THE KNOWNSEC LEAK: Yet Another Leak of China’s Contractor-Driven Cyber-Espionage Ecosystem

According to DomainTools Investigations, the Knownsec leak emerged in November 2025 and comprises 60-plus screenshots, with 65 document images shared by a single uploader, while a fuller context was provided on 31 December 2025 by Resecurity.

The materials depict Knownsec as a state-aligned cyber contractor serving China’s security state, with offensive tools such as GhostX, Un-Mail and Passive Radar, linked to a comprehensive intrusion-to-exfiltration pipeline and integrated with ZoomEye’s internet-wide reconnaissance capabilities.

The leak reveals a TargetDB catalog containing 24,241 organizations, 378,942,040 IP addresses and 3,482,468 domains across 26 regions, annotated to identify military, government, energy, financial, telecom, and other critical sectors, forming a foreign-target prioritisation engine used with ZoomEye outputs. It also discloses an o_data data lake housing breach datasets used for identity correlation and deanonymisation to power spearphishing and social engineering.

Hidden organisational details include 22 named Knownsec employees across strategic, operational, technical, and support layers, with internal emails and WBS-driven governance aligning with state-backed defence contractors. The leak situates Knownsec within China’s broader cyber-operations ecosystem, naming Ministries and state security entities as primary customers and partners.