Loading story…
The United States and United Kingdom publicly attributed long-running cyberespionage campaigns to APT31, a China state-affiliated group linked to the Ministry of State Security. UK authorities said the actors compromised the Electoral Commission’s systems and accessed electoral-register data, while also conducting reconnaissance against parliamentarians critical of China. The activity targeted UK democratic institutions, lawmakers, dissidents, and advocates, as well as organizations in strategically important industries.
The U.S. unsealed charges against seven PRC nationals alleged to operate with APT31 under the Hubei State Security Department, accusing them of conspiracy to commit computer intrusions and wire fraud. Prosecutors said the group sent more than 10,000 malicious emails using tracking links, zero-day exploits, malware, and command-and-control infrastructure to compromise government, political, corporate, and civil-society targets worldwide. The coordinated response included U.S. Treasury sanctions against China-linked actors and entities, UK sanctions, and a State Department reward of up to $10 million for information on the accused operators and their network.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
APT31 allegedly targeted email accounts of foreign officials affiliated with the Inter-Parliamentary Alliance on China, including every EU member of IPAC and 43 UK parliamentary accounts, largely belonging to IPAC members or critics of the PRC.
Following Nobel Peace Prize nominations for Hong Kong Umbrella Movement activists, APT31 allegedly targeted Norwegian government officials and a Norwegian managed service provider.
APT31 allegedly began a cyberespionage and transnational-repression campaign operated through the PRC Ministry of State Security's Hubei State Security Department. The campaign allegedly targeted critics of China, government and political personnel, dissidents, and strategically significant businesses.
The UK government and National Cyber Security Centre publicly held China state-affiliated organizations and individuals responsible for malicious cyber activity targeting UK democratic institutions and parliamentarians.
The U.S. Treasury imposed sanctions on two of the charged defendants, while the State Department announced a Reward for Justice offer of up to $10 million for information about the defendants, APT31, and associated entities.
The U.S. Department of Justice unsealed an indictment charging seven PRC nationals alleged to be APT31 members with conspiracy to commit computer intrusions and wire fraud. The indictment alleges the group sent more than 10,000 malicious emails and compromised or potentially compromised victim networks, accounts, devices, and telephone-call records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcegov.uk
Open sourcencsc.gov.uk
Open sourcehome.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice charged seven international defendants, including five alleged members of **APT41**, over computer intrusion campaigns that hit more than 100 victims worldwide. Prosecutors said the group targeted universities, software developers, telecommunications providers, social media companies, video game firms, nonprofits, and foreign governments, stealing source code, customer account data, and personally identifiable information while pursuing both **espionage** and **financial gain**. The indictments describe activity ranging from supply-chain compromises and credential theft to fraud involving in-game currency and other monetization schemes. Reporting tied the charged activity to broader APT41 operations, including **ColdLock** ransomware attacks against Taiwanese organizations, especially in the energy sector. In those intrusions, attackers were observed using **Active Directory Group Policy**, scheduled tasks, **SMB**, **PowerShell**, customized loaders, and **Cobalt Strike** to move laterally and deploy ransomware. Trend Micro said related activity also affected energy, retail, and telecommunications organizations in Southeast Asia, with infrastructure overlaps and targeting patterns suggesting links between criminal operations and Chinese state-aligned espionage.
Aug 14, 2026
The China-linked advanced persistent threat group APT31 conducted a prolonged cyber espionage campaign against Russian IT companies, particularly those serving government agencies, from at least late 2022 through 2025. The attackers leveraged legitimate Russian cloud services, such as Yandex Cloud, for command-and-control and data exfiltration, blending their malicious traffic with normal network activity to evade detection. They also staged encrypted payloads and commands on social media profiles and timed their operations to coincide with weekends and holidays, when staffing was minimal. In several cases, APT31 maintained undetected access to victim networks for extended periods, with activity surging during the 2023 New Year holidays and continuing into 2024 and 2025. The campaign focused on intelligence gathering to benefit Chinese state interests, targeting contractors and integrators working with Russian government agencies. Technical analysis by Positive Technologies and corroborated by other security firms revealed that APT31 used a combination of publicly available tools and custom malware, routing commands through popular web platforms to further mask their activity. The group’s operations against Russia are notable given the countries' strategic partnership and the rarity of public reporting on Chinese cyber activity targeting Russian entities. The campaign highlights the increasing sophistication of APT31’s tradecraft, including the use of cloud infrastructure and social media for stealthy command-and-control, as well as the geopolitical implications of Chinese cyber espionage against Russian technology firms involved in sensitive government projects.
Jun 29, 2026
The FBI said it remotely removed **PlugX malware** from more than **4,200 U.S. computers** after obtaining court authorization to dismantle infrastructure tied to a long-running Chinese cyber campaign. The malware, commonly associated with Chinese state-backed operators, had infected mostly small office and home office devices, and the bureau deleted the malicious files without collecting personal data from victims. Reporting put the total at **4,258 systems**, underscoring the scale of the cleanup operation against a botnet that had quietly persisted on U.S. networks. U.S. authorities later expanded the crackdown by unsealing charges against **12 Chinese nationals** and seizing domains linked to a broader espionage and hacker-for-hire ecosystem associated with **Silk Typhoon** (also tracked as **APT27** and formerly **Hafnium**). Prosecutors alleged that China’s security services used contractors, including **i-Soon**, to hack U.S. government agencies and other prominent targets, charging state customers roughly **$10,000 to $75,000 per compromised email inbox** and tying the activity to intrusions spanning more than a decade, including the **U.S. Treasury** breach. Italian authorities subsequently arrested an alleged Silk Typhoon-linked suspect wanted over cyberespionage tied to COVID-19 vaccine research.
Jun 29, 2026