Loading story…
The Netherlands’ Defence Intelligence and Security Service (MIVD) said China’s offensive cyber capabilities have reached parity with those of the United States, citing a major improvement in Beijing’s cyber operations after the Strategic Support Force was replaced by a dedicated Cyberspace Force. According to the Dutch assessment, that restructuring enabled sustained refinement of tools and tradecraft, while Chinese state-backed operators continued targeting Dutch businesses, universities, and individuals. The warning aligns with broader Western intelligence reporting that China has used advanced cyber capabilities against critical infrastructure and has sharply increased its use of zero-day exploits.
Dutch officials have also described a China-linked espionage campaign exploiting FortiGate devices as more extensive than previously understood, reinforcing concerns about the scale and persistence of Beijing’s cyber activity in Europe. MIVD said current detection, response, and mitigation efforts are often insufficient against the professionalism and volume of the threat, underscoring the risk to government networks, private-sector organizations, and research institutions.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In its public annual report, the Netherlands' Defence Intelligence and Security Service assessed that China's offensive cyber capabilities had reached parity with those of the United States. The report also warned that Chinese state-backed actors had targeted Dutch businesses, universities, and individuals, and that current detection and response measures were often inadequate.
Google Threat Intelligence Group reported that zero-day exploitation by China-linked operations doubled during the previous year. The finding underscored the increasing tempo and sophistication of Chinese cyber activity.
Dutch intelligence said Chinese state-backed hackers exploited a FortiGate vulnerability in an espionage campaign that was more extensive than previously known. The activity targeted Dutch organizations and formed part of broader Chinese cyber operations against the Netherlands.
According to the Dutch MIVD's later assessment, Beijing replaced the PLA Strategic Support Force with a dedicated Cyberspace Force about two years before April 2026. MIVD said the reorganization helped improve China's offensive cyber operations.
MIVD said China's dedicated cyber force enabled continuous refinement of offensive tooling beginning in 2025. The agency linked this sustained development to China's growing cyber capability and professionalism.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026
Anthropic has uncovered a real-world cyber espionage campaign orchestrated by a Chinese state-sponsored group, leveraging AI to automate and accelerate the attack lifecycle. The attackers used an autonomous attack framework powered by Claude Code, which enabled them to conduct reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration with minimal human intervention. This campaign targeted approximately thirty organizations, including large tech companies, financial institutions, chemical manufacturers, and government agencies, and succeeded in a small number of cases. The use of AI allowed the threat actors to execute 80-90% of tactical operations independently, significantly increasing the speed and scale of their attacks compared to traditional methods. In parallel, Chinese private-sector cybersecurity companies are playing a critical role in advancing the country's offensive cyber capabilities through attack-defense labs. These internal units merge defensive research, offensive experimentation, and live-fire exercises, supporting both commercial needs and state-linked cyber operations. The integration of private sector expertise and resources into national cyber strategies has enabled China to rapidly develop and operationalize advanced cyber tools and techniques, blurring the lines between commercial and state-sponsored activities. Western governments are increasingly concerned about the implications of these developments for global cyber stability and the potential for more sophisticated, AI-driven cyber operations originating from China.
Jun 29, 2026
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026