Loading story…
Chinese President Xi Jinping publicly joked about the possibility of backdoors in Xiaomi smartphones during a diplomatic meeting with South Korean President Lee Jae Myung. The exchange occurred as Xi gifted two Xiaomi smartphones to Lee, who inquired about their security, prompting Xi to quip, "You can check if there is a backdoor." The moment, which drew laughter from both leaders, highlighted ongoing international concerns about the security of Chinese technology and the potential for surveillance through undocumented access methods in devices.
The incident comes amid persistent warnings from the United States and its allies regarding the risk of backdoors in Chinese-made technology, which could be exploited for espionage or data collection. The Register notes that such concerns have led to the exclusion of Chinese telecom giants like Huawei and ZTE from certain markets. The episode also underscores the broader context of China's efforts to boost exports of its technology products, such as Xiaomi smartphones, while facing skepticism from global buyers about device security and state surveillance capabilities.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
On November 4, 2025, Chinese president Xi Jinping joked during a meeting with South Korean president Lee Jae-myung about the possibility of Xiaomi smartphones containing backdoors. The remark highlighted persistent international suspicion toward Chinese technology vendors.
After the TCL controversy, a research effort linked to Hainan University's Belt and Road Research Institute analyzed the case and recommended stronger crisis communications, better engagement with independent researchers, and closer monitoring of influential foreign cybersecurity voices.
In September 2021, China introduced vulnerability management regulations requiring rapid reporting to the Ministry of Industry and Information Technology. The article presents the TCL episode as part of the context that helped drive these rules.
After the December 2020 backdoor allegations, TCL's stock reportedly fell nearly 15 percent in a single day. The company then took steps to stabilize investor confidence.
In December 2020, then-Acting US DHS Secretary Chad Wolf publicly claimed TCL had incorporated backdoors. The allegation intensified scrutiny of Chinese technology products.
Following the November 2020 disclosure, press coverage characterized the TCL TV flaws as a potential Chinese backdoor, turning a product security issue into a broader geopolitical controversy.
In November 2020, after struggling to get timely and consistent engagement from TCL, Sick Codes publicly disclosed details of the vulnerabilities. The issues were also assigned CVEs, increasing visibility of the case.
In October 2020, Australian security researcher Sick Codes found two serious vulnerabilities affecting TCL Android TVs and began trying to report them responsibly to the company.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
nattothoughts.substack.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. President Donald Trump and Chinese President Xi Jinping are expected to meet at the White House on September 24 with artificial intelligence, advanced-chip exports, and cybersecurity among the unresolved issues. Washington is reportedly seeking cooperation against AI-enabled cyberattacks, lab-to-lab threat-intelligence sharing, and discussion of alleged Chinese distillation of proprietary U.S. models, while Beijing is expected to press for relief from restrictions on advanced chips and high-bandwidth memory. The prospective dialogue comes as U.S. policy sends mixed signals: restrictions on advanced AI chips have reportedly been eased for Nvidia's **H200**, even as Chinese entities are said to obtain Nvidia hardware through third countries and Beijing promotes domestic alternatives. Any technology agreement will compete with wider disputes over rare-earth exports, Iran-related trade enforcement, and Taiwan—including a possible $14 billion U.S. arms package that China could treat as grounds to cancel the summit—limiting expectations for a broad breakthrough.
Sep 24, 2026
Sophos X-Ops reported a malicious Windows backdoor that was discovered after a false-positive review of an executable signed with a valid **Microsoft Windows Hardware Compatibility Publisher** certificate. The malware appeared to impersonate **Thales**, installed itself as a service named `CatalogWatcher`, embedded the **3proxy** proxy server, and used an XOR-obfuscated command-and-control domain, `catalog[.]micrisoftdrivers[.]com`. Sophos said the abuse was serious because the trusted signature could help the malware evade scrutiny and blend into enterprise environments. Telemetry and VirusTotal data linked the backdoor to the **LaiXi Android Screen Mirroring** product, with related samples dating back to at least January 2023 across four compilation clusters that included signed and unsigned variants. Sophos said it found no evidence that LaiXi’s developers intentionally shipped the malware or that a broader supply-chain compromise had occurred, but urged caution because the association persisted over time. Microsoft was notified through the Microsoft Security Response Center and later added the affected files to its revocation list under **`CVE-2024-26234`**.
Jun 29, 2026
Symantec disclosed **Backdoor.Daxin**, a highly sophisticated Windows kernel-driver backdoor tied with high confidence to China-linked espionage actors and used against governments and critical infrastructure organizations, including telecommunications, transportation, manufacturing, and technology entities. Investigators said the malware had likely been in use since at least 2013 and was observed as recently as late 2021, indicating a mature capability designed for long-term covert access inside segmented or otherwise hardened environments with limited internet connectivity. Technical analyses show Daxin disguises itself as a driver, hooks Windows `NDIS` and `TCPIP` networking components, hijacks legitimate TCP connections instead of opening its own services, and can relay command-and-control traffic across multiple compromised hosts to create multi-hop covert channels. Researchers also documented HTTP-based encapsulation, a configurable remote TCP `HOST` mode, traffic inspection using a magic value `0x9910`, file upload and remote command execution capabilities via `WinExec`, and links to older China-associated tooling such as **Backdoor.Zala**, **Trojan.Owprox**, and **Trojan.Emulov**; Symantec said it worked with **CISA** and foreign governments to support detection and remediation.
Aug 15, 2026