Loading story…
A UK-China Transparency report says UK universities maintain 34 cyber-related partnerships with Chinese institutions, including 13 links to universities closely tied to China’s defence research system, creating significant research security risks. The report argues that the UK is more exposed than any other European country because its open civilian academic model is being paired with Chinese institutions operating within Beijing’s military-civil fusion framework. It highlights Beijing University of Posts and Telecommunications (BUPT) and Beihang University as high-risk examples, citing links between their cyber research, faculty, and China’s military, intelligence, and defence-industrial networks.
The report identifies the Queen Mary University of London-BUPT relationship as the most deeply integrated UK-China cyber collaboration and says additional lower-visibility cooperation continues through co-authored research and strategic partnerships. It also points to Beihang’s joint cybersecurity laboratory with Beijing Integrity Technology Co., a company sanctioned by the US, UK, and EU for facilitating activity linked to Flax Typhoon. The authors say the UK’s current research security regime remains largely advisory and call for stronger institutional controls, including dedicated research security officers, clearer high-risk organization guidance, financial support to unwind risky partnerships, and tighter travel security measures.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
On July 29, 2026, UK-China Transparency released a report examining 34 UK-China university partnerships in cyber-related fields and arguing that these relationships create research security risks for the UK. The report highlighted 13 partnerships involving Chinese institutions with close ties to China's defence and security apparatus and recommended stronger UK research security controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenattothoughts.com
Open sourcedrive.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MI5 issued an Espionage Alert alleging that the China General Technology Research Institute (CGTRI), also known as the China Academy of General Technology, funds academic work intended to improve the technical capabilities of China’s Ministry of State Security (MSS). The agency identified more than 100 academics linked to UK institutions who had contributed to CGTRI-funded projects, potentially without knowing the organization’s alleged intelligence-service connection. The work covered dual-use areas including artificial intelligence, cybersecurity, covert communications, and steganography. MI5 urged universities and researchers to review present and planned CGTRI collaborations, trace Chinese funding sources, and apply UK government research-security guidance. It warned that assistance to, or material benefit received from, a foreign intelligence service can carry criminal liability under the National Security Act 2023. China rejected the allegations, while the alert underscores UK concern that opaque research funding can enable technology transfer to foreign intelligence services without broadly implicating Chinese researchers or academic cooperation.
Oct 1, 2026
Microsoft said the China-backed espionage group **Flax Typhoon** has quietly compromised organizations in Taiwan by abusing legitimate tools and living-off-the-land techniques, with targeting focused on government, education, critical manufacturing, and information technology. The activity relied on access through public-facing applications, persistence with software such as **SoftEther VPN**, and proxying through compromised SOHO devices to reduce detection, aligning the campaign with broader PRC cyber operations described in U.S. defense strategy documents. SecurityScorecard later reported additional infrastructure likely linked to Flax Typhoon by tracing reused TLS certificate SHA-1 fingerprints associated with the group’s SoftEther VPN servers and analyzing partner NetFlow data. Its researchers identified repeated communication between a previously flagged VPN IP, `45.204.1[.]203`, and four IP addresses attributed to **Fudan University** — `202.120.224[.]129`, `202.120.224[.]82`, `202.120.224[.]114`, and `202.120.224[.]116` — raising the possibility of higher-education-linked support infrastructure while noting the university systems could themselves be compromised; the firm urged likely targets to monitor and consider blocking the identified infrastructure.
Aug 21, 2026
The White House released a National Security Science and Technology Strategy that calls for stronger safeguards across the U.S. research ecosystem, including automated research-security vetting, continuous monitoring of federally supported projects, expanded counterintelligence support, shared information repositories, and clearer cybersecurity guidance for researchers and institutions. The strategy argues that stronger defenses are needed to protect U.S. economic and military advantages from foreign interference, technology theft, and other threats targeting innovation, while also emphasizing workforce development and the need to attract top global talent in critical science and technology fields. The policy push coincided with a Pentagon order directing 30 U.S. universities and specialized technology institutes to audit their academic, financial, and research ties to foreign entities considered risky or hostile. The Defense Department said the reviews are meant to prevent unauthorized technology transfer and intellectual property theft tied to entities in countries including China, Russia, and Iran, as well as organizations linked to rebranded Confucius Institutes; schools must report findings and mitigation steps by **August 31, 2026** or risk losing eligibility for future federal research funding.
Aug 21, 2026