{"id":"d099d8f4-57b1-4f14-b9da-b27975ecf5ec","slug":"knownsec-data-breach-leak-2025-11","kind":"other","headline":"Massive data leak from Knownsec exposes 12,000+ internal documents revealing state-linked cyber espionage tools and global targets","summary":"In November 2025, a massive data leak from Chinese cybersecurity firm Knownsec was posted on GitHub by an actor using the alias t1g3r. The leak exposed over 12,000 internal documents including offensive cyber tools (GhostX, Un-Mail, Windows T-Horse RAT), global surveillance target lists covering 20+ countries, and evidence of stolen data including 95 GB of Indian immigration records and 3 TB of South Korean call logs. The documents revealed Knownsec operates as a state-aligned cyber contractor supporting Chinese intelligence objectives, with clients including Public Security Bureaus, the State Grid Corporation, and China Telecom. The leak was analyzed by Resecurity, DomainTools, and Field Effect, among others.","occurredAt":"2025-11-07T00:00:00.000Z","reviewStatus":"reviewed","modelId":null,"deploymentId":null,"companyId":"d66c7ff3-115f-45ca-9b4d-a90a164caf22","dataCenterId":null,"aliases":[],"collisionRisk":"none","reviewNote":null,"severity":"critical","rootCauseCategory":null,"rootCauseDetail":null,"affectedUnitsCount":null,"affectedUnitsBasis":null,"remediationStatus":"outstanding","regulatoryAction":"none","regulatoryBody":null,"propertyDamageEstimateUsd":null,"damageEstimateBasis":null,"bodilyInjurySeverity":null,"fatalityCount":null,"lossCostClass":null,"sourceQualityTier":null,"oshaRecordable":null,"oshaCaseNumber":null,"rootCauseDisclosed":null,"publicDisclosureDate":null,"insuranceClaimPublic":null,"formFactor":null,"latitude":null,"longitude":null,"autonomyClass":null,"legalOutcomeClass":"unknown","createdAt":"2026-08-27T13:07:21.540Z","updatedAt":"2026-09-29T19:26:00.319Z","model":null,"deployment":null,"company":{"id":"d66c7ff3-115f-45ca-9b4d-a90a164caf22","name":"Knownsec","slug":"knownsec","description":"Knownsec (Beijing Knownsec Information Technology Co., Ltd., Chinese: 知道创宇) is a Chinese cybersecurity company founded in 2007 and headquartered in Beijing. Known for its ZoomEye global network mapping tool and 'Internet Aegis' and 'Enterprise Digital Fortress' security platforms, Knownsec provides cloud defense, cloud monitoring, and threat intelligence services. The company maintains offices in Beijing, Chengdu, Shenzhen, Shanghai, Wuhan, and Xi'an, with a Hong Kong branch. In November 2025, a massive data leak exposed over 12,000 internal documents revealing offensive cyber tools and state-linked espionage operations.","status":"active","founded":2007,"hq":"Beijing, China","hqLat":34.5412252,"hqLng":108.9237067,"hqGeocodedAt":"2026-08-05T14:36:07.507Z","hqAddress":null,"hqPrecision":null,"website":"knownsec.com","fundingTotal":null,"type":"brain","roles":[],"reviewStatus":"reviewed","heatIndex":52,"lifecycleState":"active","supersededByCompanyId":null,"sources":[{"url":"https://www.knownsec.com","title":"knownsec official website","sourceName":"knownsec"}],"keyFacts":[{"label":"HQ","value":"China"}],"aliases":["Beijing Knownsec Information Technology"],"collisionRisk":"low","reviewNote":null,"atsProvider":null,"atsSlug":null,"factoryLocations":null,"manufacturingCapacity":null,"orgType":null,"burnSignal":null,"litigationEvents":null,"insurancePostureDisclosed":null,"unitEconomicsDisclosed":null,"tickerSymbol":null,"stockExchange":null,"secCik":null,"revenueUsd":null,"revenueBasis":null,"revenueAsOf":null,"employeeCount":null,"employeeCountBasis":null,"employeeCountAsOf":null,"marketCapUsd":null,"marketCapAsOf":null,"marketCapSource":null,"createdAt":"2026-06-26T11:23:45.758Z","updatedAt":"2026-08-27T13:06:25.797Z"},"derived":{"status":"active"},"sources":[{"id":"312f67aa-5603-4101-a521-ef8ceb6f48f1","incidentId":"d099d8f4-57b1-4f14-b9da-b27975ecf5ec","url":"https://www.resecurity.com/blog/article/knownsec-data-breach-a-trove-of-espionage-tradecraft-with-an-insider-narrative","label":"Resecurity","publishedAt":"2025-12-31T00:00:00.000Z","notes":null,"title":null,"sourceName":"Resecurity","mediaType":"article","videoId":null,"channel":null,"durationSec":null,"timestampSec":null,"createdAt":"2026-08-27T13:07:21.540Z","updatedAt":"2026-08-27T13:07:21.540Z"},{"id":"27d37b83-a9ee-40f4-8e33-6214c20b0a2c","incidentId":"d099d8f4-57b1-4f14-b9da-b27975ecf5ec","url":"https://dti.domaintools.com/research/the-knownsec-leak-yet-another-leak-of-chinas-contractor-driven-cyber-espionage-ecosystem","label":"DomainTools Investigations","publishedAt":"2026-01-09T00:00:00.000Z","notes":null,"title":null,"sourceName":"DomainTools Investigations","mediaType":"article","videoId":null,"channel":null,"durationSec":null,"timestampSec":null,"createdAt":"2026-08-27T13:07:21.540Z","updatedAt":"2026-08-27T13:07:21.540Z"}],"responses":[],"statusEvents":[{"id":"8c2b9f2e-9ce0-486a-b1ba-66b34f6e6657","incidentId":"d099d8f4-57b1-4f14-b9da-b27975ecf5ec","status":"active","reason":null,"source":"agent:recon","effectiveAt":"2026-08-27T13:07:22.901Z","createdAt":"2026-08-27T13:07:22.901Z"}],"jsonLd":{"@context":"https://schema.org","@type":"NewsArticle","@id":"https://registry.deploy.report/incidents/knownsec-data-breach-leak-2025-11","url":"https://registry.deploy.report/incidents/knownsec-data-breach-leak-2025-11","headline":"Massive data leak from Knownsec exposes 12,000+ internal documents revealing state-linked cyber espionage tools and global targets","description":"In November 2025, a massive data leak from Chinese cybersecurity firm Knownsec was posted on GitHub by an actor using the alias t1g3r. The leak exposed over 12,000 internal documents including offensive cyber tools (GhostX, Un-Mail, Windows T-Horse RAT), global surveillance target lists covering 20+ countries, and evidence of stolen data including 95 GB of Indian immigration records and 3 TB of South Korean call logs. The documents revealed Knownsec operates as a state-aligned cyber contractor supporting Chinese intelligence objectives, with clients including Public Security Bureaus, the State Grid Corporation, and China Telecom. The leak was analyzed by Resecurity, DomainTools, and Field Effect, among others.","identifier":"d099d8f4-57b1-4f14-b9da-b27975ecf5ec","datePublished":"2025-11-07T00:00:00.000Z","articleSection":"other","publisher":{"@id":"https://deploy.report/#organization"},"author":{"@id":"https://deploy.report/#organization"}},"framework_metadata":{"framework_schema_version":"0.1.0","verification_status":"verified","maturity_stage":null,"lifecycle_state":null,"architectural_position":{"cohort":null,"sub_cohorts":[]},"within_cohort_verified_vs_claimed_pair":null,"cap_flags":[],"verification_depth":{"sources_count":2,"primary_source_types":[]}}}