[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6N4NboktblC7aEMAjhmYlZegEQuQKicycv3e_O3OiKc":3,"$fJFLxYmVWgmEbWwXzzTGo7RRGbv1FLecyV0v7QI4JRXw":98},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":94,"created_at":95,"updated_at":96,"published_at":97},"95-tb-knownsec-leak-exposes-12-000-classified-docs-state-tools-and-global-target","95 TB KnownSec leak exposes 12,000+ classified docs, state tools, and global target lists","Beijing-based KnownSec contractor's 95 TB internal server dump reveals 12,000+ classified documents, RATs for five platforms, and 24,241 high-priority targets across 20 countries.","A 95 TB leak from Chinese cybersecurity firm KnownSec exposes 12,000+ classified documents, state-backed RATs, AI-driven exploits, and a target database covering 24,241 organizations with 378M IPs and 3.5M domains across 20 countries.",[10,11,12,13,14,15],"KnownSec","China","data leak","ZoomEye","RAT","MSS","# 95 TB KnownSec leak exposes 12,000+ classified docs, state tools, and global target lists\n\n*Beijing-based KnownSec contractor's 95 TB internal server dump reveals 12,000+ classified documents, RATs for five platforms, and 24,241 high-priority targets across 20 countries.*\n\n**Tags:** `KnownSec` `China` `data leak` `ZoomEye` `RAT` `MSS`\n\n> A 95 TB leak from Chinese cybersecurity firm KnownSec exposes 12,000+ classified documents, state-backed RATs, AI-driven exploits, and a target database covering 24,241 organizations with 378M IPs and 3.5M domains across 20 countries.\n\n---\n\n## 95 TB of KnownSec's inner workings\n\nThe leak first appeared on GitHub on November 2, 2025, before being pulled and resold on the dark web by a threat actor using the moniker t1g3r around November 7. Resecurity acquired and analyzed the full dataset, which then reappeared on the dark web in December for a second round of sales.\n\nThe 95 TB payload contains 12,000+ classified documents, 95 GB of Indian immigration data, 24,241 selected targets, 378 million associated IP addresses, and roughly 3.5 million domains. The targets break down across defense, arms manufacturing, government, political parties, energy, transportation, telecommunications, broadcasting, finance, healthcare, multimedia, and education, with the bulk tied to the US, Canada, Japan, and Russia.\n\n## The state-backed arsenal\n\nThe leak exposes a full stack of custom malware and tooling that KnownSec has been running in the field. The core of the arsenal is a set of Remote Access Trojans (RATs) covering Linux, Windows, macOS, iOS, and Android, giving the team persistent remote access across the major platforms their targets run. Windows gets the T-Horse implant, while the other platforms ship as dedicated RATs.\n\nOn the offensive side, the team fields three named tools: GhostX for browser exploitation and endpoint monitoring, Un-Mail for email content interception, and Passive Radar for network-level surveillance. These sit alongside pocsuite3, the open-source PoC framework from the Knownsec 404 Team that handles remote vulnerability testing and proof-of-concept development, and ZoomEye, their network mapping tool that feeds reconnaissance data into the target database.\n\nThe target list spans BIG-IP, Struts2, and macOS Screen Sharing, with three CVEs referenced in the leak: CVE-2017-5638, CVE-2025-62593, and CVE-2026-65400. The CVEs cover the high-priority targets in the 24,241-target set, which Resecurity says is a \"Critical Infrastructure Target Database\" mapping publicly accessible network devices against known vulnerabilities.\n\n## Who was targeted\n\nThe 24,241-target set spans 20 countries, with the bulk concentrated in the US, Canada, Japan, and Russia. The remaining targets are distributed across India, South Korea, Taiwan, Vietnam, and the UK, among others.\n\nSectors covered include defense, arms manufacturing, government, political parties, energy, transportation, telecommunications, broadcasting, finance, healthcare, multimedia, and education. Resecurity describes the collection as a \"Critical Infrastructure Target Database\" that maps publicly accessible network devices against known vulnerabilities. The database holds 378 million associated IP addresses and roughly 3.5 million domains, alongside 95 GB of Indian immigration data.\n\n## KnownSec's state ties\n\nBeijing Knownsec Information Technology Co., Ltd. (知道创宇) is the entity at the center of the leak. The firm, which Resecurity describes as a \"major Chinese cybersecurity company with close ties to the Chinese government and military,\" operates under the umbrella of China’s Ministry of State Security (MSS). It is backed by Tencent, which provides the capital and distribution muscle for the firm’s commercial and state-facing products line.\n\nThe product stack includes three main offerings: Internet Aegis, the firm’s flagship vulnerability assessment and penetration testing suite; Enterprise Digital Fortress, the enterprise-grade defensive and monitoring layer; and ZoomEye, the network mapping and vulnerability-scanning tool that feeds reconnaissance data into the internal target database. ZoomEye is the same engine that Resecurity says was \"misused internally\" to push recon data into the 24,241-target set.\n\nKnownSec sits inside a tight constellation of state-aligned contractors that form a parallel ecosystem to China’s formal intelligence services. The network includes 404 Lab (internal to KnownSec, home of pocsuite3), Qi-An-Xin, Venustech, and i-SOON (安洵). These entities are separate on paper but woven into the same machinery of state surveillance and cyberespionage, with KnownSec acting as the primary commercial front for the MSS and PLA.\n\n## China's response\n\nThe Chinese Foreign Ministry said it was \"unaware of any breach at Knownsec\" when asked directly about the leak, a standard formulation Beijing has used in prior state-linked leak denials. The spokesperson reiterated that China \"firmly opposes and combats all forms of cyberattacks,\" the same line it has deployed in response to earlier contractor-driven incidents.\n\nThat posture is consistent with how Chinese authorities have handled similar leaks: they deny awareness of the specific breach, then lean on the broader cyberattack stance to frame the firm’s role. It also fits the pattern where the firm is a commercial front for the MSS and PLA, with KnownSec acting as the primary contractor in a constellation that includes 404 Lab, Qi-An-Xin, Venustech, and i-SOON.\n\n## Key points\n\n- 95 TB total leak from KnownSec's internal server, posted to GitHub on November 2, 2025, then sold on dark web by actor t1g3r on November 7.\n- 12,000+ classified documents include WBS project sheets, personnel directories, org charts, and customer lists for Public Security Bureaus, defense institutes, and MSS.\n- Offensive tools include custom RATs for Linux, Windows, macOS, iOS, and Android, plus GhostX (browser exploitation), Un-Mail (email interception), and Passive Radar (DNS hijack).\n- Target database covers 24,241 organizations, 378M IP addresses, and 3.5M domains, with high-priority focus on defense, government, energy, telecom, healthcare, and finance sectors.\n- Targets span 20 countries with most data from US, Canada, Japan, and Russia; 95 GB of Indian immigration data included in the stolen datasets.\n\n## Further reading & sources\n\n- [China's Cyber Shadows Exposed: Inside the KnownSec Leak](https:\u002F\u002Fwww.webpronews.com\u002Fchinas-cyber-shadows-exposed-inside-the-knownsec-leak\u002F)\n- [GitHub - knownsec\u002Fpocsuite3: pocsuite3 is an open-sourced remote vulnerability testing framework developed by the Knownsec 404 Team. · GitHub](https:\u002F\u002Fgithub.com\u002Fknownsec\u002Fpocsuite3)\n- [Leak exposes Knownsec’s role in state cyber targeting | Cybernews](https:\u002F\u002Fcybernews.com\u002Fsecurity\u002Fknownsec-leak-exposes-involvement-in-state-linked-cyber-operations\u002F)\n- [DomainTools Investigations | THE KNOWNSEC LEAK: Yet Another Leak of China’s Contractor-Driven Cyber-Espionage Ecosystem](https:\u002F\u002Fdti.domaintools.com\u002Fresearch\u002Fthe-knownsec-leak-yet-another-leak-of-chinas-contractor-driven-cyber-espionage-ecosystem)\n- [Resecurity | Knownsec Data Breach: A Trove of Espionage Tradecraft with an Insider Narrative](https:\u002F\u002Fwww.resecurity.com\u002Fblog\u002Farticle\u002Fknownsec-data-breach-a-trove-of-espionage-tradecraft-with-an-insider-narrative)\n- [DomainTools | The Knownsec Leak](https:\u002F\u002Fwww.domaintools.com\u002Fwhite-papers\u002Fthe-knownsec-leak)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F95-tb-knownsec-leak-exposes-12-000-classified-docs-state-tools-and-global-target.png?v=c7a5a17130",{"cves":19,"actors":42,"malware":54,"targets":64,"timeline":70,"industries":78,"technologies":82},[20,29,37],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2017-5638",true,"\u002Fvulnerabilities\u002FCVE-2017-5638",9.8,1,"Critical",90.5,"3.1",{"id":30,"kev":22,"poc":31,"url":32,"cvss":33,"epss":34,"risk_band":35,"risk_score":36,"cvss_version":28},"CVE-2025-62593",false,"\u002Fvulnerabilities\u002FCVE-2025-62593",8.8,0.6246,"High",71.17,{"id":38,"kev":22,"poc":31,"url":39,"cvss":24,"epss":40,"risk_band":26,"risk_score":41,"cvss_version":28},"CVE-2026-65400","\u002Fvulnerabilities\u002FCVE-2026-65400",0.0172,89.16,[43,49],{"url":44,"name":45,"slug":46,"type":47,"origin":11,"motivation":48},"\u002Fthreat-groups\u002Fknownsec","Knownsec","knownsec","unknown","Espionage",{"url":50,"name":51,"slug":51,"type":52,"origin":11,"motivation":53},"\u002Fthreat-groups\u002Ft1g3r","t1g3r","cybercrime","internal power struggle",[55,57,59,61,62],{"name":56},"RATs",{"name":58},"pocsuite3",{"name":60},"Un-Mail",{"name":13},{"name":63},"T-Horse",[65],{"name":66,"sector":67,"status":68,"geography":69},"Indian immigration","government","confirmed","India",[71,75],{"date":72,"event":73,"description":74},"2025-11-02","Leak","Leak from KnownSec exposed over 95 terabytes of data",{"date":76,"event":73,"description":77},"2025-11-07","12,000 classified documents leaked from Knownsec sold on dark web by t1g3r",[79],{"url":80,"name":81,"slug":67},"\u002Findustries\u002Fgovernment","Government",[83,86,89,92],{"vendor":84,"product":85},"F5","BIG-IP",{"vendor":87,"product":88},"Apache","Struts2",{"vendor":90,"product":91},"Apple","macOS Screen Sharing",{"vendor":45,"product":93},"Internet Aegis","data_leak","2026-09-23T17:10:27.728879+00:00","2026-10-16T12:28:13.149407+00:00",null,{"articles":99},[100,108,121,133],{"slug":101,"title":102,"summary":103,"tags":104,"hero_image_url":106,"story_type":94,"created_at":107},"knownsec-leak-exposes-95-tb-of-china-s-state-cyber-arsenal","Knownsec Leak Exposes 95 TB of China's State Cyber Arsenal","A November 2025 leak from Chinese security firm Knownsec exposes 95 TB of internal data including custom RATs, the ZoomEye scanner, and a target database covering 24,241 organizations across 20 countries, confirming the firm's role as a state-aligned cyberespionage contractor for China's military and MSS.",[45,11,13,14,105],"cyberespionage","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fknownsec-leak-exposes-95-tb-of-china-s-state-cyber-arsenal.png?v=843d8ee3f7","2026-09-02T12:07:05.05762+00:00",{"slug":109,"title":110,"summary":111,"tags":112,"hero_image_url":118,"story_type":119,"created_at":120},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[113,114,115,12,116,117],"Silent Ransom Group","Troutman Pepper Locke","law firm","SSN","ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","ransomware_incident","2026-09-21T17:04:06.647891+00:00",{"slug":122,"title":123,"summary":124,"tags":125,"hero_image_url":130,"story_type":131,"created_at":132},"nao-audit-finds-58-critical-uk-government-it-systems-with-significant-cyber-resi","NAO audit finds 58 critical UK government IT systems with significant cyber-resilience gaps","The National Audit Office has confirmed that 58 critical UK government IT systems have significant cyber-resilience gaps and 228 legacy systems of unknown vulnerability, identifying Volt Typhoon as the primary threat actor.",[126,127,128,129,11],"Volt Typhoon","NAO","UK Government","Cyber Resilience","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnao-audit-finds-58-critical-uk-government-it-systems-with-significant-cyber-resi.png?v=71caba8ea6","threat_actor_activity","2026-09-20T07:06:01.656556+00:00",{"slug":134,"title":135,"summary":136,"tags":137,"hero_image_url":141,"story_type":119,"created_at":142},"satanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims","SatanLock ransomware group shuts down after six months, claims 67 victims","SatanLock, a double-extortion ransomware group, has ceased operations after roughly six months, claiming 67 compromised organizations and leaking stolen data.",[117,138,139,12,140],"SatanLock","sanlockv2","double extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsatanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims.png?v=99e2fb1938","2026-08-26T12:10:42.22722+00:00"]