Loading threat actor…
KnownSec, officially Beijing Zhidao Chuangyu Information Technology Co., Ltd., is a Chinese cybersecurity company that has been widely assessed as a state-linked cyber contractor supporting Chinese government, military, intelligence, and law-enforcement customers. Although publicly known for defensive security products and the ZoomEye internet-mapping platform, reporting on leaked internal materials has associated the company with offensive cyber capabilities, large-scale reconnaissance, intelligence collection, and support to cyber operations against foreign targets. Known aliases include KnownSec and the Chinese security firm designation sometimes used to distinguish it from threat groups. KnownSec has been linked to development and operation of tooling for reconnaissance, exploitation support, persistent remote access, credential theft, email surveillance, data aggregation, and exfiltration. Reported capabilities include internet-scale asset discovery, critical-infrastructure target mapping, remote-access tooling across multiple operating systems, email account takeover and monitoring, and analysis platforms for reconstructing network and communications data. Named tools and platforms associated with the company include ZoomEye, GhostX, Un-Mail, Passive Radar, Windows T-Horse, pocsuite, and the 404 Team/SeeBug vulnerability research unit. Victimology and targeting attributed to KnownSec indicate broad foreign intelligence collection rather than financially motivated crime. Reported targets span government, defense, telecommunications, financial services, energy, transportation, and other critical-infrastructure sectors across numerous countries. High-confidence reporting ties its activity to collection against countries including India, South Korea, Taiwan, Japan, Vietnam, the United Kingdom, the United States, Canada, and Russia, with emphasis on foreign government and infrastructure environments. The company has also been described as supporting cyberspace mapping, tradecraft platforms, and cyber-warfare command functions aligned with Chinese national objectives. KnownSec is best characterized as a China-linked commercial cyber contractor operating at the boundary between private-sector security services and state-sponsored espionage support. The dominant motivation evidenced by reported operations is espionage.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Vertically integrated espionage operations for both domestic surveillance and foreign intelligence, acting as a central enabler of China's cyber strategy.
China-based offensive security contractor ecosystem referenced via an alleged leak; described capabilities include browser exploitation, routing manipulation, credential theft, email account takeover/exfiltration, PCAP ingestion for network reconstruction, and support for long-term access and infrastructure control.
Knownsec, a state-linked Chinese cybersecurity firm, was exposed in a major leak revealing its involvement in espionage operations, use of espionage tools, and targeting of global entities.
Knownsec is a Chinese cybersecurity company with deep government and military ties, engaged in both commercial security products and offensive cyber operations. The 2025 leak revealed their development and deployment of espionage tools, global targeting of government, military, and critical infrastructure, and aggregation of large-scale stolen data. Their operations support national-level intelligence collection, cyber-operations, and network infrastructure mapping for China.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.