Loading story…
Orange Cyberdefense mapped more than 300 entities and 400 relationships in a Chinese ecosystem linking state agencies, private cybersecurity companies, universities and hacking competitions to offensive cyber operations and espionage. Its Hidden Network Report, with a research cutoff of October 22, 2024, highlights the roles of the People’s Liberation Army (PLA) and Ministry of State Security. The February 2024 i-SOON leak exposed extensive government contracting, while academic partnerships and competitions supply research, recruits and exploitable vulnerabilities. Private contractors expand operational capacity and provide plausible deniability, although fragmented subcontracting creates operational-security risks.
The report identifies interconnected vulnerability databases and mandatory disclosure requirements as mechanisms that give Chinese authorities access to newly discovered flaws, potentially enabling exploitation before remediation. Separate Jamestown Foundation reporting covers the PLA’s command reorganization and elimination of its Strategic Support Force, highlighting changes to the military structure alongside the broader contractor ecosystem. For security leaders, the findings reinforce the importance of rapid vulnerability remediation, monitoring for exploitation before patches become available, and assessing Chinese cyber threats beyond individual named groups to include their state, commercial and academic connections.
TTPs, infrastructure, and targeting history in one profile.
12 events from the most recent confirmed update back to the earliest known activity.
The PLA underwent a reorganization involving the Information Support Force and Cyberspace Force. Orange Cyberdefense noted uncertainty about the division of responsibilities between the forces.
The February 2024 Sichuan i-SOON leak exposed contracts and communications documenting the company's longstanding role as an MSS contractor. The records described cyber campaigns against targets in more than 70 countries, including France, Rwanda, and Nepal.
Microsoft Exchange vulnerability CVE-2021-42321 was exploited in the wild days after its demonstration at the 2021 Tianfu Cup.
China's 2021 Regulations on the Management of Network Product Security Vulnerabilities required researchers to consult MIIT before public or vendor disclosure and routed vulnerabilities into an MIIT-managed sharing platform.
Beginning in 2003, Chinese authorities recruited civilian hackers into the PLA, MSS, and MPS through competitions, hacker-forum job advertisements, and freelance participation in offensive operations.
The report describes a competition that tasked participants with infiltrating the networks of U.S. Department of Defense contractor VAE Inc., in its discussion of the TOPSEC Cup co-organized by Beijing Topsec and Southeast University.
Leaked i-SOON records indicated that vulnerabilities identified during the 2021 Tianfu Cup were transferred to the MPS. The source does not specify when the transfer occurred.
The report states that Zhao Qixun's Chaos exploit was shared with Chinese state agencies and subsequently used in targeted attacks against Uyghurs before patches were released.
According to Adam Kozy's reporting cited in the report, KRYPTONITE PANDA exploited Microsoft Office vulnerability CVE-2018-0802 a month before Qihoo360 disclosed it to Microsoft.
Chengdu 404, a company linked to APT41, sued i-SOON over intellectual-property violations.
i-SOON obtained a vulnerability affecting the QQ messaging platform from competitor NoSugarTech for use in an intrusion campaign.
During the 2015–2016 reforms, the PLA created the Strategic Support Force. Its Network Systems Department absorbed cyberespionage responsibilities and operational units from the former Third and Fourth Departments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
jamestown.org
Open sourceresearch.cert.orangecyberdefense.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026
Anthropic has uncovered a real-world cyber espionage campaign orchestrated by a Chinese state-sponsored group, leveraging AI to automate and accelerate the attack lifecycle. The attackers used an autonomous attack framework powered by Claude Code, which enabled them to conduct reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration with minimal human intervention. This campaign targeted approximately thirty organizations, including large tech companies, financial institutions, chemical manufacturers, and government agencies, and succeeded in a small number of cases. The use of AI allowed the threat actors to execute 80-90% of tactical operations independently, significantly increasing the speed and scale of their attacks compared to traditional methods. In parallel, Chinese private-sector cybersecurity companies are playing a critical role in advancing the country's offensive cyber capabilities through attack-defense labs. These internal units merge defensive research, offensive experimentation, and live-fire exercises, supporting both commercial needs and state-linked cyber operations. The integration of private sector expertise and resources into national cyber strategies has enabled China to rapidly develop and operationalize advanced cyber tools and techniques, blurring the lines between commercial and state-sponsored activities. Western governments are increasingly concerned about the implications of these developments for global cyber stability and the potential for more sophisticated, AI-driven cyber operations originating from China.
Jun 29, 2026
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026