Loading story…
Researchers reported that Geedge Networks’ Tiangou Secure Gateway (TSG) shares source code and traffic-filtering behavior with components of China’s Great Firewall, providing fresh evidence that the product is used in state internet censorship operations. The findings were presented at USENIX Security and were enabled by a massive leak of more than 100,000 files from Geedge, including Jira and Confluence databases and Git repositories with commit history dating back to November 2024, which allowed analysts to reconstruct TSG firmware and compare it with known Great Firewall behavior.
Analysis of the leaked material described TSG as a complex but poorly engineered platform built with memory-unsafe C code, copied third-party components, and ad hoc integrations that raise maintainability and correctness concerns. Researchers said the exposed code and bugs could help future censorship-circumvention efforts, while the leak also revealed Geedge’s apparent export of censorship technology to other countries, including Kazakhstan, Ethiopia, Pakistan, and Myanmar.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
The leaked Geedge data included all Git source code repositories with commit history going back to November 2024. This historical code base later enabled researchers to reconstruct Tiangou Secure Gateway firmware.
At USENIX Security, American academics presented evidence that Geedge Networks' Tiangou Secure Gateway shares source code and traffic-filtering behavior with parts of China's Great Firewall. They concluded the Chinese government uses TSG as one of the firewall's known filtering capabilities.
Using the leaked source code and commit history, researchers reconstructed firmware for Geedge Networks' Tiangou Secure Gateway. They used this reconstruction to compare TSG filtering behavior with the Great Firewall.
Following the leak, reports said Geedge had exported internet censorship technology to Kazakhstan, Ethiopia, Pakistan, and Myanmar. This expanded the story beyond China to Geedge's overseas censorship business.
More than 100,000 files leaked from Geedge's network, including Jira and Confluence databases and source code repositories. The leak also exposed Geedge's export activity for internet censorship technology.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A 600GB trove of internal documents and source code from Geedge Networks and the MESA Lab at the Chinese Academy of Sciences was leaked online, revealing the technical and operational details of China's Great Firewall. The leak confirms that Geedge Networks has exported turnkey censorship and surveillance systems to countries including Myanmar, Pakistan, Ethiopia, and Kazakhstan. The exposed materials provide unprecedented insight into the architecture, deployment, and international proliferation of advanced internet censorship and surveillance tools.
Jun 29, 2026
Researchers said China used a network attack system dubbed the **Great Cannon** to divert some unencrypted traffic bound for Baidu services and silently replace legitimate responses with malicious JavaScript, turning foreign visitors’ browsers into bots for distributed denial-of-service attacks. The capability was linked to sustained attacks on **GreatFire.org** and later **GitHub**, marking a shift from domestic censorship toward using China’s Internet infrastructure to project offensive effects beyond its borders. Citizen Lab, the International Computer Science Institute, and the University of California, Berkeley said the system appears distinct from but related to the **Great Firewall**, with evidence visible across multiple Chinese ISPs and consistent with state involvement. Researchers warned the same traffic-injection method could be adapted for broader payload delivery, including browser exploits or malware, while U.S. officials said attackers appeared to have leveraged infrastructure in China against U.S.-hosted sites and urged an investigation. The reports said **HTTPS** is the strongest practical mitigation because unencrypted HTTP traffic can be intercepted and modified in transit.
Jun 29, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026