Loading story…
Italian investigators disclosed that China-linked hackers breached Italy’s Interior Ministry network in February 2026 and reportedly stole personnel data on about 5,000 DIGOS officers, the police units responsible for counterterrorism and political investigations. Italian law enforcement assessed the intrusion was not routine espionage, but part of an effort to identify Chinese nationals overseas whom Beijing viewed as political threats, linking the operation to broader campaigns targeting critics and diaspora communities abroad.
The breach fits a wider pattern of PRC transnational repression in which cyber operations are used alongside surveillance, intimidation, proxy networks, pressure on relatives, covert agents, and misuse of law-enforcement mechanisms to monitor and silence dissidents outside China. Reporting cited Freedom House data attributing 253 of 854 documented physical transnational repression incidents from 2014 to 2022 to the PRC, as well as 2023 U.S. charges against alleged Ministry of Public Security officers tied to the 912 Special Project Working Group and prior allegations involving covert overseas Chinese police service stations and private contractors supporting these activities.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
In February 2026, Italian investigators disclosed that China-linked hackers breached Italy’s Interior Ministry network and reportedly stole personnel data on about 5,000 DIGOS officers. Italian law enforcement assessed that the intrusion was intended to identify Chinese nationals abroad viewed by the Chinese Communist Party as political threats, rather than serve as routine espionage.
In 2023, U.S. authorities brought charges against alleged Chinese Ministry of Public Security officers connected to the 912 Special Project Working Group. The reference cites this as part of the broader pattern of PRC transnational repression abroad.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenattothoughts.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026
Reporting indicates **China-linked intelligence activity** is targeting current and former Western government officials through both human and technical collection. In the US case, a suspected Chinese influence/collection network using a purported consultancy (*Foresight and Strategy*) allegedly approached a former senior State Department official and offered payment to produce an assessment of US policy priorities in Venezuela, consistent with prior research describing a nexus of fake companies and websites used to recruit people with government and think-tank policy experience. In the UK, Chinese state-linked hackers are accused of maintaining years-long access to communications associated with senior Downing Street officials, with reporting alleging compromises affecting phones used by aides to former prime ministers **Boris Johnson, Liz Truss, and Rishi Sunak** dating back to 2021 and discovered in 2024. The activity has been linked by sources to **Salt Typhoon**, a China-aligned espionage group associated with telecom-provider intrusions that can enable collection of call metadata and potentially content (texts/calls), allowing intelligence value even without direct handset malware.
Jun 29, 2026
China-linked threat activity was reported against both critical infrastructure in India and diplomatic targets in Europe, with researchers describing sustained espionage and pre-positioning operations rather than confirmed destructive attacks. Recorded Future’s Insikt Group said intrusions hit seven Indian State Load Dispatch Centers near the disputed Ladakh border, as well as India’s national emergency response apparatus and an Indian logistics subsidiary, using **ShadowPad** malware, compromised DVR/IP camera devices for command-and-control, and the **FastReverseProxy** tool. The activity was assessed as likely intended to establish access and collect intelligence inside India’s power sector. Separately, Proofpoint said China-aligned actor **TA416** increased operations against European diplomatic entities as Russia-Ukraine tensions escalated, including targeting a person involved in refugee and migrant services. The campaigns used web bugs to confirm active recipients before sending malicious links that ultimately deployed updated **PlugX** malware through ZIP archives, droppers, and DLL search-order hijacking. Proofpoint found substantial overlap between TA416 and the publicly reported **Red Delta** cluster, while Beijing publicly denied involvement in the India-related accusations and said it opposes cyberattacks.
Aug 15, 2026