Researchers have linked Guangdong Chanming Technology Co., Ltd., a little-known Chinese cybersecurity vendor, to RedRelay, an alleged covert relay network used by China-linked threat actors. The findings connect company records, software artifacts, patent filings, and PLA procurement documents to a broader cyber-espionage ecosystem. Despite its minimal public visibility, the firm maintains several copyrights and patents for tools with capabilities more aligned with surveillance, anonymity, data collection, and offensive cyber operations than conventional enterprise security products.
Registered product names include Internet Security Access System, Multi-Function Security Proxy System, File Transfer Network System, Secure Tunnel Net anti-traceability system, Network Equipment Vulnerability Analysis System, Android Secret Extraction System, and Telegram Data Collection System.
The Chinese vendor linked RedRelay (Source: WordPress) These descriptions indicate software designed to conceal traffic, route communications through intermediary systems, assess network weaknesses, and collect data from mobile devices and messaging platforms. The company’s apparent lack of commercial marketing and association with military contracts suggests it may be developing products for state-linked users rather than the general cybersecurity market. Researchers identified an unusual Linux command repeatedly used in FCN builds to identify a default network interface: cat /proc/net/route | awk '{print $1,$2}' | awk '/00000000/ {print $1}' This command sequence served as a crucial pivot point.
