An evaluation of a knowledge leak from a Chinese language cybersecurity firm TopSec has revealed that it doubtless gives censorship-as-a-service options to potential prospects, together with a state-owned enterprise within the nation.
Based in 1995, TopSec ostensibly gives providers similar to Endpoint Detection and Response (EDR) and vulnerability scanning. Nevertheless it’s additionally offering “boutique” options with a view to align with authorities initiatives and intelligence necessities, SentinelOne researchers Alex Delamotte and Aleksandar Milenkoski mentioned in a report shared with The Hacker Information.
The information leak comprises infrastructure particulars and work logs from staff, in addition to references to internet content material monitoring providers used to implement censorship for private and non-private sector prospects.
It is believed that the corporate offered bespoke monitoring providers to a state-owned enterprise hit by a corruption scandal, indicating that such platforms are getting used to observe and management public opinion as essential.
Current among the many knowledge leak is a contract for a “Cloud Monitoring Service Mission” introduced by the Shanghai Public Safety Bureau in September 2024.
The challenge, the doc reveals, entails steady monitoring of internet sites inside the Bureau’s jurisdiction with the purpose of figuring out safety points and content material adjustments, and offering incident alerts.
Particularly, the platform has been designed to search for the presence of hidden hyperlinks in internet content material, together with these containing delicate phrases associated to political criticism, violence, or pornography.
Whereas the precise objectives are unclear, it is suspected that such alerts might be utilized by prospects to take follow-on actions, similar to issuing warnings, deleting content material, or proscribing entry when delicate phrases are detected. That mentioned, Shanghai Anheng Good Metropolis Safety Know-how Co. Ltd. received the contract, per public paperwork analyzed by SentinelOne.
The cybersecurity agency mentioned the leak was detected after it analyzed a textual content file that was uploaded to the VirusTotal platform on January 24, 2025. The way wherein the info was leaked stays unclear.
“The principle file we analyzed comprises quite a few work logs, that are an outline of the work carried out by a TopSec worker and the period of time the duty took, usually accompanied by scripts, instructions, or knowledge associated to the duty,” the researchers famous.
“Along with work logs, the leak comprises many instructions and playbooks used to administrate TopSec’s providers through a number of widespread DevOps and infrastructure applied sciences which are used worldwide, together with Ansible, Docker, ElasticSearch, Gitlab, Kafka, Kibana, Kubernetes, and Redis.”
Additionally discovered are references to a different framework named Sparta (or Sparda) that is supposedly designed to deal with delicate phrase processing by receiving content material from downstream internet functions through GraphQL APIs, as soon as once more suggestive of censorship key phrase monitoring.
“These leaks yield perception into the advanced ecosystem of relationships between authorities entities and China’s personal sector cybersecurity corporations,” the researchers mentioned.
“Whereas many nations have vital overlap between authorities necessities and personal sector cybersecurity corporations, the ties between these entities in China are a lot deeper and characterize the state’s grasp on managing public opinion by means of on-line enforcement.”