China’s “King of Vulnerabilities” Hacked: Knownsec Leak Exposes Zero-Day Flaws
A data leak at the Chinese company Knownsec—long heralded as one of the flagships of the nation’s cybersecurity industry—has dealt the firm a reputational blow and forced an unexpected admission of internal weaknesses. In early November, unknown actors published a trove of the company’s internal documents online, revealing that the so-called “king of vulnerabilities” had failed to protect its own infrastructure: attackers had exploited three zero-day flaws to infiltrate Knownsec’s systems back in 2023. The company offered an unusually detailed account of the incident—rare transparency for China’s corporate sector—yet many questions remain unanswered.
On 5 November, the Chinese blog Mrxn’s Blog reported what it called the “largest leak” in Knownsec’s history, claiming that around 12,000 confidential documents had surfaced—ranging from tools and internal systems to lists of targets. It was later discovered that the data had first appeared on GitHub, from which it was removed for policy violations. The English-language outlet NETASKARI was among the first to analyze the available fragments, finding only promotional materials, monitoring data lists, and a corporate profile—nothing resembling “offensive cyberweapons” of state-hacker caliber. Still, the journalist noted that Knownsec remains a company capable of developing intrusion tools for clients and, potentially, conducting offensive operations.
Yet neither researchers nor journalists—including NETASKARI and Natto Team—have seen the full archive. Nonetheless, Western media quickly circulated dramatic headlines about a “massive leak of China’s cyber arsenal.” Amid the noise surrounding Natto Team’s tools, the outlet sought to examine the incident from Knownsec’s perspective, shedding light on the role major private firms play in shaping China’s cyber power.
Founded in 2007, Knownsec stands among the industry’s most influential and technologically sophisticated companies. In 2024, the research group RoarTalk ranked it among the twenty key “comprehensive” players in the market. Its founders and current CSO hail from the first generation of China’s “patriotic hackers,” pioneers of the country’s late-1990s hacking scene. Particularly prominent is CSO Zhou Jinping—better known as SuperHei—who has dominated global vulnerability-discovery rankings for years, identifying flaws in products ranging from Microsoft to Tencent.
Among Knownsec’s investors are Baidu and Tencent, and in 2018 the company appeared on the Nasdaq billboard as part of CCTV’s “National Brand” initiative. With more than 1,500 employees and dozens of divisions across the country, Knownsec has long served as a showcase for China’s cyber industry.
Its response to the leak was immediate. On the same day the reports appeared, the company issued a notice to clients, explaining that the breach had actually occurred in August 2023, when unknown attackers exploited three zero-day vulnerabilities to infiltrate the firm’s cloud-based office system. Although the attempt to expand the attack was thwarted, the company was unable to determine the scope of the theft—its adversaries’ methods were too sophisticated.
After the leaked data resurfaced on dark-web forums, Knownsec confirmed that it originated from that earlier intrusion. Upon reviewing the published fragments, the firm concluded that they consisted of partial lists of employees and clients, as well as data from its own dark-web monitoring system. Knownsec emphasized that no user accounts, passwords, or critical client assets had been stolen. It nevertheless acknowledged the two-year gap between the attack and the public disclosure, attributing it to the fact that the company itself had never seen the full contents of the stolen archive.
In its notice, the company apologized to its clients, describing the incident as “deeply regrettable and embarrassing” for any cybersecurity organization. It also criticized media outlets for exaggerating the scale of the event.
The controversy was further fueled by the involvement of blogger Mrxn, who for more than a decade has published cybersecurity incident reports and pentesting tools on GitHub. His motives remain unclear: an attempt to damage Knownsec’s reputation, a desire to “teach the company a lesson” akin to the infamous TCL case, or simply an effort to profit from already stolen data.
The incident revived debate about which Chinese companies are deemed “replaceable” and which are considered “too big to fail.” Many drew comparisons to the 2024 scandal involving i-SOON—a firm that never acknowledged its leak, vanished from public view, and, according to investigations, barely remains afloat. Knownsec, by contrast, is a national brand, a major investment target, and—judging by official actions—an entity the state intends to support.
This also informs the international dimension. As far back as 2021, the United States designated Knownsec a “Chinese military company” and restricted the export of U.S. technologies to it—an honor shared with only one other cyber firm, the giant Qihoo 360. On Chinese forums, the rationale is stated bluntly: Knownsec allegedly represents “the greatest threat to U.S. dominance in cyberspace.”
Yet the 2025 leak illustrates a paradox: even industry leaders who scour the world’s software for vulnerabilities can overlook critical flaws within their own systems—and must confront the consequences when long-forgotten breaches resurface two years later.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
