Cybersecurity Experts Reconstruct the Two Hours That Broke Kuaishou’s Risk-Control Defenses

As a veteran practitioner in cybersecurity and risk-control systems, Lu Shenglong learned about the Kuaishou livestream incident earlier than most.

On December 22, shortly after 10:00 p.m., screenshots began popping up in internal cybersecurity group chats—showing clearly prohibited content appearing inside Kuaishou’s livestream interface. Soon after, similar alerts surfaced in Kuaishou’s own emergency response center group. Lu and other technical experts initially suspected that a moderation module had “temporarily gone down.” But as more screenshots and screen recordings flooded in—and spread rapidly—he realized this wasn’t a routine technical glitch.

That night, large numbers of livestream rooms simultaneously displayed pornographic, vulgar, and graphic violent content, with some rooms reaching nearly 100,000 viewers. Images and videos spread like a virus across social platforms and private groups. After attempts like throttling and bans, Kuaishou ultimately contained the situation only by taking down the livestream entry point altogether. Livestream functionality was largely restored around 12:45 a.m.

The entire episode lasted roughly two hours. Kuaishou later issued a statement saying it had been hit by “black- and gray-industry” attacks.

Lu has worked in cybersecurity for 13 years and currently leads an offensive-and-defensive security lab at a cybersecurity firm. Part of his job is acting as an authorized hacker—testing organizations’ security posture under permission.

In his view, the industry’s discussion after the incident was less about the attack itself and more about why Kuaishou’s risk-control system was “punched through,” and why the platform didn’t rapidly switch into emergency mode during an abnormal two-hour window.

“This bug could have been caused by an algorithm failure. It could also have happened during a staged rollout of a risk-control algorithm, or due to weaknesses in the internal high-availability architecture used for fault isolation and fast recovery. From onset to full containment, it took nearly two hours—too slow. That suggests gaps in emergency procedures, fault detection, and failover mechanisms,” Lu said.

To him, the incident was a mirror—reflecting the long-running tug-of-war between business growth and security investment, and the hidden security debt the broader internet industry accumulates while moving fast.

“Two hours from start to full containment is too long—something is wrong.”

Jingxiang Studio: How did you first hear about the “Kuaishou livestream incident”?

Lu Shenglong: I saw it in several group chats tied to cybersecurity forums. Kuaishou also has an “Emergency Response Center” group to communicate vulnerability information with external security researchers.

Around 10:00 p.m., people began saying Kuaishou’s moderation and risk-control platform seemed to be down. At first, nobody jumped straight to “attack.” We all assumed it was an internal failure.

Jingxiang Studio: So initially you didn’t think it was a hacker attack?

Lu Shenglong: Right. Typical hacker attacks often focus on denial-of-service—like DDoS, where massive traffic floods servers or surrounding infrastructure—or stealthy intrusion and control.

With DDoS, you can usually observe obvious traffic anomalies, and platforms typically disclose the attack category. Those attacks aim to knock services offline, not precisely bypass moderation and then open large volumes of illegal livestreams.

That’s why many in the industry leaned toward the risk-control system itself failing—algorithm breakdown, a staged rollout gone wrong, or a temporary bug. And 10:00 p.m. is peak livestream time, when system load is high—often when things are most fragile.

Jingxiang Studio: How do you view Kuaishou’s response?

Lu Shenglong: Two hours from incident to full containment is too long. At minimum, it indicates problems in internal high availability design and emergency response mechanisms.

For a platform of Kuaishou’s scale, if a core risk-control system fails, there should be monitoring and alerts in seconds. The ideal response chain should look like this: risk-control failure → second-level alert → automatic switch to manual review queue or strict throttling mode → security and operations teams emergency fix → recovery.

Looking at the outcome, a two-hour containment time suggests one of several things: the issue wasn’t detected, the alert wasn’t acted on, or the emergency failover didn’t actually work.

Normally, if the risk-control system goes down, the business side can still activate manual review to intercept non-compliant livestream requests. But based on what happened, the manual review interception that should have kicked in didn’t deliver the expected effect. That could also be architectural: if business continuity is prioritized over safety, then when risk-control fails, the system may default to “allow” to avoid service interruption.

This incident spread extremely fast and had huge impact. But as of now, there’s no definitive root cause, and most outside analysis is still speculative.

Kuaishou will likely publish a more detailed report soon. For major public content-safety incidents, regulators often require companies to submit detailed reports, and the public has a right to understand what happened. It may currently be in the internal investigation and communication phase.

Jingxiang Studio: What responsibility might a platform bear in incidents like this?

Lu Shenglong: If it’s ultimately classified as a cybersecurity incident, the platform may face penalties under the Cybersecurity Law and the Data Security Law—such as fines, mandatory remediation, or even service suspension. If user data leakage is involved, it could also implicate the Personal Information Protection Law. Beyond that, if content-safety obligations weren’t properly fulfilled, the platform may be summoned by regulators and required to rectify.

Black/gray industry attacks aren’t necessarily “account theft”—they’re often “account usage.”

Jingxiang Studio: Some media reported that more than ten thousand accounts were involved in illicit livestreaming that night. Based on what we know, can we infer where those accounts came from?

Lu Shenglong: There’s no evidence that these were ordinary users whose accounts were stolen. A more likely scenario is that they were “inventory accounts” held by black/gray industry actors. If they attacked the risk-control platform, they don’t need the “tens of millions” scale people imagine. The key is a precise attack point.

Jingxiang Studio: So it might not be “stolen accounts,” but “accounts being used”?

Lu Shenglong: Exactly. Many platforms have large pools of accounts that were batch-registered or purchased. They may stay dormant, and once a risk-control weakness appears, they’re activated in bulk.

Jingxiang Studio: Compared with past data-breach incidents involving major internet firms, what’s different here?

Lu Shenglong: There are two angles.

First, if we accept Kuaishou’s description—risk control or business systems being attacked—then it’s not fundamentally different from cases we handle every day. The techniques involved aren’t necessarily “new” in the security world, but the attacker combined them and targeted livestream-specific business logic—like high-concurrency moderation—very precisely, causing outsized damage.

Second, the behavior after the compromise—mass pornographic livestreaming—differs significantly from typical data leaks.

In many data breaches, motives are clearer: exfiltrate information, steal trade secrets, mine crypto, extort, or siphon data. Here, the attacker’s goal appears to have been opening livestreams at scale—possibly to funnel traffic, attach links, exploit loopholes for profit, or conduct scams.

Jingxiang Studio: Kuaishou said it was hit by black/gray industry attacks. How does that ecosystem operate?

Lu Shenglong: The black/gray industry has formed a tightly linked supply chain with upstream, midstream, and downstream roles.

Upstream: tool developers, captcha-solving services, and data brokers. They provide automation scripts that can bypass risk controls.
Midstream: “account dealers.” They register, purchase, and maintain large numbers of platform accounts, then price them in tiers based on followers and activity—like an “account futures market.” They supply large volumes of verified and unverified accounts.
Downstream: execution crews. They rent or buy tools and accounts, then go live in concentrated bursts during the vulnerability window to drive traffic, scam, or push malicious promotions.

The cost of this kind of attack isn’t necessarily high, but the payoff can be huge. With device farms and cheap bot accounts, even if most accounts are banned, a tiny fraction surviving and successfully diverting traffic can cover the costs.

Jingxiang Studio: With evolving technology, how are black/gray industry attacks changing?

Lu Shenglong: On one hand, the barrier to wrongdoing is getting lower. Some groups are already using AI to correlate and analyze data—auto-labeling targets, generating scam scripts. If they have someone’s face data plus enough additional information, they can generate convincingly fake video or audio for fraud.

On the other hand, impact is scaling up. With livestreaming, you can reach thousands—or tens of thousands—very quickly.

At its core, offense-defense is a cost battle. Attackers can invest heavily: buy huge volumes of accounts, pay captcha services to bypass monitoring, mass-register accounts using fake identities. Defenders have fixed resources. If the attacker’s投入 is many times higher than the platform’s defensive capacity, breaches can happen.

Security should not be treated as a “negotiable cost.”

Jingxiang Studio: From an industry standpoint, what should people reflect on after this incident?

Lu Shenglong: For companies, the risk is universal. Kuaishou’s issue isn’t an isolated case—it reflects a long-standing problem: security is treated as a cost center, not a profit center. On financial statements, security spending looks like pure expense. It doesn’t directly add users, boost engagement, or increase revenue. So in resource allocation, project approvals, and internal influence, security teams often end up weaker.

In practice, many security teams are understaffed and stretched across multiple domains, making it difficult to build depth and completeness.

Under business pressure, security is often viewed as something that can “temporarily give way.” Many companies’ security programs are compliance-driven and incident-driven. If nothing happens, budget is tight and priorities slip; once something happens, attention spikes and spending increases briefly—then fades. This cycle makes security reactive, not systematic or forward-looking.

Jingxiang Studio: What’s a reasonable security investment ratio for companies?

Lu Shenglong: There’s no single number. It should match business scale and risk level. But in many domestic companies, the proportion of IT investment devoted to security is still low relative to business systems. Security isn’t “set it and forget it”—it requires continuous operations and iteration.

Today, we can use intelligent risk controls and user-tiered strategies to manage high-risk behavior without harming most users’ experience. At the same time, emergency response mechanisms must be solid.

Jingxiang Studio: Some experts say the core issue is the asymmetry between “automated attacks” and “manual defenses.” If you were to build an AI-automated defense system, what hidden attack patterns should AI be trained to recognize?

Lu Shenglong: Different scenarios need different models. For risk-control moderation, you’re dealing with content-safety models. Adversarial content safety often involves attackers adding tiny perturbations—noise that humans can’t detect—to prohibited images, which can trick traditional deep learning models into misclassifying.

For classic cybersecurity attacks, the focus should be on attack behaviors and on automating alerting, triage, and response—building systems that can detect, judge, and act quickly.

Jingxiang Studio: With AI being widely used by black/gray industry actors, how do you see this shift?

Lu Shenglong: Attacks are becoming easier, but defense is also improving. AI can be used offensively, but it can also help train risk models and detect anomalies. The real gap isn’t technology—it’s resources and priority. Attackers can concentrate on one point, while defenders must protect the entire surface. In the long term, it comes down to whether a company continuously invests in its security system.

Jingxiang Studio: What impact could this incident have on the industry?

Lu Shenglong: The impact is huge. Regulations—Cybersecurity Law, Data Security Law, Personal Information Protection Law, and related content governance requirements—are tightening platform responsibility. Authorities may strengthen inspections of companies’ security performance, and platforms will likely pay more attention to redundancy and high-availability design for risk-control systems.

Personally, I’m watching two things most closely: whether the final root cause will be disclosed transparently, and whether platforms will fundamentally rebalance business priorities versus security. If it’s only a technical patch and the underlying incentives don’t change, similar incidents could happen again.