All news
data leak

Precursor Intelligence

Knownsec Leak Exposes 95 TB of China's State Cyber Arsenal

12,000 internal documents from Beijing Knownsec reveal RATs, ZoomEye, and 24,241 targets across 20 countries.

2 September 2026
KnownsecChinaZoomEyeRATcyberespionage
Knownsec Leak Exposes 95 TB of China's State Cyber Arsenal

At a glance

2 actors

Threat actors

NameTypeOriginMotivation
KnownsecunknownChinaEspionage
t1g3rcybercrimeChinainternal power struggle

Technology affected

Knownsec · Internet Aegis

Malware & tooling

RATspocsuite3ZoomEye

Timeline

  1. Leak

    Leak from KnownSec exposed over 95 terabytes of data

  2. Leak

    12,000 classified documents leaked from Knownsec sold on dark web by t1g3r

The 95 TB leak

Beijing Knownsec Information Technology Co., Ltd. (知道创宇), the firm behind the ZoomEye network mapper and pocsuite3 vulnerability framework, had 95 TB of internal data pulled from an internal server. The leak surfaced on November 2, 2025, and was sold on a dark-web forum by an actor using the moniker 't1g3r' around November 7, 2025, before reappearing in December.

The trove contains over 12,000 internal documents, including remote-access trojans, target lists, and operational docs — the same set Resecurity analyzed in its December 31 report.

Who Knownsec is

Knownsec, formally registered as Beijing Knownsec Information Technology Co., Ltd. (知道创宇), is a Beijing-based cybersecurity firm that has long operated as a commercial front for state-directed offensive work. The company is backed by Tencent and runs under the umbrella of China’s Ministry of State Security, contracting out hacking services to government and military customers.

Its product line includes “Internet Aegis” and “Enterprise Digital Fortress” for internal and enterprise use, plus ZoomEye, a global vulnerability-scanning and network-mapping tool that has made the firm a household name among security researchers. The same team also maintains pocsuite3, an open-source remote vulnerability testing framework used for PoC development and execution.

The leaked documents carry the Unified Social Credit Code 91110108666277620Y, along with registration code 110108010419556 and organization certification code 666277620 — the standard identifiers that pin the legal entity to its Beijing registration.

The toolset

The leaked set includes custom remote-access trojans (RATs) for Linux, Windows, macOS, iOS, and Android, giving Knownsec persistent remote access across the full range of target platforms. These are the internal offensive tools, not the public-facing pocsuite3 framework from the 404 Team that researchers have been running for years.

Also in the trove is an email content interception system for inline inspection of target mail traffic, and a 'Critical Infrastructure Target Database' that maps public-facing network devices against known vulnerabilities. The database holds 24,241 selected targets, 378 million associated IP addresses, and 3.5 million domains, with a high-priority focus on defense, arms manufacturing, government, political parties, energy, transportation, telecommunications, broadcasting, finance, healthcare, multimedia, and education. Most of the data is associated with the US, Canada, Japan, and Russia.

Targeting 20 countries

The database, which Resecurity identified as the 'Critical Infrastructure Target Database,' holds 24,241 selected targets, 378 million associated IP addresses, and roughly 3.5 million domains. It maps public-facing network devices against known vulnerabilities, giving Knownsec a pre-built list of high-value infrastructure to hit.

The high-priority sectors span defense, arms manufacturing, government, political parties, energy, transportation, telecommunications, broadcasting, finance, healthcare, multimedia, and education. The targets are concentrated in the US, Canada, Japan, and Russia, with additional coverage across India, South Korea, Taiwan, Vietnam, and the UK.

State ties and the denial

The files identify Knownsec’s active customers as Chinese military units, police forces, government agencies, and public security organizations. Resecurity noted the company “was deeply involved in offensive cyber activity” for these state entities, which contract out hacking services for espionage and surveillance tasks.

Internally, the team also misused ZoomEye — its own global vulnerability-scanning and network-mapping tool — to feed reconnaissance data into the target database. That means the same tool researchers use to scan the internet was turned on Knownsec’s own target list to populate the 24,241 entries and 378 million IPs.

The Chinese Foreign Ministry, when pressed, said it was “unaware of any breach at Knownsec” and reiterated that China “firmly opposes and combats all forms of cyberattacks.” It is the standard MFA-style denial Beijing has used for state-linked cyber leaks, where the ministry claims unfamiliarity while affirming its official stance against cyber operations.

Key points

  • Leak contains 12,000+ internal documents totaling 95 TB, sold on a dark web forum by actor 't1g3r' around November 7, 2025.
  • Tools include custom RATs for Linux, Windows, macOS, iOS, and Android, plus an email content interception system and a Critical Infrastructure Target Database.
  • Target database covers 24,241 organizations, 378M+ IP addresses, and 3.5M domains, with high-priority focus on defense, government, energy, healthcare, and telecom sectors.
  • Knownsec is Beijing Knownsec Information Technology Co., Ltd (USCC 91110108666277620Y), backed by Tencent, and operates the ZoomEye network mapping tool.
  • China's Foreign Ministry denied awareness of the breach, stating it 'firmly opposes and combats all forms of cyberattacks.'

Further reading & sources