KnownSec Data Leak Exposes State-Aligned Cyber Espionage Pipeline

A massive data leak from KnownSec, a Beijing-based cybersecurity firm, exposes how the organisation operates as a contractor for China’s Ministry of Public Security and other state entities, blurring the line between defensive services and offensive intelligence. According to DomainTools, KnownSec’s operations form a vertically integrated espionage stack designed for global reconnaissance, targeted intrusion and long-term surveillance.

The leak highlights ZoomEye, marketed as a cyberspace search engine, and its integration with a classified TargetDB containing over 24,000 organisations and 378 million IP addresses mapped across 26 regions, including Taiwan, Japan, South Korea and India. For active intrusion, KnownSec relies on GhostX, a multi-vector exploitation and persistence framework described as capable of profiling users, stealing credentials and manipulating network traffic.

The report also details Un-Mail for webmail takeover with IMAP/POP mailbox replication, and Passive Radar, which maps internal networks from PCAP data without active scanning. It notes a data lake of breached credentials and identity data used for identity-correlation and social engineering.