Loading story…
China’s Military Procurement Network suspended or banned several prominent domestic cybersecurity companies from PLA-related contracts in the first half of 2026 over alleged procurement violations, with collusive bidding cited as a central concern. Companies named in reporting include TopSec, Venustech, and subsidiaries of Qi An Xin, all of which are described as significant players in China’s cybersecurity sector and part of the broader ecosystem that has supported government and military cyber activity.
The action has drawn added scrutiny because it follows earlier reporting on leaked i-SOON documents that allegedly detailed bid-rigging and coordinated bidding practices among Chinese cybersecurity vendors competing for state contracts. The measures suggest tighter military procurement oversight in China and could disrupt firms with close links to state security work, while exposing governance and compliance risks inside a sector long intertwined with official cyber operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Beijing TopSec Network Security was given a lifetime ban from PLA procurement in January 2026 following a two-year investigation into collusive bidding. The action was part of the PLA's enforcement against procurement misconduct among Chinese cybersecurity vendors.
In the first half of 2026, China's Military Procurement Network suspended or banned numerous major Chinese cybersecurity companies from PLA-related contracts over alleged procurement violations, especially collusive bidding. Companies specifically named in the reporting include TopSec, Venustech, and Qi An Xin subsidiaries.
Earlier reporting cited leaked i-SOON documents that described bid-rigging and cooperative bidding practices among Chinese cybersecurity firms pursuing government and military contracts. The leaks were also said to show close ties between some vendors and state or military clients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcemalware.news
Open sourcenattothoughts.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China has reportedly instructed domestic organizations to stop using cybersecurity software from multiple **U.S. and Israeli vendors**, citing national security concerns that such tools could collect sensitive data and transmit it abroad. The directive, reported by Reuters and echoed in follow-on coverage, appears consistent with Beijing’s broader technology decoupling efforts and long-running policy initiatives to replace foreign technology in critical environments with domestic alternatives. Named vendors affected include **VMware (Broadcom)**, **Palo Alto Networks**, **Fortinet**, and Israel-based **Check Point**, with additional reporting listing a wider set of impacted security suppliers such as **Mandiant**, **CrowdStrike**, **SentinelOne**, **McAfee**, **Recorded Future**, **Claroty**, **Rapid7**, and **Wiz**, as well as Israeli firms **CyberArk**, **Orca Security**, **Cato Networks**, and **Imperva** (Thales-owned). Reporting indicates uncertainty about which Chinese entities received the notice and how broadly it applies, but notes the move had immediate market impact on affected companies’ stocks and aligns with China’s stated goal of reducing reliance on foreign software across state-linked sectors.
Jun 29, 2026
Recorded Future reported that China’s People’s Liberation Army Unit 61419 purchased foreign antivirus products, indicating the unit was likely acquiring commercial security software to study, test, and potentially exploit it. The finding links a known PLA cyber element to procurement activity involving defensive tools made by overseas vendors, a pattern consistent with vulnerability research and offensive cyber preparation. The report suggests the antivirus purchases were not routine enterprise acquisitions but part of a broader effort to analyze how widely deployed security products operate and where they may be weak. For defenders, the activity underscores the risk that endpoint protection platforms themselves can become high-value targets, especially when state-backed operators seek to identify exploitable flaws, bypass detection, or repurpose trusted software in intrusion campaigns.
Jul 12, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026