China's Cyber Espionage in East Asia: A Critical Threat Assessment

Executive Summary

China's state-sponsored cyber espionage activities in East Asia have intensified, targeting diplomatic entities, supply chains, and critical infrastructure. These operations aim to gather sensitive information, disrupt adversaries, and gain strategic advantages, posing a critical threat to regional security.

Introduction

As of April 2026, China's cyber espionage operations have evolved in sophistication and scale, focusing on long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting. These activities are primarily conducted by advanced persistent threat (APT) groups such as Volt Typhoon and Salt Typhoon, both attributed to China's Ministry of State Security (MSS).

Long-Term Espionage Implants

Volt Typhoon, active since at least mid-2021, has been targeting critical infrastructure in the United States, including telecommunications and energy sectors. The group's operations are designed to maintain persistent access, enabling data theft and potential sabotage during geopolitical tensions. Their tactics involve stealthy malware deployment and living-off-the-land techniques to evade detection. (en.wikipedia.org)

Supply Chain Compromise for Intelligence Collection

Salt Typhoon has been implicated in compromising supply chains to infiltrate target networks. In 2024, the group breached U.S. internet service providers, facilitating access to sensitive communications and data. This approach underscores China's strategic focus on exploiting trust relationships within supply chains to gain intelligence. (en.wikipedia.org)

SIGINT-Linked Intrusions

China's cyber operations have increasingly targeted signals intelligence (SIGINT) capabilities. By infiltrating communication networks, Chinese APT groups aim to intercept and analyze electronic signals, including voice and data communications, to gather strategic and tactical intelligence. This SIGINT focus enhances China's ability to monitor adversaries and inform military and diplomatic decisions. (marketresearch.com)

Diplomatic Targeting

Chinese cyber actors have also targeted diplomatic entities to gather sensitive information. In 2024, the APT group MirrorFace, aligned with Chinese interests, targeted a diplomatic organization within the European Union, marking a significant expansion in China's cyber espionage activities. (eset.com) Additionally, in 2025, Chinese cyber actors targeted Southeast Asian diplomats, demonstrating a refined use of social engineering and thematic deception techniques to penetrate diplomatic networks. (securitybrief.com.au)

Conclusion

China's state-sponsored cyber espionage operations in East Asia are multifaceted and pose a critical threat to regional security. The focus on long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting reflects a strategic approach to intelligence collection and influence. Ongoing vigilance and enhanced cybersecurity measures are essential to mitigate these threats and protect sensitive information.

Highlights:

• Volt Typhoon
• Salt Typhoon
• ESET releases latest APT report: China-aligned groups expand targeting; Iran advances diplomatic espionage | | ESET, Published on Wednesday, November 06