Mei Danowski

Threat intelligence research from geopolitical perspectives. Co-founder of Natto Thoughts.

[Eugenio Benincasa @eubenincasa]

New Natto piece examines the cyber ops and contractors behind China’s efforts to target critics abroad, and how the tools and capabilities behind these campaigns circulate across China’s cyber ecosystem, as illustrated in the chart below. Link in thread.

[Eugenio Benincasa @eubenincasa]

Where does China stand in AI-driven vulnerability discovery? One company claims its AI-assisted bug discovery operates at a scale similar to that claimed for Claude Mythos. What does that actually look like?

More on Natto Thoughts (link in thread).

[Mei Danowski @MeiDanowski]

@n0tsa This appears to be a retelling of the TCL TV and @sickcodes story. See https://t.co/A4CPeqC7Qw

[Eugenio Benincasa @eubenincasa]

After 2 years in the dark, the Tianfu Cup is back. The event – China’s most prestigious 0-day hacking contest – resurfaced with little visibility.

The website was live only briefly, but we got to it in time. New Natto analysis (link in thread) digs into 4 key developments:

[Eugenio Benincasa @eubenincasa]

This piece traces the shift from earlier, more provincially bounded operational models toward cross-provincial collaboration with legitimate cybersecurity businesses, and explores why these firms are concentrated in a small number of provinces 👉 https://t.co/95bueNxLKO

[Eugenio Benincasa @eubenincasa]

How do China’s cyber operations scale to a near-nationwide level? While provincial MSS/MPS bureaus remain core nodes of authority and tasking, a detailed case study demonstrates how companies can enable cross-provincial operations at scale (link in thread)

[Mei Danowski @MeiDanowski]

Intense competition, rapid innovation, and strong state involvement define the overall trends in China’s cybersecurity industry for 2025. See our latest analysis:

https://t.co/qWqmVo25wM

[Mei Danowski @MeiDanowski]

From attack–defense thinking to vulnerability research and exposed threat actors, the Natto Team explored key aspects of China’s cyber ecosystem in 2026.

https://t.co/TGCOvNgHIV

[Eugenio Benincasa @eubenincasa]

China’s Ministry of State Security (MSS) is not a monolith, but highly provincialized. Its provincial bureaus function as the operational nerve centres of state cyber ops. In a new piece, @MeiDanowski and I examine their roles and patterns of specialization (link in thread)

[Mei Danowski @MeiDanowski]

See link for details https://t.co/DAdsJTnZYK

[Mei Danowski @MeiDanowski]

The Natto Team examines the leaked incident from Knownsec’s perspective to explore the role that elite Chinese cybersecurity companies play in building the country’s cyber capabilities.

[Eugenio Benincasa @eubenincasa]

Western govts grapple w/how the private-sector could be better integrated into state cyber ops. In China, many ops flow through "attack-defense labs," which blend commercial work w/state-linked activity.

This piece w/@MeiDanowski examines these labs & their state links (link👇)

[Mei Danowski @MeiDanowski]

https://t.co/7L3wsZB5pa

[Mei Danowski @MeiDanowski]

Researcher @sickcodes found a vulnerability in TCL TVs and reached out to TCL. What happened next became a masterclass in what NOT to do-eventually, what TO do.
New analysis from Natto Thoughts - how a single disclosure reshaped China’s approach to cybersecurity and control.

[Mei Danowski @MeiDanowski]

https://t.co/4KxIfOXKuV

[Mei Danowski @MeiDanowski]

The Natto Team explores how APT27, HAFNIUM, and Silk Typhoon highlight the complexities of tracking threat actors and their real-world identities and why understanding the humans behind the keyboard matters.

[Mei Danowski @MeiDanowski]

https://t.co/DquqBPgx3U

[Mei Danowski @MeiDanowski]

The Natto Team examines the Joint Advisory and highlights how government agencies navigate the complex web of threat actors, corporate suppliers and state intelligence Chinese state cyber operations. See Natto Thoughts analysis 👇

[Mei Danowski @MeiDanowski]

Very excited to have the opportunity to work with @eubenincasa and present our research at @labscon_io - the best conference of year as many people say.

[Eugenio Benincasa @eubenincasa]

Off to @labscon_io in the Arizona desert next week to dive into China cyber research with @MeiDanowski 🌵😎 Looking forward to seeing everyone there and catching some great research

[Mei Danowski @MeiDanowski]

Read the full piece https://t.co/0M9V9FQL0N

[Mei Danowski @MeiDanowski]

From Natto Thoughts : a beacon of clarity? Or just more questions in storm?