity incident in China has exposed more than 12,000 confidential documents from Knownsec, a Beijing-based information security company with links to the Chinese military.

The leaked files include detailed information on state-sponsored cyber weapons, internal hacking tools, and global target lists associated with Chinese intelligence operations. The data also reportedly contains Remote Access Trojan programs capable of compromising systems across multiple operating platforms, including Linux, Windows, macOS, iOS, and Android.

Code samples retrieved from the breach indicate that the Android-based malware was designed to harvest data from popular Chinese messaging platforms and the encrypted communication service Telegram.

Among the leaked materials is a spreadsheet naming 80 foreign organizations that Knownsec allegedly infiltrated. Additional data caches appear to include 95 gigabytes of immigration records from India, 3 terabytes of call data from South Korean telecommunications provider LG U Plus, and 459 gigabytes of transportation planning information from Taiwan.

A portion of the stolen documents was briefly uploaded to GitHub before the hosting platform removed them. The incident represents one of the most significant cybersecurity leaks tied to a Chinese defense-affiliated company, revealing extensive details of offensive cyber capabilities and international surveillance operations. Investigations into the scope and authenticity of the exposed materials are ongoing.