We’re excited to share that we will be delivering a speech in the The Hague Threat Intelligence Exchange (Hague TIX 2025) where we’ll be discussing the latest Chinese state actors’s attack methods.
Stay tuned for insights from our experts!
About Speech
- Date: 2025 / 6 / 10
- Venue: George Maduroplein 1 (Madurodam), Den Haag, Netherlands
- Topic: KnockHuoDuo Unmasked: The Fruit of China's Evolving Zero-Day Exploitation Strategy
- Speakers: Charles Li (Chief Analyst), Greg Chen (Vulnerability Researcher), Yi-Chin Chuang (Cyber Threat Researcher)
- Introduction:
In recent years, Chinese state actors have increasingly exploited zero-day vulnerabilities, surpassing all other nations combined. This surge reflects a deliberate policy shift since 2018, when China began systematically collecting vulnerabilities and treating them as national assets. Following this strategy, we identified an emerging Chinese state actor, KnockHuodou (UNC4841), specializing in vulnerability exploitation. Their expertise in pwning, binary exploitation, and reverse engineering has enabled some of the most sophisticated compromises. This presentation will reveal our research on KnockHuodou in 2024.
We will start by introducing KnockHuodou and their recent campaigns, particularly their exploitation of zero-day vulnerabilities in edge devices. Next, we will present case studies to highlight the evolving threat they pose. KnockHuodou serves as a vivid example of how China-nexus actors can adopt the centralized vulnerability research in cyberattacks. In the last part of the speech, we will conclude with key implication based on our understanding of KnockHuodou, and how it represents the emerging Chinese cyber threats – because, as the saying goes, know the enemy and know yourself; in a hundred battles, you will never be in peril. We believe that intelligence is the best key for defending.
More details are at the official website.