CCP Unmasked
Attribution profile
- Type
- Activist
- Location
- China
- Known incidents
- 3 incidents
- Sources
- 1 source
- First seen
- 2020-08-19
- Last seen
- 2020-08-19
- Updated
- 2026-10-04 00:28
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
CCP Unmasked is a hacker group that uses the alias referencing the Chinese Communist Party and is located in China. The group gained attention in August 2020 when it claimed to have breached three Chinese social‑media monitoring firms—Knowlesys (Hong Kong/Guangdong), Yunrun Big Data Service (Guangzhou) and OneSight (Beijing)—and leaked alleged internal documents totaling about 40 GB. The leaked materials included presentations describing the firms’ Intelligence Center platform, which the companies said was used to monitor Facebook, Twitter, WeChat and other sites for anti‑government groups and opposition parties, and to work with intelligence, military and police agencies. CCP Unmasked stated that its goal was to challenge what it perceived as the Chinese Communist Party’s attempts to undermine democracy and spread disinformation, and it published the files on its Twitter account before the account was suspended under Twitter’s hacked‑materials policy. No specific malware families, initial‑access vectors or tooling details are described in the reporting, and the group’s ties to any state or criminal organization have not been publicly established. The August 2020 document leak remains its only publicly reported operation.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 1 source.