https://epcyber.com/blog.html China-focused OSINT, dark-web CTI, and offensive-OSINT tradecraft — investigations, methods, and findings from the EPCYBER Intelligence Team. en-us Mon, 20 Jul 2026 09:00:00 +0000 https://epcyber.com/assets/author.png https://epcyber.com/blog.html https://epcyber.com/blog-offensive-osint-china.html https://epcyber.com/blog-offensive-osint-china.html Mon, 20 Jul 2026 09:00:00 +0000 Seeing foreign ecosystems through a different lens — a new advanced, corporate-verified course that brings penetration-testing tradecraft to China OSINT and surfaces what conventional analysts never see. https://epcyber.com/blog-threat-intelligence-platforms-suck.html https://epcyber.com/blog-threat-intelligence-platforms-suck.html Wed, 08 Jul 2026 09:00:00 +0000 The sales deck shows pins on every underground ecosystem. What ships is machine-translated headlines and keyword alerts — coverage you can see, intelligence you can't. https://epcyber.com/blog-intelligence-gaps-vetting.html https://epcyber.com/blog-intelligence-gaps-vetting.html Mon, 06 Jul 2026 09:00:00 +0000 The résumé is the least trustworthy document in the room — and it's the one nearly every vetting process leans on hardest. https://epcyber.com/blog-c2-infra-detection.html https://epcyber.com/blog-c2-infra-detection.html Wed, 14 Jan 2026 09:00:00 +0000 Operators leave default certificates, unchanged favicons, and framework credits sitting in the HTML. Every shortcut they take becomes a fingerprint — and fingerprints are searchable. https://epcyber.com/blog-is-the-name-fake.html https://epcyber.com/blog-is-the-name-fake.html Fri, 09 Jan 2026 09:00:00 +0000 张三 is China's John Doe. Before you build a profile on a Chinese name from a leak, make sure you're not chasing a placeholder. https://epcyber.com/blog-douyin-military-activity.html https://epcyber.com/blog-douyin-military-activity.html Tue, 30 Dec 2025 09:00:00 +0000 Some of the most valuable open-source intelligence on Chinese military activity isn't text — it's Douyin video. Here's how to work with it, even if you don't read Chinese. https://epcyber.com/blog-china-mass-surveillance-tech.html https://epcyber.com/blog-china-mass-surveillance-tech.html Fri, 19 Dec 2025 09:00:00 +0000 Leaked internal documents reveal 270 million monthly voiceprint collections, video analysis deployed to China's security apparatus, and deep integration with Huawei systems. https://epcyber.com/blog-inside-the-ccp.html https://epcyber.com/blog-inside-the-ccp.html Sat, 13 Dec 2025 09:00:00 +0000 Party members, veterans, grid watchers, militia warehouses, and 2,000 people whose every move is logged — a look inside a village-level CCP surveillance system on the North Korean border. https://epcyber.com/blog-threat-actor-attribution.html https://epcyber.com/blog-threat-actor-attribution.html Thu, 11 Dec 2025 09:00:00 +0000 A new alias doesn't mean a new actor. Behavioral patterns, opsec failures and linguistic habits persist — here's a framework for collapsing personas back into one operator. https://epcyber.com/blog-pla-unit-numbers.html https://epcyber.com/blog-pla-unit-numbers.html Wed, 10 Dec 2025 09:00:00 +0000 Decode the structure of PLA unit designations — what the MUCD numbers reveal about branch, function, and command, and how to search them. https://epcyber.com/blog-sanctions-evasion-shell-companies.html https://epcyber.com/blog-sanctions-evasion-shell-companies.html Thu, 04 Dec 2025 09:00:00 +0000 The day after a Chinese company hits the Entity List, a new one is registered in Hong Kong. Same address, same directors. Here are the patterns that give the cutouts away. https://epcyber.com/blog-the-name-is-a-lie.html https://epcyber.com/blog-the-name-is-a-lie.html Wed, 03 Dec 2025 09:00:00 +0000 You search 'Zhang Wei' and get 50 million results. Chinese name OSINT runs on different logic — and if you don't understand it, you're drowning in false positives or missing your target. https://epcyber.com/blog-tracking-dual-use-tech.html https://epcyber.com/blog-tracking-dual-use-tech.html Tue, 02 Dec 2025 09:00:00 +0000 Beijing's military-civil fusion doesn't hide in secret networks — it files patents, registers companies, and occasionally leaks documents. Here's where to actually start looking. https://epcyber.com/blog-new-underground-forum.html https://epcyber.com/blog-new-underground-forum.html Tue, 12 Aug 2025 09:00:00 +0000 XSS shut down, BreachForums got compromised, and a new forum quietly emerged to absorb the fallout. Spotting these shifts early is what separates reactive monitoring from proactive intelligence. https://epcyber.com/blog-chinas-dual-use-tech-ai.html https://epcyber.com/blog-chinas-dual-use-tech-ai.html Mon, 04 Aug 2025 09:00:00 +0000 China's 2025 AI Security Governance draft reads like standard regulatory noise — until you notice it's a playbook for AI-assisted offensive cyber operations at scale. https://epcyber.com/blog-is-your-target-pla.html https://epcyber.com/blog-is-your-target-pla.html Wed, 30 Jul 2025 09:00:00 +0000 No military background anywhere online. Then a routine 2019 civil-servant candidate list from Jingmen City gave up the whole profile. https://epcyber.com/blog-pastebin-to-threat-actor.html https://epcyber.com/blog-pastebin-to-threat-actor.html Tue, 22 Jul 2025 09:00:00 +0000 Some of the most actionable dark-web sources aren't buried in .onion forums — they're sitting in plain sight on paste sites. Here's how to pivot one overlooked paste into a live threat-actor network. https://epcyber.com/blog-obtain-plus86-number-osint.html https://epcyber.com/blog-obtain-plus86-number-osint.html Sat, 21 Jun 2025 09:00:00 +0000 A new method to obtain and use a real +86 number independently — create verified accounts on Zhihu, QQ, Weibo, Douyin and more, no ID verification required. https://epcyber.com/blog-bypass-blocked-sites.html https://epcyber.com/blog-bypass-blocked-sites.html Sun, 01 Jun 2025 09:00:00 +0000 Wix-style geo/VPN/TOR blockers rely on simple logic. Understand how they work and two out-of-the-box methods open the door — no VPN required. https://epcyber.com/blog-ultimate-guide-china-osint.html https://epcyber.com/blog-ultimate-guide-china-osint.html Sat, 31 May 2025 09:00:00 +0000 The complete field guide to China OSINT — every major domestic platform, what it exposes, and how analysts pull emails, phones, and usernames from it. https://epcyber.com/blog-metadata-exposed-forum-admin.html https://epcyber.com/blog-metadata-exposed-forum-admin.html Wed, 28 May 2025 09:00:00 +0000 A familiar-looking logo on a dark web forum led us to its admin — through the image metadata they forgot to strip. https://epcyber.com/blog-deepseek-pla-ties-usage.html https://epcyber.com/blog-deepseek-pla-ties-usage.html Wed, 30 Apr 2025 09:00:00 +0000 Our DeepSeek AI × Chinese Military (PLA) ties and usage report — state influence, military adoption, and infrastructure abuse, from original EPCYBER research. https://epcyber.com/blog-live-bypass-qcc-tianyancha.html https://epcyber.com/blog-live-bypass-qcc-tianyancha.html Tue, 01 Apr 2025 09:00:00 +0000 QCC and Tianyancha block foreign traffic with DPI, not a geo-fence — which is why a VPN doesn't get you in. Live, unedited, the route through. https://epcyber.com/blog-chinese-top-secret-gov-files.html https://epcyber.com/blog-chinese-top-secret-gov-files.html Fri, 21 Feb 2025 09:00:00 +0000 Over 50 exposed government documents marked top secret or confidential — found with a single method, somewhere keywords return nothing. https://epcyber.com/blog-bypass-restricted-chinese-networks.html https://epcyber.com/blog-bypass-restricted-chinese-networks.html Sun, 16 Feb 2025 09:00:00 +0000 Seventy-five seconds. The technical restrictions that stop most Western practitioners cold, and the way through. https://epcyber.com/blog-chinese-mobile-numbers.html https://epcyber.com/blog-chinese-mobile-numbers.html Sun, 16 Feb 2025 09:00:00 +0000 The +86 is the join between an account and a person. Here is how to get one. https://epcyber.com/blog-rednote-exposing-numbers.html https://epcyber.com/blog-rednote-exposing-numbers.html Tue, 21 Jan 2025 09:00:00 +0000 RedNote leaks its users' mobile numbers. What that opens up, and the databases sitting behind it. https://epcyber.com/blog-bypass-gov-cn-restrictions.html https://epcyber.com/blog-bypass-gov-cn-restrictions.html Tue, 29 Oct 2024 09:00:00 +0000 Reaching gov.cn data past its technical restrictions. Methods we found ourselves — which is why they still work. https://epcyber.com/blog-bypassing-csdn.html https://epcyber.com/blog-bypassing-csdn.html Wed, 23 Oct 2024 09:00:00 +0000 CSDN shows you enough to know the answer is there, then holds the rest behind a +86 login. Step by step, without an account. https://epcyber.com/blog-cyber-threat-identification-china.html https://epcyber.com/blog-cyber-threat-identification-china.html Sun, 20 Oct 2024 09:00:00 +0000 Finding data, getting past site restrictions, and running CTI across China's landscape — tools, cases, and source development. https://epcyber.com/blog-socmint-sneak-peek.html https://epcyber.com/blog-socmint-sneak-peek.html Mon, 14 Oct 2024 09:00:00 +0000 Twelve minutes of an actual lesson. How we explore, search, and pivot in China's ecosystem — including the wrong turns. https://epcyber.com/blog-why-cti-platforms-fail-video.html https://epcyber.com/blog-why-cti-platforms-fail-video.html Mon, 05 Aug 2024 09:00:00 +0000 90% of CTI reports scratch the surface. Two reasons nobody in the industry wants to name — and what actually fixes it. https://epcyber.com/blog-new-genesis-market.html https://epcyber.com/blog-new-genesis-market.html Tue, 23 Jul 2024 09:00:00 +0000 A Genesis Market successor and a new leaks search engine — both caught while still in early development, before anyone was watching. https://epcyber.com/blog-what-skills-you-gain.html https://epcyber.com/blog-what-skills-you-gain.html Sat, 13 Jul 2024 09:00:00 +0000 For team leaders asking what their analysts will actually be able to do afterward. The full rundown — and an honest note on who it isn't for yet. https://epcyber.com/blog-bypassing-access-without-vpn.html https://epcyber.com/blog-bypassing-access-without-vpn.html Sat, 06 Jul 2024 09:00:00 +0000 Ask a Western analyst how to reach a blocked Chinese site and you get one answer. Those platforms were built assuming you'd bring exactly that. https://epcyber.com/blog-china-osint-advanced-overview.html https://epcyber.com/blog-china-osint-advanced-overview.html Thu, 04 Apr 2024 09:00:00 +0000 An overview of the Advanced program — what it covers, and who it is built for. https://epcyber.com/blog-weibo-osint-trick.html https://epcyber.com/blog-weibo-osint-trick.html Mon, 28 Aug 2023 09:00:00 +0000 A manual route from a Weibo image to the account behind it. One episode of Bytes of Clues — and a drop in the ocean, by our own admission.