Trellix Reports 41.4% Drop in Detected Chinese Nation-State Cyber Activity

Trellix reported a 41.4% decline in detected Chinese nation-state threat activity from April through September 2026, although Chinese-aligned detections remained substantially higher than those attributed to Russia and Iran. Researchers cautioned that the decline could reflect shifting intelligence priorities, targeting, infrastructure or detection visibility rather than fewer operations. Detection trends broadly coincided with Chinese military and maritime activity around Taiwan, but did not establish a causal relationship.

Across all nation-state detections, the United States accounted for 38% and Turkey for 37.1%, while transportation, shipping and telecommunications together represented more than half of detected campaign volume. Gamaredon, APT36 and Mustang Panda were the most prevalent groups; the top 10 groups accounted for 56% of activity. Backdoors were the most frequently detected malware category, with infostealers also prominent. The findings underscore that lower detection counts alone do not justify reducing defensive vigilance, particularly in heavily targeted sectors.