The KnownSec Files: How a Commercial Security Giant Feeds China’s Offensive Cyber Machine

A WireScreen special report analyzing leaked internal documents and corporate data to reveal how China’s commercial cybersecurity ecosystem intersects with state-sponsored cyber operations.

‍

In November 2025, a trove of more than 12,000 internal files—purportedly originating from the Chinese cybersecurity firm KnownSec—surfaced online, offering rare insight into the blurred line between commercial cyber defense and state cyber offense in China.

‍

This report combines open-source leak analysis with proprietary WireScreen corporate intelligence to provide structural, evidentiary context around KnownSec’s ownership, government ties, and operational role within China’s cyber ecosystem. The findings are highly relevant for policymakers, national security professionals, critical-infrastructure operators, and researchers assessing vendor risk and state-enabled cyber threats.

‍

What This Report Covers

• KnownSec’s ownership structure, including state-backed capital and major global technology investors
• The role of KnownFuture, a subsidiary linked to PLA cyber units and military procurement
• Strategic implications for critical infrastructure, vendor risk management, and national security policy

‍

About the Author

John Costello,  Director of Strategic Affairs, WireScreen
Former senior official at the White House Office of the National Cyber Director (ONCD) and the Cyberspace Solarium Commission, with extensive experience in U.S. cyber policy and intelligence.

‍

Request access to download the report.

‍

‍Hear directly from the author! You can also sign up to request access to an exclusive on-demand webinar where John Costello talks about his analysis of this significant leak.