Chinese Infosec Firm Data Breach Exposes Cyber Weapons and Global Target List

Hi there! I just came across some unbelievable news - a major Chinese cybersecurity company was hacked and the leaked data revealed some serious information. We're talking weapons of cyber war, and a global target list of hacking victims. That's seem to be the plot of a Hollywood movie, right?

What Really Happened​

An information security firm named Knownsec based in China was reportedly hacked, leaking over 12,000 confidential documents online. These documents demonstrated that Knownsec had developed hacking tools and maintained a record of organizations and nations that it had attacked.

Here are the details of the leak:

• Hacking tools (Remote Access Trojans or RATs) that infect Windows, Linux, macOS, Android, and iPhones.
• A spreadsheet that listed 80 foreign victims, that, again, were likely hacked prior to the leak.
• •Large amounts of stolen data: 95GB of immigration data from India, 3TB of phone data from South Korea, and 459GB of road network data from Taiwan.
• Much of the leaked material was released onto GitHub, which was quickly removed.

That's a large amount of data - and the overwhelming questions of what happened behind the closed doors.

Reasons Why This is Significant​

This is not just another case of a “data breach” - this incident is much more serious. The leak disclosed both a set of cyber weapons (tools developed specifically for services to attack systems) as well as an actual target list of international organizations.

Think about it — have you ever wanted to know how "hackers" at the government level would actually hack a system? This leak gives us a sense of how it all works in that hidden world. It is like seeing a text of a spy agency's playbook.

Here is what the leak discloses:

• The hacking tools could compromise nearly any system or device, be it a computer or a phone,
• The targets were not arbitrary as there were telecommunication companies, immigration systems, and sections of the public infrastructure were potential targets, and
• No one is truly free of the potential to be surveilled or attacked.

This raises the question: If they can do this, who else can?

My Thoughts​

To be honest, I am both astonished and fascinated by this news. It is frightening because these are powerful tools, and thought-provoking because now we have a new way to understand how an attack takes place.

I have worked with very small IT configurations and have seen how a very small network can be compromised by poor security. This leak reminds us that we need to find some means of better securing our systems, regardless of the size of our systems.

If one company has this toolkit, it is safe to assume others do as well. That is what stuns me.

What we Can Learn​

• Don’t presume anything safe while using your device. The tools hit anything — PC, phone or server.
• Check your layers of protection. If large firms are being targeted then a smaller firm may be as well.
• Have a plan. When there is a cyber event you need to be able to back up and have a course of action on how to respond.
• Stay in-the-loop. The better you are at self-education the better you will be at staying ahead of the attack.