Loading story…
A 600GB trove of internal documents and source code from Geedge Networks and the MESA Lab at the Chinese Academy of Sciences was leaked online, revealing the technical and operational details of China's Great Firewall. The leak confirms that Geedge Networks has exported turnkey censorship and surveillance systems to countries including Myanmar, Pakistan, Ethiopia, and Kazakhstan. The exposed materials provide unprecedented insight into the architecture, deployment, and international proliferation of advanced internet censorship and surveillance tools.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
6 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcetomshardware.com
Open sourcehackread.com
Open sourcedatabreaches.net
Open sourcewired.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Geedge Networks’ Tiangou Secure Gateway (TSG)** shares source code and traffic-filtering behavior with components of **China’s Great Firewall**, providing fresh evidence that the product is used in state internet censorship operations. The findings were presented at **USENIX Security** and were enabled by a massive leak of more than **100,000 files** from Geedge, including **Jira** and **Confluence** databases and **Git repositories** with commit history dating back to **November 2024**, which allowed analysts to reconstruct TSG firmware and compare it with known Great Firewall behavior. Analysis of the leaked material described TSG as a complex but poorly engineered platform built with **memory-unsafe C code**, copied third-party components, and ad hoc integrations that raise maintainability and correctness concerns. Researchers said the exposed code and bugs could help future censorship-circumvention efforts, while the leak also revealed Geedge’s apparent export of censorship technology to other countries, including **Kazakhstan, Ethiopia, Pakistan, and Myanmar**.
Aug 21, 2026
A broad exposure of **Chinese state-linked sensitive data** resurfaced across underground and open reporting, combining claims of a massive leak from the **National Super Computer Center in Tianjin** with renewed circulation of previously stolen **Knownsec** corporate documents. One report described a threat actor using the name `airborneshark1` and the alias **Flaming China** to advertise an alleged **10 PB** dataset purportedly taken from the NSCC, a government-owned high-performance computing environment used by academic institutions, state-owned enterprises, and military-affiliated research partners. The available sample data was assessed by the source as likely genuine, although the full scale of the claimed exfiltration remains unverified and may imply prolonged access or insider assistance if authentic. Separately, a partial re-release of the **Knownsec** leak revived reporting on more than **12,000 classified documents** allegedly exposing the internal capabilities of a major Chinese cybersecurity firm tied to government and military work. The leaked material reportedly included multi-platform **RATs**, Android malware targeting chat data, hardware-based collection tools such as a malicious power bank, and spreadsheets identifying overseas targets in more than 20 countries, alongside evidence of large-scale data theft from India, South Korea, and Taiwan. The Kazakhstan **Daryn Online** and Tanzania **BRELA** breach reports describe unrelated criminal data-sale listings and do not match the China-focused state-linked leak activity covered in the relevant reporting.
Jun 29, 2026
Chinese cybersecurity firm KnownSec suffered a significant data breach, resulting in the leak of over 12,000 internal documents. The files, briefly posted on GitHub before removal, reportedly include details on KnownSec's contracts with Chinese government and military entities, internal hacking tools, and a spreadsheet listing 80 overseas targets. Analysis of the leaked data suggests the presence of remote access trojans (RATs) capable of compromising Linux, Windows, macOS, iOS, and Android systems, with some tools able to extract data from popular messaging apps such as Telegram and Chinese platforms. The breach also exposed large datasets, including 95GB of Indian immigration data, 3TB of call records from South Korea's LG U Plus, and 459GB of Taiwanese road planning data. Security researchers and analysts have described the leak as an intelligence gold mine, providing rare insight into the operations of a major Chinese cyber contractor. While the exact motivation behind the leak remains unclear—whether it was the act of a disgruntled insider or an external hack-and-dump operation—the incident highlights the scale and scope of KnownSec's cyber activities, including its role in mapping foreign digital infrastructure and developing tools for state-sponsored operations. The exposure of these documents is likely to have significant implications for both Chinese cyber operations and the security of the affected international targets.
Jun 29, 2026