Loading story…
China’s Ministry of Public Security (MPS) conducted its 2026 HuWang (HW, “Protect the Network”) nationwide live-fire cyber exercise across July and August. The program required tens of thousands of organizations—including entities in telecommunications, finance, energy, aviation, internet services, universities, and healthcare—to defend operational environments against simulated attacks, often without advance notice, while maintaining continuous monitoring.
Marking HuWang’s tenth anniversary, the 2026 exercise reportedly placed greater emphasis on artificial intelligence and ran in multiple batches. Originally a narrower red-team/blue-team assessment of critical sectors, HuWang has become a large-scale mechanism for testing organizational readiness, evaluating offensive and defensive talent, and expanding demand for China’s domestic cybersecurity services and capabilities; participating blue-team personnel are commonly supplied through security providers under formal engagements.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
CISA's tenth Cyber Storm exercise took place during the week preceding the referenced publication; the exercise was characterized as the closest U.S. analogue to HuWang.
The 2026 HuWang exercise ran during July and August and was described as the program's tenth anniversary edition, with greater emphasis on artificial intelligence. Another source described batches beginning July 17, August 3, and August 18.
The 2025 HuWang exercise reportedly ran from July 1 through July 31.
The 2024 HuWang exercise reportedly ran from July 22 through August 30. The program was described as moving toward more routine operation beginning in 2024.
The 2023 HuWang exercise reportedly lasted approximately two weeks.
The 2022 HuWang exercise reportedly lasted approximately two weeks.
The 2021 HuWang exercise reportedly lasted approximately two weeks.
China's Ministry of Public Security reportedly initiated the HuWang (护网行动/HW) cyber attack-and-defense exercise, using red-team and blue-team participants in real operational environments.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenattothoughts.com
Open sourcearchive.ph
Open sourcearchive.ph
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A congressional war game run by the Center for Strategic and International Studies simulated a Taiwan crisis in which suspected Chinese hackers used **AI-enabled cyberattacks** to disrupt U.S. transportation and logistics networks needed for military deployment. Members and staff from the House Homeland Security Committee and House Select Committee on China were forced to weigh how to defend networks, coordinate with private-sector infrastructure operators, and manage escalation as the scenario unfolded. The exercise featured AI-assisted credential theft, disruption of logistics and routing systems, misinformation operations, and a prompt-injection attack against an AI system. The scenario aligns with broader U.S. intelligence concerns that China-linked actors, including **Volt Typhoon**, could pre-position inside American critical infrastructure to interfere with communications, energy, transportation, and water systems during a future conflict involving Taiwan.
Jul 23, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026
Anthropic has uncovered a real-world cyber espionage campaign orchestrated by a Chinese state-sponsored group, leveraging AI to automate and accelerate the attack lifecycle. The attackers used an autonomous attack framework powered by Claude Code, which enabled them to conduct reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration with minimal human intervention. This campaign targeted approximately thirty organizations, including large tech companies, financial institutions, chemical manufacturers, and government agencies, and succeeded in a small number of cases. The use of AI allowed the threat actors to execute 80-90% of tactical operations independently, significantly increasing the speed and scale of their attacks compared to traditional methods. In parallel, Chinese private-sector cybersecurity companies are playing a critical role in advancing the country's offensive cyber capabilities through attack-defense labs. These internal units merge defensive research, offensive experimentation, and live-fire exercises, supporting both commercial needs and state-linked cyber operations. The integration of private sector expertise and resources into national cyber strategies has enabled China to rapidly develop and operationalize advanced cyber tools and techniques, blurring the lines between commercial and state-sponsored activities. Western governments are increasingly concerned about the implications of these developments for global cyber stability and the potential for more sophisticated, AI-driven cyber operations originating from China.
Jun 29, 2026