China's State-Sponsored Exploitation of Zero-Day Vulnerabilities in East Asia

Executive Summary

Chinese state-sponsored cyber actors have intensified their exploitation of zero-day vulnerabilities in East Asia, focusing on critical infrastructure and enterprise technologies. This trend underscores a strategic shift towards leveraging unpatched exploits for cyber espionage and potential cyber warfare operations.

Introduction

Zero-day vulnerabilities—flaws in software or hardware that are unknown to the vendor and lack a patch—have become a focal point for cyber actors seeking unauthorized access to systems. In East Asia, Chinese state-sponsored groups have been particularly active in identifying and weaponizing these vulnerabilities to achieve strategic objectives.

Exploitation of Zero-Day Vulnerabilities

In 2025, the Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in the wild, with Chinese state-sponsored groups being the most prolific users. These groups have demonstrated a detailed understanding of vulnerable devices, particularly targeting networking and security tools, including edge devices that often lack robust endpoint detection and response capabilities. (therecord.media)

Notable Chinese State-Sponsored Groups

• Volt Typhoon: An advanced persistent threat (APT) group operated by the Chinese government, active since at least mid-2021. Volt Typhoon primarily targets U.S. critical infrastructure, focusing on espionage, data theft, and credential access. (en.wikipedia.org)

• UNC3886: Affiliated with the People's Republic of China, this APT group has been active since at least late 2021, targeting critical infrastructure globally. Notably, in mid-2024, UNC3886 compromised end-of-life Juniper MX routers, highlighting their ability to tailor malware for embedded network devices. (en.wikipedia.org)

Exploit Broker Transactions

The acquisition and sale of zero-day exploits have become a significant aspect of cyber operations. Chinese state-sponsored groups often procure these exploits through exploit brokers to enhance their cyber capabilities. For instance, in 2025, a Chinese-linked group known as Tick exploited a zero-day vulnerability in Motex Lanscope Endpoint Manager (CVE-2025-61932) to hijack corporate systems, demonstrating the group's focus on targeting enterprise technologies. (thehackernews.com)

Implications for East Asia

The increased exploitation of zero-day vulnerabilities by Chinese state-sponsored actors poses significant risks to East Asian nations. Critical infrastructure sectors, including energy, telecommunications, and finance, are particularly vulnerable to such sophisticated cyber attacks. The ability to exploit unpatched vulnerabilities allows these actors to maintain persistent access to targeted systems, facilitating long-term espionage and potential sabotage operations.

Conclusion

The strategic use of zero-day vulnerabilities by Chinese state-sponsored cyber actors in East Asia represents a growing threat to regional cybersecurity. It is imperative for organizations to implement robust security measures, including regular patching protocols and advanced threat detection systems, to mitigate the risks associated with such sophisticated cyber threats.

Highlights:

• China, Not Iran, The Biggest Zero-Day Cyber Threat, Published on Saturday, March 07
• Chinese hackers are now using this tactic for spying - India Today, Published on Sunday, April 28
• China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems, Published on Thursday, October 30