Chinese state-sponsored hackers conduct global espionage by exploiting known vulnerabilities in telecom and government networks to steal sensitive data since at least 2021.

Cyber & Information WarfareUnknownUnknown

Aggressor

Summary

An international coalition of cybersecurity agencies has warned that Chinese state-sponsored hackers have been breaking into telecom, government, and infrastructure networks globally to conduct espionage. These advanced persistent threat actors exploit known vulnerabilities in routers and firewalls from vendors like Cisco, Ivanti, and Palo Alto to secretly capture communications, track targets, and maintain persistent hidden access since at least 2021. The stolen data includes intercepted communications, movement tracking, and administrator login credentials, feeding into Chinese intelligence services including the People's Liberation Army and the Ministry of State Security. The activities have been observed across the United States, Australia, Canada, New Zealand, the UK, Japan, Germany, and other countries. The report urges organizations, especially critical infrastructure, to patch vulnerabilities, strengthen encryption and authentication, disable unused services, and monitor network logs for indicators of espionage.

Classification

Confidence: High

The report details state-sponsored hacking by Chinese actors involving persistent covert intrusion into global telecommunications and government networks for espionage purposes, fitting established characteristics of hostile hybrid warfare cyber espionage.

Source URL

https://cadeproject.org/updates/global-agencies-warn-of-chinese-cyber-espionage-through-network-hacking

Open source

Provenance

Publisher: extension
Submitted: Feb 13, 2026, 19:25 UTC
Last updated: Nov 8, 2026, 20:46 UTC
Event time: Sep 2, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "5ec22c7e-8270-4303-90ce-47e882fee1c8",
  "url": "https://cadeproject.org/updates/global-agencies-warn-of-chinese-cyber-espionage-through-network-hacking",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Unknown",
  "incident_type": "Unknown",
  "country": "Unknown",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "China",
    "offensive cyber operations",
    "State-sponsored hackers",
    "Advanced Persistent Threat",
    "Telecommunications",
    "Critical Infrastructure",
    "NSA",
    "FBI",
    "National Cyber Security Centre"
  ],
  "nodes": [],
  "countries": [
    "Unknown"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "An international coalition of cybersecurity agencies has warned that Chinese state-sponsored hackers have been breaking into telecom, government, and infrastructure networks globally to conduct espionage. These advanced persistent threat actors exploit known vulnerabilities in routers and firewalls from vendors like Cisco, Ivanti, and Palo Alto to secretly capture communications, track targets, and maintain persistent hidden access since at least 2021. The stolen data includes intercepted communications, movement tracking, and administrator login credentials, feeding into Chinese intelligence services including the People's Liberation Army and the Ministry of State Security. The activities have been observed across the United States, Australia, Canada, New Zealand, the UK, Japan, Germany, and other countries. The report urges organizations, especially critical infrastructure, to patch vulnerabilities, strengthen encryption and authentication, disable unused services, and monitor network logs for indicators of espionage.",
  "summary_short": "Chinese state-sponsored hackers conduct global espionage by exploiting known vulnerabilities in telecom and government networks to steal sensitive data since at least 2021.",
  "summary_extended": null,
  "actor_primary": "Chinese state-sponsored hackers",
  "target_primary": null,
  "location_text": "Cyberspace",
  "location_region": "Cyberspace",
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The report details state-sponsored hacking by Chinese actors involving persistent covert intrusion into global telecommunications and government networks for espionage purposes, fitting established characteristics of hostile hybrid warfare cyber espionage.",
  "event_time_utc": "2025-09-02T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-13T19:25:08.716Z",
  "updated_at": "2026-11-08T20:46:49.922Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: UnknownLocation: Unknown

Source reliability

Info credibility

Event time

Sep 2, 2025, 00:00 UTC

Event time confidence

unknown

Location

Cyberspace

Region

Cyberspace

Primary actor

Chinese state-sponsored hackers

Country

Unknown

Countries

Unknown

Tags

China, offensive cyber operations, State-sponsored hackers, Advanced Persistent Threat, Telecommunications, Critical Infrastructure, NSA, FBI, National Cyber Security Centre

Loading signal...

{ "id": "5ec22c7e-8270-4303-90ce-47e882fee1c8", "url": "https://cadeproject.org/updates/global-agencies-warn-of-chinese-cyber-espionage-through-network-hacking", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Unknown", "incident_type": "Unknown", "country": "Unknown", "source_reliability": "C", "info_credibility": "3", "tags": [ "China", "offensive cyber operations", "State-sponsored hackers", "Advanced Persistent Threat", "Telecommunications", "Critical Infrastructure", "NSA", "FBI", "National Cyber Security Centre" ], "nodes": [], "countries": [ "Unknown" ], "where_text": "Cyberspace", "headline": null, "description": "An international coalition of cybersecurity agencies has warned that Chinese state-sponsored hackers have been breaking into telecom, government, and infrastructure networks globally to conduct espionage. These advanced persistent threat actors exploit known vulnerabilities in routers and firewalls from vendors like Cisco, Ivanti, and Palo Alto to secretly capture communications, track targets, and maintain persistent hidden access since at least 2021. The stolen data includes intercepted communications, movement tracking, and administrator login credentials, feeding into Chinese intelligence services including the People's Liberation Army and the Ministry of State Security. The activities have been observed across the United States, Australia, Canada, New Zealand, the UK, Japan, Germany, and other countries. The report urges organizations, especially critical infrastructure, to patch vulnerabilities, strengthen encryption and authentication, disable unused services, and monitor network logs for indicators of espionage.", "summary_short": "Chinese state-sponsored hackers conduct global espionage by exploiting known vulnerabilities in telecom and government networks to steal sensitive data since at least 2021.", "summary_extended": null, "actor_primary": "Chinese state-sponsored hackers", "target_primary": null, "location_text": "Cyberspace", "location_region": "Cyberspace", "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The report details state-sponsored hacking by Chinese actors involving persistent covert intrusion into global telecommunications and government networks for espionage purposes, fitting established characteristics of hostile hybrid warfare cyber espionage.", "event_time_utc": "2025-09-02T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-13T19:25:08.716Z", "updated_at": "2026-11-08T20:46:49.922Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }