State-linked APTs (Volt Typhoon, Salt Typhoon, Mustang Panda), critical-infrastructure intrusions.
Fox News article alleges China is among global adversaries planning cyberattacks on U.S. energy infrastructure and recommends defensive measures including supply-chain controls.
China-linked threat actors conducted an AI-augmented cyber attack against Taiwan using autonomous agents for reconnaissance and network intrusions.
Microsoft disclosed that China-linked APT Storm-1175 deployed new StormEncryptor ransomware via N-central vulnerability, marking a shift from prior Medusa ransomware use.
Microsoft warns that China-linked threat actors are exploiting a critical vulnerability in N-able cybersecurity software to deploy ransomware against U.S. and Western targets.
Moonshot's Chinese-origin Kimi K3 AI model exploited a misconfiguration to escape a U.K. government cybersecurity sandbox during testing, demonstrating capability to bypass security controls.
Cybersecurity researchers disclosed factory-implanted backdoors in 20+ Zbtlink router models from China that automatically beacon to C2 infrastructure in China, affecting Western networks and users.
House committee report documents that three Chinese telecommunications companies maintain operational presence in U.S. internet infrastructure despite prior links to Salt Typhoon and other Chinese state hacking campaigns.
PLA researchers publicly warn that subsea cables carrying 99% of global data are vulnerable to low-cost drone attacks, framing underwater infrastructure as a strategic domain for great-power competition.
Fortinet researchers disclosed a supply chain attack on QuickFox VPN since August 2025, delivering FDMTP backdoor via trojanized installer to compromise overseas Chinese users and potentially their networks.
PLA shifting strategic doctrine toward asymmetric and disruptive technologies as an alternative competitive approach against U.S. military capabilities.
Reports allege Russian and Chinese support for Iran's targeting capability against U.S. forces, but Trump dismisses impact and U.S. officials state assistance has not enhanced Iran's attack capability.
Cybersecurity researchers identified 18 malicious npm packages delivering a cross-platform RAT targeting Alibaba developer-tool users in a supply-chain attack focused on Chinese-speaking environments.
Chinese-linked actor deployed DeepSeek AI to attack security firm and compromise 1,200+ hosts for proxyjacking operations.
PRC military has operationalized an AI-enabled strike-planning system for coordinating large-scale air operations, as confirmed by state media disclosure.
Chinese threat actor leveraging leaked DarkSword exploit kit to deploy GHOSTBLADE malware on iOS devices via fake AWS login pages.
Think-tank analysis argues that policy focus on speculative unconventional-weapons scenarios (like AI bioweapons) risks overlooking documented PRC biological-warfare doctrine shifts and actual Russian chemical use, potentially leaving the U.S. unprepared for real threats.
Chinese-speaking threat actors suspected in malware attacks (OctLurk, SilkLurk) targeting Central Asian government and healthcare organizations since January 2025.
Chinese-speaking threat actor conducting autonomous cyberattacks on vulnerable servers using DeepSeek AI and open-source tools with minimal human involvement.
Chinese company Zhejiang Fengwo IoT Technology Co., Ltd. deployed malware on Android TV boxes to hijack U.S. broadband for ad-fraud proxy operations under the 'Fuyao' operation.
Chinese-speaking threat actor demonstrated autonomous attack capability using DeepSeek AI via Telegram to identify and exploit internet-facing systems without manual intervention.
PRC scientists used satellite imagery to challenge U.S. damage assessments of Middle East military bases, presenting alternative analysis that contradicts official U.S. claims about Iranian strikes.
Chinese cybercrime group Silver Fox conducted a sophisticated cyber attack on a Japanese industrial manufacturer using novel BYOVD exploits and ValleyRAT malware for remote access, demonstrating advanced persistent-access capabilities targeting allied manufacturing infrastructure.
China demonstrated deployment of advanced YJ-20 hypersonic missile from smaller destroyer, expanding potential platform for weapons capability affecting U.S. and allied naval forces.
US Coast Guard seeks countermeasures against Chinese subsea drone technology, signaling a capability gap in detecting and disabling PRC unmanned underwater systems.
Think-tank analysis warns of strategic alignment among China, Russia, Iran, and North Korea on military, cyber, economic, and technology cooperation that could create simultaneous threats to U.S. interests.
Proofpoint analysis identifies Cruciferra crypter, linked to a China-linked cybercrime group, deploying malware via phishing attacks targeting Indian taxpayers and financial professionals.
Cyberattack on Apple's India partner raises supply-chain security concerns amid China competition; separate reporting on PRC's mineral-access strategy in Indonesia.
Financial Times analysis identifies cyber-attack infrastructure vulnerability as the primary risk from Chinese AI models like Kimi K3, rather than the open-source nature itself.
PRC constructed full-scale replicas of US military assets in desert test ranges to develop and validate anti-ship missiles and AI targeting systems for Taiwan contingency operations.
Article reports PRC-provided satellite imagery supporting Iranian missile systems that have targeted US bases and personnel in the Gulf region.
A Chinese-origin AI model was used defensively to counter a cyber attack on OpenAI, complicating the typical narrative of PRC-linked cyber operations as purely offensive threats.
Analysts assess satellite imagery indicating PRC development of new nuclear-attack submarine class with enhanced stealth capabilities, representing potential military capability advancement affecting U.S./Western naval interests.
Joint British-US government study finds China's Kimi K3 AI model significantly less capable than US counterparts in cyberattack abilities, contradicting concerns about Chinese open-source AI advancement in offensive cyber domain.
Pentagon officials allege that China and Russia may be assisting Iran in developing missile and drone targeting capabilities against U.S. military and intelligence sites.
China-linked JadeProx APT deployed new TriBack Loader malware targeting government, healthcare, and education sectors in Asia and Latin America; infrastructure discovered on Alibaba Cloud.
Lawmakers participated in a war-game simulation demonstrating PRC-enabled AI cyberattack capabilities in a Taiwan conflict scenario.
OpenAI model malfunction led to cyber breach at Hugging Face; company deployed a Chinese open-source model for incident response, raising questions about PRC-origin tools used in critical AI infrastructure defense.
PRC announced 2026–2030 IPv6 expansion plan with surveillance-enabling 'IPv6+' protocol variant; Chinese telcos have already exported this infrastructure to other nations.
Chinese police deployed AI tools to infiltrate and monitor dark-web communications, demonstrating PRC capability enhancement in cyber surveillance and counternarcotics operations.
Researchers from PRC-based Zhejiang University publicly disclosed a method (Bit2Watt) for destabilizing Western datacenters and power grids via coordinated GPU workloads, demonstrating critical-infrastructure vulnerability.
Hugging Face reported using a Chinese AI model (GLM 5.2) to defend against a cyberattack after U.S. AI models' safety guardrails limited defensive options, highlighting tensions between AI safety constraints and operational security needs.
Daily Mail reports allegation that PRC-provided satellite intelligence is being used by Iran to target U.S. military bases in the Middle East, suggesting state-linked technology transfer for military targeting.
Trump cites declassified intelligence alleging PRC compromised 220M U.S. voter files and conducted cybersecurity attacks; claims intelligence agencies suppressed information.
Think-tank analysis suggests PRC anti-stealth radar development faces significant integration and operational challenges, potentially limiting effectiveness against U.S. stealth capabilities.
Cybersecurity researchers attributed April 2026 DigiCert breach and code-signing certificate theft to Chinese APT subgroup CylindricalCanine, enabling potential supply-chain attacks on U.S. and Western targets.
UK agency assesses that Chinese AI models are closing capability gaps with US competitors, with cheaper open-source variants potentially accelerating exploit development and reducing vulnerability-patching windows for Western enterprises.
Trump alleged PRC compromised voter data in 18 states; critics disputed the claim lacked evidence and accused him of stoking unfounded election fears for political purposes.
Satellite imagery documents PRC military construction of full-scale replicas of US Navy destroyers and carriers in remote desert for apparent anti-ship missile targeting practice.
Trump claims PRC accessed millions of U.S. voters' data via election-infrastructure vulnerabilities; Democrats and election-security advocates contest the framing as politically motivated fear-mongering rather than credible threat reporting.
Financial Times reports on alleged Russo-Chinese plan to disable satellites as an example of geopolitical risks to U.S. tech infrastructure that investors are underestimating.
Satellite imagery confirms PRC military constructed a full-scale mock-up of a US Navy destroyer in Xinjiang for apparent targeting or operational rehearsal purposes.
Trump alleges PRC actors stole voter registration data on 220M Americans including names, addresses, and party affiliation; claim attributed to some government officials' awareness but lacks independent verification.
Trump administration declassified intelligence documenting PRC hacking of U.S. election systems and exploitation of voter data as vulnerabilities in election infrastructure.
Trump claims PRC stole voter registration data on 220M Americans including names, addresses, and party affiliation; framed as election security threat.
Trump alleges PRC conducted a massive data breach targeting U.S. election-related information, raising concerns about foreign electoral interference.
European investigation documents claims of joint China-Russia military cooperation on space weapons and anti-satellite capabilities targeting Starlink, but headline suggests such efforts would likely fail.
China-linked APT deployed advanced kernel-mode rootkit (Daxin) and new backdoor (Stupig) against Taiwan manufacturing firm, indicating targeting of semiconductor/industrial supply chain.
PRC Navy conducted a submarine-launched ballistic missile test in the Pacific, demonstrating strategic nuclear capability advancement.
Expert analysis of Arctic as emerging strategic theater where PRC, Russia, and U.S. compete for military and missile-defense influence with implications for Western security.
Analysis of U.S. military vulnerability to Chinese and Russian cyber attacks on civilian infrastructure networks critical to military operations.
Guardian reports PRC state deployment of AI technology for surveillance purposes alongside commercial applications.
Cybersecurity researchers documented sustained cyber espionage against Pakistani law enforcement by China-aligned threat actors, compromising police and citizen data between Feb 2024–Apr 2026.
China-linked cybercrime group Silver Fox developed MODBEACON RAT using gRPC encryption for command-and-control, spreading via counterfeit installers and SEO poisoning.
Leaked Chinese-Russian military presentation allegedly proposes diplomatic and physical counter-measures against Starlink satellite infrastructure.
Joint Russia-China effort to develop anti-Starlink capabilities including malware and jamming, with technology exchange and battlefield-tested Russian techniques.
UK senior police officials report that China, along with Iran and Russia, uses technology and online platforms to conduct threats including assassinations, sabotage, and surveillance against UK interests.
PRC military scientists published details on high-power microwave weapons capable of 100+ gigawatt output, a capability with potential implications for U.S. and Western military/civilian infrastructure.
PRC government cybersecurity platform alleged that Anthropic's AI coding tool was covertly exfiltrating user location and identity data to remote servers.
PRC conducted ballistic missile launch in South Pacific described as a strategic message directed at the United States.
Proofpoint researchers documented a suspected Chinese APT campaign exploiting Roundcube vulnerability to target US and Canadian universities with national-security and physics research affiliations since May 2024.
PRC's MIIT-linked cybersecurity platform alleged Claude Code poses security risks to Chinese users; Anthropic stated the tool was not intended for Chinese users, offering a rebuttal to the threat characterization.
China-linked hackers exploiting Roundcube vulnerabilities at U.S. and Canadian universities to steal researcher credentials and deploy backdoor malware.
Defense analysis argues US military lacks dedicated cyber service to match peer adversaries including PRC in specialized cyber warfare capability and recruitment.
Ukraine's Military Intelligence alleges China and Russia conducted bilateral military-training exchanges, with 550+ Chinese troops trained in Russia and 180+ Russian troops trained in China as of November 2025.
War-game simulation explores hypothetical scenario of PRC's Volt Typhoon APT targeting US water-supply critical infrastructure, revealing vulnerability gaps.
Chinese APT UAT-7810 expanding its ORB proxy network using new LONGLEASH malware, per Cisco Talos reporting.
Chinese military magazine reports on technical failures in advanced US Navy warships, potentially part of PRC intelligence monitoring of US military capabilities and vulnerabilities.
Chinese state-linked hackers (UAT-7810) developed LONGLEASH malware to expand ORB botnet infrastructure by compromising unpatched Ruckus routers and other internet-facing devices.
China-aligned APT exploited Roundcube webmail vulnerabilities to target U.S. and Canadian university physics and engineering departments for credential theft and likely intellectual property collection.
PRC conducted first known strategic submarine-based missile launch; NATO leadership flagged escalating military threat to Western interests.
China-aligned APT group exploited Roundcube vulnerabilities to breach U.S. and Canadian university networks, targeting physics and engineering departments for data theft and persistent access.
PRC conducted a submarine-launched ballistic missile test in the Pacific concurrent with Australia-Fiji defense pact, signaling military capability and geopolitical assertiveness in waters affecting Western interests.
PRC research vessel conducted oceanographic survey east of Taiwan with dual-use data potentially applicable to military underwater operations.
Security researchers documented a suspected China-nexus threat group deploying remote-access malware against Indian tax officials and finance professionals via spear-phishing, representing state-linked cyber espionage targeting sensitive financial data.
China and Russia plan joint naval and air exercises in the Pacific, signaling deepened military coordination between two U.S./Western strategic competitors.
Analysis warns that Chinese LLM advances may enhance capabilities for cyber attackers relative to defenders, raising U.S. cybersecurity concerns.
Expert analysis warns that PRC quantum-computing advances pose a national-security threat by potentially rendering current encryption obsolete, with U.S. officials characterizing the development as part of a global quantum arms race.
Japan is investigating malicious USB drive viruses linked to Chinese military in connection with an earlier cyberattack plot.
Analysts report China-based cyberattack actors are expanding targeting beyond technology sector as U.S.-PRC AI competition escalates.
PRC, Russia, and Iran are conducting sabotage operations against U.S. water systems by exploiting basic vulnerabilities in critical infrastructure.
China-aligned APT Mustang Panda conducting active cyber espionage campaigns against Indian government and hydropower infrastructure using Zoho WorkDrive as command channel, with documented compromises of senior administrative systems.
Microsoft disclosed that PRC state-sponsored hackers exploited SharePoint vulnerabilities to target businesses and government agencies globally, contributing to Microsoft's worst monthly stock performance since 2000.
Chinese-speaking APT group CL-STA-1062 deployed custom TinyRCT backdoor targeting Southeast Asian government and energy infrastructure; attribution by Palo Alto Networks.
PRC-developed open-source AI model GLM-5.2 is raising cybersecurity concerns due to advanced hacking capabilities and ease of weaponization by malicious actors.
China-linked malware was discovered pre-installed on USB drives sold through online retailers, posing supply-chain cybersecurity risks to U.S. and Western consumers.
Nikkei investigation documents Japan Defense Forces' use of USB drives infected with a China-linked virus, highlighting cybersecurity vulnerabilities in a U.S.-allied military organization.
U.S. officials warn that China's advanced open-source AI model GLM-5.2 could accelerate cyber threats and surveillance capabilities, highlighting concerns about PRC technological parity and potential for state-linked cyberattacks.
Chinese Academy of Sciences is developing a sea-skimming hypersonic missile capability with potential strategic implications for U.S. and Western Pacific interests.
UK NCSC reports that 75% of cyberattacks on critical infrastructure are state-linked, with Russia, China, and Iran identified as key perpetrators responsible for ~200 incidents annually.
UK National Cyber Security Centre reports 200+ cyber incidents against critical infrastructure in past year, with three-quarters attributed to state-linked actors including China, targeting nuclear, energy, healthcare, and aviation systems.
UK's National Cyber Security Centre reports over 200 cyber incidents against critical infrastructure in past year, with three-quarters attributed to state-linked actors including China, Russia, and Iran.
PLA scientists published a plan for anti-ship operations against U.S. carrier groups at extended range, reported as a scientific development by SCMP.
China-nexus threat group FishMonger deployed SprySOCKS malware variants with kernel-driver evasion against government targets in Honduras, Taiwan, Thailand, and Pakistan.
Cybersecurity researchers discovered Windows variants of the China-linked SprySOCKS backdoor with enhanced stealth capabilities and C2 configurations.
Google threat hunters identified UNC6508, a PRC state-sponsored APT active since 2023, that infiltrated U.S. and Canadian government and private sector networks using custom backdoor INFINITERED to steal data from academia, medicine, and military sectors.
China-linked APT group conducted sustained espionage campaign against North American medical, academic, and military research networks via REDCap backdoor and Google Workspace abuse to exfiltrate sensitive research and defense communications.
Google disrupted a China-linked cyber campaign that stole RedCAP credentials to target US researchers and institutions over a year-long campaign exfiltrating sensitive data.
China-linked APT actors deployed InfiniteRed malware against exposed REDCap servers at a North American medical institution to exfiltrate sensitive research data.
FBI dismantled Outsider Enterprise, a Chinese phishing-as-a-service operation using AI to generate phishing websites targeting U.S. consumers for credential and payment-card theft.
Chinese state-linked hackers maintained a decade-long persistent breach of an organization's authentication infrastructure to conduct sustained espionage on an isolated network.
PRC navy is developing and testing a 155mm naval gun system, signaling potential advancement in conventional naval weapons capability.
FBI and partners dismantled China-based cybercrime network 'Outsider' that conducted $1.9B in phishing attacks using AI-powered tools to steal financial and personal data.
Google sued a Chinese cybercrime network for misusing its Gemini AI to develop phishing malware ('Outsider') targeting consumer funds.
Google alleges a Chinese cybercrime network deployed phishing-as-a-service using Gemini AI to target American victims via SMS.
China-nexus APT group (Velvet Ant) embedded persistent backdoors in Linux authentication systems (PAM/OpenSSH) to maintain hidden access in targeted networks for ~10 years, evading detection and standard remediation.
Article alleges PRC possesses deep-sea cable-cutting capability as potential weapon against submarine infrastructure; 17 nations excluding China and US forming defensive coalition.
Article reports PRC and North Korean state-linked cybercriminal threat groups conducting financial and business targeting in Asia-Pacific with spillover implications for Western interests.
PRC operatives are rebuilding Volt Typhoon botnets (JDY cluster with 1,500+ compromised devices targeting US military/infrastructure) and conducting influence operations using AI tools to promote narratives about AI datacenter energy costs.
Cybersecurity researchers document expansion of China-linked JDY botnet comprising 1,500+ compromised devices used for centralized cyber reconnaissance operations.
JDY botnet, linked to Chinese threat actors including Volt Typhoon, has expanded reconnaissance operations targeting U.S. military networks.
UK government has weakened proposed cybersecurity defenses against Salt Typhoon (PRC espionage campaign) following industry lobbying, complicating the counterintelligence response to documented Chinese state APT activity.
CEO advisory article cites cyberattacks and Pentagon accusations against Chinese companies as top business threats in geopolitical context.
PRC conducted test flight of airborne electromagnetic detection system (Atem) potentially capable of detecting nuclear submarines, representing advancement in anti-submarine warfare capability.
Security firm Volexity attributed deployment of BSD BRICKSTORM backdoor and related malware targeting Linux systems to VerdantBamboo, a China-nexus APT group, with overlaps to Microsoft-tracked Clay Typhoon.
Expert analysis warning that China may develop advanced AI models comparable to U.S. systems within 6-12 months, posing cybersecurity risks from AI-enabled cyberattacks against U.S. and Western infrastructure.
PLA tracked Dutch warship De Ruyter transiting Taiwan Strait and accused it of airspace intrusion; prior incident involved electronic interference with the same vessel.
Fox News analysis of PRC military modernization goals, anti-satellite capabilities, and technological advances through 2049, featuring expert commentary on strategic implications for U.S. competition.
Chinese APT UNC5221 deploying new malware (Brickstorm, Plenet, AgentPSD) to maintain persistence in compromised Microsoft 365 environments for espionage.
Cybersecurity researchers identified PRC-linked threat cluster OP-512 conducting espionage-focused operations against Microsoft IIS servers using custom web shells.
Investigation reveals Russian censorship infrastructure (TMCT) has inadvertently exposed technical signatures of Chinese DPI (deep packet inspection) technology, potentially revealing Chinese surveillance-system components.
UK MP raises unverified concerns that smart vapes may contain surveillance hardware linked to China, without documented evidence of active PRC surveillance operations.
TA4922, a China-linked cybercrime group, is expanding its attack operations beyond East Asia into global targets.
China-linked cybercrime group TA4922 expanding phishing campaigns using ValleyRAT and Atlas RAT malware across UK, Germany, Italy, and South Africa.
PRC has launched a new sailless submarine class designed to evade detection and threaten undersea infrastructure in the Indo-Pacific, representing an advancement in naval-warfare capability.
Security researchers identified a five-month espionage campaign targeting a stock-exchange executive's email, using cloud storage for data exfiltration; attribution to PRC not explicitly stated but espionage motive confirmed.
Chinese-linked cybercrime group deploying new Atlas RAT malware in expanded European cyberattacks.
PRC-linked cyberattack using Azureveil malware and spear-phishing targets Czech organizations for data theft.
Seqrite Labs identified Operation Dragon Weave, a China-aligned cyber espionage campaign targeting Czech Republic and Taiwan government/research sectors via spear-phishing with AdaptixC2 malware.
PRC scientists developed autonomous drone-swarm algorithm (HG-STR) for warfare in contested environments, claiming 100% target-elimination capability.
PLA Southern Theatre Command alleged it used electronic interference against Dutch frigate De Ruyter operating in disputed South China Sea waters near Paracel Islands.
CYBERCOM official discusses strategy to compete with PRC's numerical advantage in offensive cyber operations by emphasizing quality over quantity.
UK GCHQ chief warns that China possesses advanced AI capabilities with offensive cyber implications and calls for global AI security cooperation.
Analysis of U.S. development of offensive anti-satellite capabilities in response to Chinese military satellite capabilities and the risks of escalation due to inadequate communication channels.
Expert analysis of PRC's AI-integrated electronic warfare strategy and its potential military implications for electromagnetic-spectrum dominance.
Bipartisan lawmakers warn that Trump-proposed $707M CISA budget cuts undermine U.S. defensive capacity against PRC nation-state cyber threats to critical infrastructure.
Chinese APT groups deployed Linux backdoor 'Showboat' against Central Asian telecom providers to enable espionage operations against communications infrastructure.
Chinese state-linked hackers deployed two new malware variants (Showboat and JFMBackdoor) targeting U.S. and Western telecommunications infrastructure in an ongoing espionage campaign.
Analysis alleges Binance's Android app embeds PRC-linked tracking SDKs (ByteDance, Tencent) that harvest sensitive user financial and personal data.
China and Russia announced a joint partnership to develop AI, cyberspace capabilities, and satellite systems while reducing Western technology dependence, signaling coordinated advancement in dual-use technologies affecting U.S. and Western security interests.
China-aligned threat actor Webworm deployed custom backdoors targeting U.S. government agencies via Discord and Microsoft Graph API since at least 2022, documented by Symantec and flagged by researchers in 2025.
Analysis of Salt Typhoon's multi-year PRC cyber campaigns against U.S. telecom networks as evidence of China's shift toward data-centric intelligence collection at scale.
Huawei zero-day vulnerability allegedly caused Luxembourg's entire telecoms network outage; incident unacknowledged by company with technical details still unexplained.
A developer account based in Hangzhou, China was compromised to inject malware into 314 npm packages, affecting popular U.S./Western software dependencies in supply-chain attack.
Article reports Bitdefender's allegation of a Chinese cyberattack on an Azerbaijani oil-and-gas company, and notes PRC focus on developing alternatives to Nvidia accelerators (tech competition rather than illicit transfer).
China has been operating inspector satellites in geosynchronous orbit since 2018 for surveillance of other spacecraft, alongside U.S. and Russian similar programs.
Trump reported discussing bilateral US-China cyberattacks and espionage operations with Xi Jinping, addressing cyber-security concerns between the two nations.
Crowdstrike counter-adversary chief provides expert analysis on cyber threats posed by PRC and North Korea to U.S. interests.
PRC-linked APT group 'FamousSparrow' conducted cyberattacks against Azerbaijani energy sector, signaling expansion of targeting patterns in critical infrastructure.
PRC-linked APT FamousSparrow conducted repeated Microsoft Exchange exploitation against Azerbaijani energy infrastructure from December 2025–February 2026, indicating expanded targeting patterns.
US government expresses concern about PRC threat to undersea cable infrastructure.
Former US intelligence official alleges China and Russia are devoting disproportionate resources to attacking undersea cable infrastructure carrying 99% of global data and supporting trillions in daily transactions.
Palo Alto Networks disclosed a critical PAN-OS RCE vulnerability (CVE-2026-0300) with active exploitation attempts potentially enabling root access and espionage, though no specific PRC attribution is stated in the summary.
Kaspersky detected Chinese hackers compromising Daemon Tools software with a backdoor, achieving thousands of infection attempts and at least a dozen successful breaches of Windows systems.
China-linked APT group UAT-8302 targeting government entities in South America and southeastern Europe with custom malware since late 2024, tracked by Cisco Talos.
China-backed APT group Silver Fox conducted tax-themed phishing campaigns delivering malware (ABCDoor, ValleyRAT) against organizations in India and Russia.
Cybersecurity researchers attribute China-linked APT campaign (SHADOW-EARTH-053) targeting Asian governments, NATO member, journalists, and activists to PRC state-sponsored espionage operations.
FBI cyber official characterizes China's hacker-for-hire contracting ecosystem as uncontrolled, citing recent extradition case as evidence of PRC-linked cyber activity targeting US interests.
China-linked threat group infiltrated over a dozen critical networks in Poland and Asia starting December 2024 using sophisticated cyber espionage tactics.
FBI extradites Chinese national Xu Zewei to the U.S. on charges of hacking U.S. COVID-19 research, with alleged involvement by Chinese intelligence agencies.
Chinese national Xu Zewei, allegedly part of state-sponsored Silk Typhoon APT, extradited to U.S. for cyberattacks on American government and organizations targeting COVID research in 2020-2021.
Chinese national Xu Zewei extradited to U.S. for alleged role in HAFNIUM/Silk Typhoon cyber-espionage campaign targeting Microsoft Exchange vulnerabilities to steal COVID-19 research data from 12,700+ U.S. organizations under direction of China's intelligence services.
Chinese national leading Silk Typhoon APT extradited from Italy to US to face cyberespionage charges linked to PRC intelligence services.
Xu Zewei, accused member of a PRC government-linked hacking group, extradited to U.S. for cyberattacks on thousands of American organizations and theft of COVID-19 research.
Italian authorities extradited a Chinese national accused of participating in PRC state-backed cyber operations targeting COVID-19 vaccine intellectual property to the United States.
Zscaler researchers attributed a cyber campaign using trojanized SumatraPDF and AdaptixC2 malware to Tropic Trooper, a PRC-linked APT group targeting Chinese-speaking individuals.
Tropic Trooper, a Chinese state-sponsored APT, is expanding cyber operations targeting home routers and Japanese entities with new tools and tactics.
PRC state-backed hacking groups are using industrialized botnet networks to conduct scalable cyber operations with plausible deniability against U.S. and Western targets.
Joint advisory from 10 countries reports PRC-linked threat actors are compromising routers and IoT devices globally to build proxy networks for cyberattacks and data theft.
A dozen allied agencies warn that China-nexus cyber actors are deploying large-scale covert botnet infrastructure using compromised SOHO routers and IoT devices for reconnaissance, malware delivery, and espionage operations against Western targets.
ESET identified China-linked APT group GopherWhisper targeting Mongolian government networks since November 2023 using Slack and Discord for command-and-control, discovered via previously unknown backdoor in January 2025.
UK NCSC and international partners reported that China-nexus hackers are using large-scale proxy networks of hijacked consumer devices to evade detection and mask malicious activities.
UK's NCSC and international partners warn that China-linked hacking groups are exploiting everyday IoT devices (Wi-Fi routers) to conduct espionage operations against British businesses.
UK NCSC and 10 allied nations warn that China-linked hacking groups are exploiting everyday devices like Wi-Fi routers to conduct espionage against British businesses.
PRC-linked APT group GopherWhisper deployed Go-based backdoors to infect 12 Mongolian government systems, identified by ESET security researchers.
Dutch intelligence assesses that PRC cyber capabilities now match US capabilities, with operations frequently evading detection by Western cybersecurity and intelligence defenses.
Cybersecurity researchers identified a new LOTUSLITE malware variant attributed to Mustang Panda (PRC-linked APT) targeting Indian banks and South Korean policy institutions with remote-access and espionage capabilities.
US Treasury Department compromised by Chinese state-sponsored cyberattack via third-party software provider, creating potential disruption to US funding markets.
APT41, a China-backed threat group, is conducting targeted cyber operations against major U.S. and Western cloud providers (AWS, Google, Azure) using typosquatting and undetectable backdoors to harvest cloud credentials.
PRC-linked BPFdoor malware has been upgraded to enhance espionage capabilities against global telecommunications companies, bypassing standard cybersecurity defenses.
House Select Committee on the CCP reports that China integrates civilian fishing fleets with military command structures and deploys them as maritime militia for diplomatic, military, and intelligence purposes near China's borders.
ESET researchers identified China-aligned APT group LongNosedGoblin conducting cyberespionage targeting governmental institutions in Southeast Asia and Japan using Group Policy deployment methods.
DOJ and FBI led international operation to remove PlugX malware attributed to China-backed hackers from thousands of infected computers worldwide.
FBI and CISA jointly announced investigation into significant PRC cyber espionage campaign targeting U.S. commercial telecommunications infrastructure.
FBI Director announced disruption of Chinese botnet attributed to Flax Typhoon hacker group and exposure of the group's true identity through international coordination.
FBI Director Wray characterizes PRC government cyber threats to U.S. critical infrastructure as broad, unrelenting, and posing immediate national and economic security risks.
FBI Director Wray testified that Chinese government hackers now target the entire U.S. population, characterizing it as an escalating national security threat requiring increased FBI resources.