Chinese Threat Actors: What Defenders Need to Know

On April 23, 2026, CISA and a coalition of international partners published an advisory detailing how Chinese state-sponsored threat actors operate. The report describes a clear shift away from individually procured infrastructure toward large, continuously refreshed networks of compromised SOHO routers, IoT devices, and end-of-life edge appliances. These distributed networks are used to route reconnaissance, deliver malware, maintain command-and-control, and conduct data exfiltration through geographically local exit nodes, making activity harder to detect and attribute.

The advisory stands as one of the clearest indicators that the Chinese cyber ecosystem has evolved into a sophisticated, industrialized apparatus. This ecosystem reflects coordinated and overlapping contributions from major state entities, including the Ministry of State Security (MSS), the People's Liberation Army (PLA), and the Ministry of Public Security. It also highlights the growing role of commercial contractor firms acting as hack-for-hire operators, effectively functioning as scalable operational support units within this broader ecosystem.

This blog focuses on the most operationally relevant Chinese threat actor groups, breaking down their modus operandi, priority targets, malware arsenals, and detection opportunities.

Simulate Chinese APT Attacks with 14-Day Free Trial of Picus Platform

Brief History of Chinese State-Sponsored Threat Actors

Chinese cyber espionage dates back to the late 1990s and early 2000s, when reconnaissance and intellectual property theft campaigns targeting U.S. defense contractors, aerospace firms, and government agencies first emerged as a coordinated effort. The public turning point came in February 2013, when security researchers attributed hundreds of intrusions to PLA Unit 61398 in Shanghai. For several years following this disclosure, the People's Liberation Army was widely seen as the primary driver of China's offensive cyber operations.

The landscape shifted significantly after China introduced sweeping military reforms in 2015 and 2016. These changes restructured China's cyber operations and moved operational control from the PLA to the civilian Ministry of State Security and its regional State Security Departments. By the late 2010s, MSS-affiliated contractor networks had become central to operations, with front companies such as Boyusec (APT3), Huaying Haitai (APT10), Hainan Xiandun (APT40), Chengdu 404 (APT41), and Wuhan Xiaoruizhi (APT31) named in indictments by the United States Department of Justice.

Today, the Chinese cyber threat ecosystem is defined by three key trends. First, an industrialized contractor model that enables scale while maintaining plausible deniability. Second, a shared malware and tooling economy, where frameworks like ShadowPad, PlugX, HyperBro, and Cobalt Strike are reused across multiple threat clusters, blurring attribution lines. Third, advanced covert network tradecraft, as highlighted in recent CISA advisories, renders traditional indicator-based detection increasingly ineffective and forces a shift toward behavior-based defense strategies.

Profiles of Chinese State-Sponsored Cyber Threat Actors

APT3 (Gothic Panda / UPS Team / Buckeye / TG-0110 / Boyusec)

Active since 2010 | Attributed to the MSS Guangdong State Security Department through the front company Boyusec, also known as Guangzhou Bo Yu Information Technology.

Target sectors and regions: APT3 originally focused on U.S. and European aerospace, defense, telecommunications, and technology firms before shifting around 2015 toward Hong Kong political organizations, pro-democracy activists, and regional governments.

Modus operandi: APT3 is historically significant for its early and aggressive use of browser and Adobe Flash zero-day exploits, delivered through spear-phishing emails and strategic web compromises. Major campaigns include Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. The group is also notable for its 2016 reuse of Equation Group exploitation tools, obtained through unknown means before the ShadowBrokers leaks. APT3 embedded DoublePulsar and variants of EternalRomance into a custom toolkit known as Bemstour.

Key malware and tools: PlugX, Pirpi, OSInfo, RemoteCMD, SHOTPUT, and Bemstour, the framework associated with Equation Group tool reuse.

Notable CVEs exploited: CVE-2014-1776 affecting Internet Explorer, CVE-2015-3113 affecting Adobe Flash, and CVE-2015-5119 affecting Adobe Flash.

Key MITRE ATT&CK techniques: T1566.001, T1203, T1071.001, T1078, and T1021.002.

APT10 (MenuPass / Stone Panda / Cloud Hopper / Red Apollo / POTASSIUM)

Active since 2006 | Attributed to the MSS Tianjin State Security Bureau, operating through the contractor Huaying Haitai Science and Technology Development Company.

Target sectors and regions: APT10 has consistently targeted managed service providers (MSPs), aerospace, satellite, engineering, telecommunications, pharmaceuticals, and government organizations. Japan remains a long-term strategic focus, alongside sustained activity in the U.S., U.K., Canada, and Australia.

Modus operandi: APT10 is best known for Operation Cloud Hopper, a large-scale supply chain intrusion campaign in which the group compromised MSPs to gain trusted access into thousands of downstream customer environments. This operation culminated in the December 2018 indictment by the United States Department of Justice of Zhu Hua and Zhang Shilong. Despite public attribution, the group has continued operations with evolved tooling and refined targeting, particularly against Japanese industrial and government entities, operating under clusters such as Earth Tengshe and Bronze Riverside.

Key malware and tools: PlugX, Quasar RAT, RedLeaves, ChChes, UPPERCUT (ANEL), PoisonIvy, and LODEINFO, which has been actively used in Japan-focused campaigns since 2019.

Notable CVEs exploited: CVE-2017-11882, CVE-2019-0708 (BlueKeep), and CVE-2023-4966 (Citrix Bleed).

Key MITRE ATT&CK techniques: T1199, T1078, T1021.002, T1053.005, and T1071.001.

APT27 (Emissary Panda / LuckyMouse / Iron Tiger / Bronze Union / TG-3390 / Linen Typhoon / Red Phoenix / IODINE)

Active since 2010 | Attributed to the Ministry of State Security (MSS).

Target sectors and regions: APT27 targets government, defense, aerospace, energy, and technology organizations worldwide, with a strong focus on intergovernmental bodies and political institutions across East Asia, Europe, and the Middle East.

Modus operandi: APT27 maintains one of the most mature and adaptable toolkits in the Chinese APT ecosystem. The group combines watering-hole attacks, strategic web compromises, and rapid exploitation of N-day vulnerabilities in public-facing systems. Between 2020 and 2022, APT27 expanded into financially motivated operations, including the deployment of Polar ransomware, showing how state-aligned espionage and opportunistic monetization increasingly overlap in Chinese operations.

Key malware and tools: HyperBro, ShadowPad, PlugX, SysUpdate, HttpBrowser, ZxShell, and China Chopper.

Notable CVEs exploited: CVE-2021-26855 (Exchange ProxyLogon), CVE-2021-44228 (Log4Shell), and CVE-2025-53770 (SharePoint ToolShell, observed in 2025 activity).

Key MITRE ATT&CK techniques: T1190, T1059.003, T1071.001, T1547.001, and T1003.

APT31 (ZIRCONIUM / Violet Typhoon / Judgment Panda / Red Keres)

Active since 2010 | Attributed to the Ministry of State Security, Hubei State Security Department, operating through the front company Wuhan Xiaoruizhi Science and Technology Company.

Target sectors and regions: APT31 focuses heavily on high-value individuals and entities tied to politically sensitive topics, including government officials, legislators, campaign staff, journalists, dissidents, academics, and corporations. Notable targets include the U.K. Parliament members, U.S. presidential campaign staff, and the Inter-Parliamentary Alliance on China, reflecting a strong emphasis on political intelligence collection and influence monitoring.

Modus operandi: APT31 is closely associated with long-term surveillance operations targeting individuals, leveraging tracking pixels, reconnaissance beacons, and credential phishing campaigns to monitor activity and harvest access. In March 2024, the United States Department of Justice unsealed an indictment against seven APT31 operators, publicly identifying Wuhan Xiaoruizhi as the coordinating front company. The group is also among the earliest known Chinese threat actors to operationalize compromised SOHO routers as relay infrastructure, a technique now widely adopted across the ecosystem.

Key malware and tools: SOGU, LUCKYBIRD, SLOWGYRO, along with custom loaders and proprietary web shells.

Notable CVEs exploited: CVE-2017-0199, CVE-2017-11882, and CVE-2020-0688 (Microsoft Exchange).

Key MITRE ATT&CK techniques: T1598.002, T1566.002, T1204.002, T1090.003, and T1584.005.

APT40 (Leviathan / Kryptonite Panda / Gingham Typhoon / TEMP.Periscope / Bronze Mohawk / ISLANDDREAMS / MUDCARP)

Active since 2013 | Attributed to the Ministry of State Security, Hainan State Security Department, operating through the contractor Hainan Xiandun Technology Development Company.

Target sectors and regions: APT40 primarily targets maritime industries, naval defense, shipping, aerospace, and universities involved in government-sponsored naval research. Its operations focus on Malaysia, Australia, the United States, the United Kingdom, Germany, and countries across South and Southeast Asia, aligning closely with strategic maritime priorities.

Modus operandi: APT40 is widely recognized as the primary Chinese threat actor focused on maritime and naval intelligence collection, directly supporting Beijing's strategic interests in the South China Sea and the Maritime Silk Road. A July 2024 advisory led by the Australian Signals Directorate under the Five Eyes alliance highlighted the group's ability to weaponize newly disclosed vulnerabilities within hours, demonstrating a highly responsive operational model. APT40 is also a heavy user of compromised SOHO devices as relay infrastructure, reinforcing its ability to blend into regional network traffic and evade detection.

Key malware and tools: AIRBREAK (ORANGEADE), BADFLICK, BADSIGNAL, Derusbi, China Chopper, PlugX, ShadowPad, HOMEFRY, and MURKYTOP.

Notable CVEs exploited: CVE-2019-19781 (Citrix), CVE-2020-5902 (F5 BIG-IP), CVE-2022-26134 (Atlassian Confluence), and CVE-2021-40539 (ManageEngine ADSelfService Plus).

Key MITRE ATT&CK techniques: T1190, T1505.003, T1059.001, T1090, and T1041.

APT41 (Winnti / Double Dragon / Wicked Panda / Barium / Brass Typhoon / Bronze Atlas)

Active since 2012 | Attributed to the Ministry of State Security (MSS), operating through the contractor Chengdu 404 Network Technology Company.

Target sectors and regions: APT41 operates at a global scale, targeting more than 40 countries and over 15 industries, including healthcare, telecommunications, technology, gaming, government, defense, pharmaceuticals, education, automotive, travel, media, and semiconductors.

Modus operandi: APT41 is widely regarded as the quintessential dual-mandate Chinese threat actor, conducting state-sponsored espionage alongside financially motivated operations. These activities include cryptocurrency theft, in-game asset fraud, and occasional ransomware deployment. The group maintains one of the most extensive and technically advanced tool arsenals in the Chinese APT ecosystem, spanning UEFI implants, mobile surveillance frameworks, and custom cloud-based command-and-control infrastructure.

In September 2020, the United States Department of Justice indicted five APT41 operators, yet the group continued operations with little disruption, highlighting its resilience. Notably, APT41's ShadowPad implant has become a shared backbone across multiple Chinese threat clusters, including APT10, APT27, APT40, and others, reinforcing the shared tooling economy within the ecosystem.

Key malware and tools: ShadowPad, Winnti malware, POISONPLUG, Speculoos, DUSTPAN, DUSTTRAP, Spyder, Crosswalk, Moonbounce (UEFI implant), and the SonarX big data surveillance platform.

Notable CVEs exploited: CVE-2021-44228 (Log4Shell, exploited within hours of disclosure), CVE-2019-19781 (Citrix), CVE-2020-10189 (Zoho ManageEngine Desktop Central), and CVE-2021-26855 (Exchange ProxyLogon).

Key MITRE ATT&CK techniques: T1190, T1059.001, T1574.002, T1071.001, T1041, and T1486.

Mustang Panda (Bronze President / RedDelta / TA416 / Earth Preta / TWILL TYPHOON / HoneyMyte / Camaro Dragon / Stately Taurus)

Active since publicly documented in 2017 | Attributed to the Ministry of State Security(MSS).

Target sectors and regions: Mustang Panda targets governments, NGOs, religious organizations, and policy research institutions, with a strong focus on Southeast Asia, including Myanmar, Vietnam, the Philippines, Indonesia, and ASEAN-affiliated entities. The group also operates across Europe, Mongolia, and the Vatican, and frequently targets the Tibetan and Uyghur diaspora, indicating a focus on political influence and regional intelligence collection.

Modus operandi: Mustang Panda is one of the most active and operationally consistent Chinese APT groups. It is best known for its use of DLL sideloading via legitimate signed executables, allowing malware to execute while evading detection. The group heavily leverages cloud platforms such as Google Drive and Dropbox for staging and payload delivery, blending malicious traffic with legitimate services.

Attack lures are typically geopolitical and time-sensitive, exploiting themes such as G20 summits, ASEAN meetings, and global conflicts like Russia-Ukraine, delivered through spear-phishing documents. Mustang Panda has also demonstrated USB-based propagation techniques, deploying worms in environments with weak endpoint controls and limited network visibility.

Key malware and tools: PlugX (with extensive custom variants), TONESHELL, PUBLOAD, MQsTTang, HIUPAN (USB worm), STARPROXY, and PAKLOG keylogger.

Notable CVEs exploited: CVE-2017-0199, CVE-2017-11882, and CVE-2022-47966 (Zoho ManageEngine).

Key MITRE ATT&CK techniques: T1566.001, T1574.002, T1071.001, T1102, and T1091.

Ke3chang (APT15 / Vixen Panda / Nickel / Nylon Typhoon / Mirage / Playful Dragon / Royal APT / Metushy)

Active since 2010 | Attributed to the Ministry of State Security (MSS).

Target sectors and regions: Ke3chang primarily targets Ministries of Foreign Affairs, diplomatic missions, energy companies, and government agencies across Europe, Latin America, and Asia. Activity has been observed in Brazil, Guatemala, Costa Rica, and Peru, with Microsoft reporting sustained Nylon Typhoon operations against foreign affairs entities in more than a dozen countries, highlighting a clear focus on diplomatic and geopolitical intelligence collection.

Modus operandi: Ke3chang is a patient, long-dwell espionage actor specializing in covert intelligence gathering over extended periods. Campaigns typically begin with targeted spear-phishing against government officials or contractors, followed by credential harvesting, mailbox access, and systematic data collection. The group is known for maintaining low-noise operational discipline, often remaining undetected for months or even years. It achieves this through frequent rotation of command-and-control infrastructure and by avoiding noisy post-exploitation techniques that could trigger alerts.

Key malware and tools: MirageFox, RoyalDNS, Ketrican, Okrum, BS2005, NeoichorDNS, and Neoichor.

Notable CVEs exploited: CVE-2017-0199, CVE-2019-0604 (Microsoft SharePoint), and CVE-2021-44228 (Log4Shell).

Key MITRE ATT&CK techniques: T1566.001, T1071.001, T1071.004, T1114, and T1003.

Gallium (Operation Soft Cell / Granite Typhoon / Phantom Panda / Red Dev 4)

Active since 2017 | Attributed to the Ministry of State Security (MSS).

Target sectors and regions: Gallium targets global telecommunications providers, mobile network operators, financial institutions, and government agencies. Its most notable campaign, Operation Soft Cell, compromised more than a dozen telecom operators across multiple continents, focusing on the collection of Call Detail Records (CDRs) and metadata of high-value individuals.

Modus operandi: Gallium specializes in telecommunications infrastructure compromise, enabling long-term, covert surveillance capabilities. The group gains access to billing platforms, signaling systems, and subscriber databases, allowing it to monitor communications at scale. Initial access is typically achieved through exploitation of internet-facing Microsoft Exchange and Oracle WebLogic servers, followed by the rapid deployment of web shells. From there, Gallium conducts lateral movement using stolen credentials and legitimate administrative tools, maintaining persistence while minimizing detection.

Key malware and tools: China Chopper, PoisonIvy, HTran, Mimikatz, PingPull, Sword2033, and custom web shells.

Notable CVEs exploited: CVE-2017-10271 (Oracle WebLogic), CVE-2019-0604 (Microsoft SharePoint), and CVE-2021-26855 (Exchange ProxyLogon).

Key MITRE ATT&CK techniques: T1190, T1505.003, T1003, T1021.002, and T1071.001.

HAFNIUM (Silk Typhoon)

Active since 2020 | Attributed to the Ministry of State Security (MSS).

Target sectors and regions: HAFNIUM targets defense contractors, think tanks, law firms, infectious disease researchers, higher education institutions, and NGOs. Since 2024, the group has expanded into IT managed service providers and cloud identity platforms, with a primary geographic focus on the United States.

Modus operandi: HAFNIUM gained global attention in March 2021 through the mass exploitation of the Microsoft Exchange ProxyLogon vulnerability chain, compromising tens of thousands of on-premises Exchange servers within days. This campaign marked one of the most widespread and rapid exploitation events observed in modern cyber operations.

Since late 2024, Microsoft has observed a significant evolution in Silk Typhoon's tradecraft, shifting from direct exploitation toward identity- and cloud-centric intrusion models. The group now abuses stolen API keys, OAuth tokens, and privileged credentials associated with PAM platforms, cloud applications, and data management services to pivot into downstream customer environments. This reflects a broader transition toward supply chain compromise of the identity and management plane, rather than targeting infrastructure directly.

Key malware and tools: China Chopper, ASPXSpy, Tarrask, custom web shells, and abuse of stolen API keys and OAuth tokens for cloud-based lateral movement.

Notable CVEs exploited: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 (ProxyLogon), and CVE-2024-3400 (PAN-OS GlobalProtect).

Key MITRE ATT&CK techniques: T1190, T1505.003, T1078.004, T1550.001, and T1552.004.

Salt Typhoon (GhostEmperor / FamousSparrow / UNC2286 / Earth Estries / RedMike)

Active since 2020 | Attributed to the Ministry of State Security (MSS), with reporting indicating shared tasking with the People's Liberation Army (PLA).

Target sectors and regions: Salt Typhoon targets telecommunications carriers, internet service providers, hospitality, government, and NGOs across the U.S. and allied countries. The group drew global attention in late 2024 after compromising major U.S. carriers, including AT&T, Verizon, and Lumen Technologies, gaining access to lawful intercept systems used for court-authorized surveillance.

Modus operandi: Salt Typhoon specializes in deep, persistent compromise of telecom infrastructure to enable long-term signals intelligence collection. The group focuses heavily on edge devices and network infrastructure, particularly targeting Cisco IOS XE environments, where it establishes rootkit-level persistence. Its tradecraft prioritizes stealth and longevity, with operators often maintaining access for months before executing actions that generate detectable signals, making detection exceptionally challenging.

Key malware and tools: Demodex rootkit, GhostSpider backdoor, Masol RAT, SnappyBee (Deed RAT), JumbledPath network traversal tool, and custom Cisco IOS XE implants.

Notable CVEs exploited: CVE-2023-20198 and CVE-2023-20273 (Cisco IOS XE), CVE-2024-3400 (PAN-OS), and CVE-2021-26855 (Microsoft Exchange).

Key MITRE ATT&CK techniques: T1190, T1542.003, T1090.003, T1070, and T1040.

Naikon (Lotus Panda / APT30 / Override Panda / Raspberry Typhoon / Camerashy)

Active since 2010 | Attributed to the People's Liberation Army Chengdu Military Region Second Technical Reconnaissance Bureau (Unit 78020).

Target sectors and regions: Naikon primarily targets ASEAN member state governments, military organizations, diplomatic missions, and civil aviation authorities. Its operations maintain a persistent focus on the South China Sea region, particularly involving the Philippines, Vietnam, Malaysia, Indonesia, and Myanmar, reflecting a strong alignment with regional geopolitical priorities.

Modus operandi: Naikon is one of the longest-running PLA-linked APT groups and serves as a textbook example of disciplined, regionally focused intelligence collection. Campaigns typically begin with spear-phishing emails containing malicious Microsoft Office documents, often themed around current diplomatic or geopolitical developments in Southeast Asia. Following initial compromise, the group deploys a mature and stable toolkit of backdoors, enabling lateral movement, sustained access, and controlled data exfiltration. Exfiltration is typically performed through carefully staged and compressed archive files, minimizing detection risk.

Key malware and tools: RainyDay, Nebulae, ARIABODY, HDOOR, SNAKEDISK, PlugX, and Sisfader.

Notable CVEs exploited: CVE-2012-0158, CVE-2017-0199, and CVE-2017-11882.

Key MITRE ATT&CK techniques: T1566.001, T1203, T1071.001, T1005, and T1560.001.

Tonto Team (CactusPete / Earth Akhlut / Bronze Huntley / Karma Panda / HeartBeat / Whitebird)

Active since 2009 | Attributed to the People's Liberation Army Northern Theater Command, specifically the Shenyang Technical Reconnaissance Bureau (Unit 65017).

Target sectors and regions: Tonto Team targets government, diplomatic, defense, technology, research, and cryptocurrency organizations across Russia, Belarus, Mongolia, South Korea, Japan, Taiwan, and Eastern Europe, reflecting a strong focus on regional intelligence collection and geopolitical monitoring.

Modus operandi: Tonto Team is a long-running but relatively low-profile PLA-aligned threat cluster. It is best known for its reliance on RTF-based spear-phishing campaigns, often crafted using the Royal Road (8.t) weaponizer framework, a toolset shared across multiple Chinese APT groups. Following initial access, the group rapidly deploys the Bisonal backdoor family, which has been continuously developed and refined for over a decade. This consistent tooling strategy enables reliable persistence and controlled post-exploitation activity.

Key malware and tools: Bisonal (multiple variants), ShadowPad variants, Dexbia, and the Royal Road RTF weaponizer.

Notable CVEs exploited: CVE-2017-11882, CVE-2018-0798, CVE-2018-0802, and CVE-2022-1040 (Sophos Firewall).

Key MITRE ATT&CK techniques: T1566.001, T1203, T1059.003, T1071.001, and T1547.001.

Volt Typhoon (Vanguard Panda / BRONZE SILHOUETTE / Insidious Taurus / DEV-0391)

Active since 2021, publicly exposed in May 2023 | Attributed to PRC state-sponsored activity, widely assessed as aligned with the Ministry of State Security (MSS) or People's Liberation Army (PLA) cyber units.

Target sectors and regions: Volt Typhoon targets critical infrastructure across the United States and allied nations, including water and wastewater systems, energy, transportation, communications, and government networks. Activity has been documented across the continental U.S., Guam, Hawaii, and, more recently, telecommunications networks in Latin America, indicating a broad strategic footprint.

Modus operandi: Volt Typhoon is the defining example of cyber pre-positioning, focusing not on immediate intelligence collection but on establishing persistent, low-and-slow access to critical infrastructure that could be leveraged during a future geopolitical crisis. The group relies almost entirely on living-off-the-land techniques, using native Windows utilities such as netsh, wmic, ntdsutil, PowerShell, and cmd.exe, with minimal use of custom malware.

To evade attribution, Volt Typhoon routes activity through the KV-Botnet, a covert network of compromised Cisco, NetGear, and other end-of-life SOHO routers. In January 2024, the United States Department of Justice and Federal Bureau of Investigation announced a court-authorized disruption of this botnet, highlighting its operational significance.

Key malware and tools: Minimal custom malware, with reliance on tools such as FastReverseProxy (FRP), Earthworm, Impacket, and extensive use of native Windows binaries.

Notable CVEs exploited: CVE-2021-40539 (ManageEngine ADSelfService Plus), CVE-2021-27860 (FatPipe), along with the exploitation of end-of-life Cisco RV320/RV325 and NetGear ProSAFE routers for botnet expansion.

Key MITRE ATT&CK techniques: T1078, T1036, T1571, T1090.003, and T1059.001.

UNC3886

Active since 2021 | Attributed to China-nexus activity

Target sectors and regions: UNC3886 targets the defense industrial base, telecommunications, technology firms, and government organizations across the United States, Asia, and Europe. The group shows a clear preference for high-value environments operating virtualization platforms and network infrastructure at scale, where visibility is often limited.

Modus operandi: UNC3886 is considered one of the most technically advanced Chinese-nexus zero-day operators currently tracked. The group specializes in compromising hypervisors and network appliances, operating below the traditional endpoint detection layer. Its campaigns frequently chain zero-day vulnerabilities across platforms such as VMware ESXi, vCenter, Fortinet FortiGate and FortiManager, and Juniper Junos OS, enabling deep persistence beneath the operating system.

This approach allows UNC3886 to maintain exceptionally long dwell times, with some intrusions persisting for multiple years without detection. The group's tradecraft emphasizes stealth, persistence, and control at the infrastructure layer, making it particularly difficult to detect with conventional security tooling.

Key malware and tools: VIRTUALPITA, VIRTUALPIE, VIRTUALGATE (ESXi implants), MEDUSA rootkit, REPTILE Linux kernel rootkit, CASTLETAP, THINCRUST, and custom Junos OS backdoors.

Notable CVEs exploited: CVE-2022-22948, CVE-2023-20867 (VMware), CVE-2022-42475, CVE-2022-41328 (FortiOS), CVE-2023-34048 (vCenter), and CVE-2025-21590 (Junos OS, mid-plane exploitation).

Key MITRE ATT&CK techniques: T1190, T1542.003, T1014, T1070, and T1036.

UNC5221

Active since 2023 | Attributed to China-nexus activity.

Target sectors and regions: UNC5221 demonstrates broad, opportunistic victimology, driven primarily by vulnerability exposure rather than sector-specific targeting. Affected organizations include government, defense, telecommunications, aerospace, legal, finance, and managed service providers, with activity observed across North America, Europe, and Asia.

Modus operandi: UNC5221 is the cluster most closely associated with the large-scale exploitation of Ivanti edge appliances. In January 2024, the group chained CVE-2023-46805 and CVE-2024-21887 to compromise thousands of Ivanti Connect Secure and Policy Secure devices within a short timeframe. This activity continued through 2024 and 2025 with additional Ivanti zero-day exploitation, including CVE-2025-0282 and CVE-2025-22457, highlighting a persistent focus on edge infrastructure as an entry point.

Following initial access, UNC5221 deploys a distinctive set of web shells and lightweight loaders, specifically designed for long-term persistence on appliance filesystems, where traditional endpoint visibility is limited. The group's operations emphasize speed, scale, and persistence, making it a high-impact actor in mass exploitation campaigns.

Key malware and tools: BUSHWALK, CHAINLINE, FRAMESTING, LIGHTWIRE, WARPWIRE, THINSPOOL, PHASEJAM, DRYHOOK, and SPAWN family loaders.

Notable CVEs exploited: CVE-2023-46805, CVE-2024-21887, CVE-2025-0282, CVE-2025-22457, and CVE-2024-8963.

Key MITRE ATT&CK techniques: T1190, T1505.003, T1059.004, T1552.004, and T1070.004.

Storm-2603

Active since 2025 | Attributed to China-nexus activity.

Target sectors and regions: Storm-2603 targets SharePoint-dependent organizations globally, including government, education, technology, finance, and energy sectors, reflecting a broad attack surface driven by enterprise software exposure.

Modus operandi: Storm-2603 emerged in mid-2025 through exploitation of the SharePoint ToolShell vulnerability chain, specifically CVE-2025-53770 and CVE-2025-53771. The group is notable for its dual-use operational pattern, where espionage-focused reconnaissance and credential theft are sometimes followed by ransomware deployment, particularly Warlock ransomware.

This approach closely mirrors the behavior of APT41, reinforcing a broader trend in the Chinese threat landscape where intelligence collection increasingly overlaps with financially motivated or disruptive operations. Microsoft has observed Storm-2603 operating alongside clusters such as Linen Typhoon and Violet Typhoon during ToolShell exploitation campaigns, suggesting shared targeting priorities or parallel tasking.

Key malware and tools: Custom SharePoint web shells, Warlock ransomware, Impacket, Mimikatz, and loaders specifically tailored to the ToolShell exploitation chain.

Notable CVEs exploited: CVE-2025-53770 and CVE-2025-53771 (SharePoint ToolShell).

Key MITRE ATT&CK techniques: T1190, T1505.003, T1486, T1003, and T1059.

Liminal Panda

Active since 2020, first publicly disclosed in November 2024 | Attributed to China-nexus activity.

Target sectors and regions: Liminal Panda targets telecommunications operators across South Asia, Africa, and the Middle East, with a particular focus on providers serving individuals of intelligence interest to Chinese authorities. This reflects a targeting strategy centered on subscriber access rather than infrastructure alone.

Modus operandi: Liminal Panda operates deep within telecom ecosystems, exploiting trust relationships between interconnected carriers to pivot laterally across networks using GSM and SIGTRAN protocols. Instead of relying on traditional malware-heavy approaches, the group emphasizes stealthy abuse of legitimate telecom management interfaces and subscriber databases, enabling passive surveillance without triggering endpoint-based detection mechanisms.

The group's activity was publicly highlighted during U.S. Senate testimony by CrowdStrike in November 2024, where it was characterized as a persistent and strategic threat to allied telecommunications infrastructure. Its tradecraft demonstrates a shift toward protocol-level exploitation and trust abuse, rather than vulnerability-driven intrusion.

Key malware and tools: SIGTRANslator, CordScan, PingPong, along with extensive abuse of native telecom operator tooling.

Notable CVEs exploited: The group relies primarily on weak or default credentials and implicit trust relationships between telecom operators, rather than a defined CVE exploitation pattern.

Key MITRE ATT&CK techniques: T1199, T1078, T1040, T1071, and T1090.

Aquatic Panda

Active since 2020 | Attributed to China-nexus activity, assessed as aligned with the Ministry of State Security (MSS).

Target sectors and regions: Aquatic Panda targets government, academic, NGO, religious, and telecommunications organizations across East Asia, Southeast Asia, and North America.

Modus operandi: Aquatic Panda is known as one of the fastest N-day exploiters in the Chinese APT ecosystem. The group gained attention for rapid exploitation of Log4Shell (CVE-2021-44228) within days of disclosure in December 2021, including a widely reported compromise of a major academic institution. It combines opportunistic vulnerability exploitation with targeted spear-phishing and leverages the ScanBox reconnaissance framework to fingerprint users visiting compromised websites before launching follow-on attacks.

Key malware and tools: ScanBox, Cobalt Strike, Winnti-family implants, and custom PowerShell-based toolchains.

Notable CVEs exploited: CVE-2021-44228 (Log4Shell), CVE-2022-26134 (Confluence), CVE-2022-47966 (Zoho ManageEngine).

Key MITRE ATT&CK techniques: T1190, T1059.001, T1595, T1071.001, T1036.

Evasive Panda (Daggerfly / Bronze Highland / StormBamboo)

Active since 2012 | Attributed to the Ministry of State Security (MSS).

Target sectors and regions: Evasive Panda targets Tibetan organizations, Hong Kong pro-democracy groups, Uyghur diaspora communities, religious minorities, NGOs, and telecommunications providers across South Asia and East Africa.

Modus operandi: Evasive Panda stands out for its network-level supply chain attacks, including compromise of internet service providers and DNS poisoning. The group has demonstrated the ability to intercept and modify software update traffic, replacing legitimate updates with trojanized payloads. Its operations show strong cross-platform capability, with tooling for Windows, macOS, and Android, enabling persistent surveillance across multiple device ecosystems used by targeted communities.

Key malware and tools: MgBot modular framework, Macma (macOS backdoor), Nightdoor (NetMM), Suzafk, and custom Android spyware.

Notable CVEs exploited: Primarily relies on supply chain and DNS manipulation, with opportunistic use of N-day vulnerabilities rather than consistent CVE-driven access.

Key MITRE ATT&CK techniques: T1557, T1195.002, T1071.001, T1059.004, T1056.

Worok

Active since 2020 | Attributed to China-nexus activity, with overlaps to TA428.

Target sectors and regions: Worok targets government, financial, telecommunications, energy, and military organizations across Asia, the Middle East, and Africa.

Modus operandi: Worok is a low-volume but technically advanced threat cluster known for combining public-facing application exploitation with steganographic payload delivery. The group has been observed embedding second-stage payloads within PNG images using least-significant-bit encoding, delivered through multi-stage loaders. This approach ensures the final payload is never transmitted as a recognizable executable, significantly complicating detection.

Key malware and tools: CLRLoad, PowHeartBeat, PNGLoad (steganographic stager), VSingle, and custom .NET loaders.

Notable CVEs exploited: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 (ProxyShell chain).

Key MITRE ATT&CK techniques: T1190, T1027.003, T1059.001, T1140, T1071.001.

ToddyCat

Active since 2020 | Attributed to China-nexus activity.

Target sectors and regions: ToddyCat targets government and defense organizations across Europe and Asia, with a focus on diplomatic and telecommunications entities in the CIS region and Southeast Asia.

Modus operandi: ToddyCat is known for stealthy, long-dwell intrusions that begin with exploitation of public-facing applications, such as Microsoft Exchange. The group quickly transitions to passive backdoors that avoid regular beaconing, instead waiting for operator interaction. Its custom Stayin' Alive loader chain deploys the Samurai and Ninja backdoors, while operators maintain strong operational security through infrastructure rotation and artifact cleanup.

Key malware and tools: Samurai backdoor, Ninja toolkit, Stayin' Alive loader family, LoFiSe file collector, and passive listeners leveraging legitimate traffic tunneling.

Notable CVEs exploited: CVE-2021-26855 (Exchange ProxyLogon), CVE-2022-41040, and CVE-2022-41082 (ProxyNotShell).

Key MITRE ATT&CK techniques: T1190, T1505.003, T1071.001, T1055, T1070.

Cross-Group Technical Analysis of Chinese APT Groups

Covert Networks and Operational Relay Boxes

The most significant recent development across the Chinese APT ecosystem, and the central focus of CISA AA26-113A advisory, is the industrialization of covert networks, also known as ORB networks (Operational Relay Boxes). Rather than acquiring or leasing infrastructure directly, Chinese threat actors now rely on large-scale, shared botnets composed of compromised SOHO routers, IoT devices, and end-of-life edge appliances.

In this model, traffic enters through an initial on-ramp node, is routed across multiple compromised devices, and exits through a geographically local node near the target, significantly complicating attribution and detection. This architecture allows attackers to blend seamlessly into legitimate regional traffic patterns while maintaining operational flexibility.

The most prominent examples include the KV-Botnet, used by Volt Typhoon and built largely from compromised Cisco and NetGear routers, and Raptor Train, operated by Integrity Technology Group on behalf of Flax Typhoon, which peaked at more than 200,000 infected devices in 2024.

For defenders, this shift leads to the extinction of IOCs. Traditional defenses such as static IP blocklists lose effectiveness when a single threat actor can operate from hundreds of thousands of rotating residential IP addresses, when multiple actors share the same botnet infrastructure, and when network nodes are continuously refreshed and redistributed.

Initial Access Patterns

• Edge device exploitation is now the dominant initial access vector. Platforms such as Ivanti Connect Secure, Fortinet FortiGate and FortiManager, Cisco IOS XE, Juniper Junos OS, Citrix NetScaler, Microsoft Exchange, SharePoint, and PAN-OS are routinely mass-exploited within hours or days of public CVE disclosure, reflecting a shift toward speed-driven, vulnerability-first intrusion models.
• Spear-phishing remains a core technique for several groups, particularly Mustang Panda, APT31, and Ke3chang, which rely on geopolitical or diplomatic lures combined with DLL sideloading payload chains to achieve initial access and execution.
• Supply chain compromise now operates across multiple layers. Silk Typhoon targets the identity and PAM supply chain, while APT10 pioneered MSP compromise through Operation Cloud Hopper. APT41 has demonstrated direct software supply chain compromise, including incidents involving **CCleaner, ASUS Live Update, and NetSarang products. Meanwhile, Evasive Panda has escalated this model further by compromising ISPs to manipulate software update delivery at the network level.
• Credential-based attacks are increasingly prevalent, with password spraying and abuse of valid accounts in Microsoft 365 and Microsoft Entra ID environments observed across APT31 and other clusters. This mirrors the approach commonly associated with APT33, highlighting a convergence of tradecraft across state-sponsored ecosystems.

Execution, Persistence, and Lateral Movement

• DLL sideloading is one of the most widely shared post-exploitation techniques across Chinese APT groups, including Mustang Panda, APT10, APT41, and APT27. In this approach, legitimate signed executables are abused to load attacker-controlled DLLs from the same directory, effectively bypassing application allowlisting and blending into trusted processes.
• Living-off-the-land binaries (LOLBins) are a standard component of operations, with Volt Typhoon representing the clearest example of this tradecraft. Commonly abused tools include wmic.exe, netsh.exe, ntdsutil.exe, certutil.exe, bitsadmin.exe, and native PowerShell, all of which allow attackers to execute, persist, and move laterally without introducing obvious malicious binaries.
• Web shells on public-facing servers remain a primary persistence mechanism, providing reliable, low-noise access points. China Chopper is the most prevalent web shell across the ecosystem, alongside variants such as ASPXSpy and BehindTheProxy, as well as appliance-specific shells like BUSHWALK on Ivanti devices.
• Persistence techniques follow a layered approach, with scheduled tasks, WMI event subscriptions, and registry Run keys serving as the most common methods. More advanced actors extend persistence through IIS module implants, and at the highest level of sophistication, deploy firmware- and infrastructure-level implants, including UEFI implants such as APT41's Moonbounce and hypervisor-level implants like UNC3886's VIRTUALPITA, enabling deep, long-term access that operates below traditional detection layers.

Shared Malware Economy

The Chinese APT ecosystem operates on a quartermaster model in which custom malware developed by one group is redistributed across many others. The clearest examples are listed below.

• ShadowPad, originally exclusive to APT41, has been observed in operations attributed to APT10, APT27, APT40, Tonto Team, Mustang Panda, and other clusters.
• PlugX is a decade-old modular RAT now used by APT3, APT10, APT27, APT41, Naikon, and Mustang Panda, with each group maintaining its own variant branches.
• HyperBro is most strongly associated with APT27 but has been observed in adjacent clusters.
• Cobalt Strike is ubiquitous and frequently cracked, making it a default fallback for many Chinese operators.
• China Chopper is the single most common web shell across all Chinese groups.

Command and Control

• Cloud service abuse is widespread. Mustang Panda abuses Google Drive and Dropbox. APT41 uses legitimate cloud storage and custom C2. Silk Typhoon abuses Microsoft Graph and cloud identity APIs.
• DNS-based C2 appears in Ke3chang (RoyalDNS), APT40, and several smaller clusters.
• Covert networks are increasingly the preferred transport layer, as discussed above.
• Passive backdoors that do not beacon outbound until receiving operator traffic are used by ToddyCat (Samurai, Ninja) and UNC3886 (CASTLETAP on Junos OS).

Credential Access and Defense Evasion

• Mimikatz and LSASS dumping remain standard across nearly every Chinese group.
• NTDS.dit extraction using ntdsutil or comsvcs.dll is a Volt Typhoon signature, but appears widely.
• Kerberoasting and AS-REP Roasting are common in post-compromise Active Directory abuse.
• Rootkits appear at the top end, including Salt Typhoon's Demodex, UNC3886's MEDUSA and REPTILE, and custom network device implants.

Notable CVEs Exploited by Chinese APT Groups

The following table summarizes high-impact CVEs exploited by Chinese APT groups in recent years.

Prioritized Defensive Actions Against Chinese APT Groups

Based on observed TTP frequency across Chinese threat groups, the following defensive actions are advised.

• Treat covert networks as APTs in their own right. Monitor for inbound connections from residential broadband ranges, SOHO router IP space, and IoT hosting infrastructure. Use dynamic threat feeds that incorporate known covert network nodes, and consider NetFlow-based upstream mapping to discover new nodes.

• Apply IP allow lists rather than deny lists for VPN and remote administration. Where business context permits, restrict corporate VPN inbound connections to known good geographic regions, time zones, and operating system fingerprints. Enforce machine certificates for SSL connections.

• Patch internet-facing appliances within 48 hours of critical CVE disclosure. Ivanti, Fortinet, Cisco IOS XE, Juniper, Citrix, Exchange, SharePoint, and PAN-OS are the consistently targeted product lines. Several Chinese groups have demonstrated the same-day or next-day weaponization of newly disclosed vulnerabilities.

• Remove end-of-life edge devices from production. The KV-Botnet and Raptor Train were built primarily on unsupported hardware. Organizations should inventory home-office and branch-office network equipment, enforce firmware currency, and replace devices that no longer receive vendor updates.

• Enable comprehensive PowerShell logging, including Script Block Logging (Event ID 4104), Module Logging, and Transcription Logging. Deploy behavioral detections for encoded commands, download cradles, and suspicious parent-child process chains.

• Monitor for LOLBin abuse, particularly wmic.exe, netsh.exe, ntdsutil.exe, certutil.exe, and bitsadmin.exe invocations that are unusual for the environment. Volt Typhoon's tradecraft is almost entirely visible through behavioral analytics on these native binaries.

• Hunt for DLL sideloading, especially signed binaries executing from non-standard directories such as %APPDATA%, %TEMP%, or %PROGRAMDATA%. This single behavior cuts across Mustang Panda, APT10, APT41, APT27, and more.

• Hunt for common Chinese APT malware families. Detection coverage for ShadowPad, PlugX, HyperBro, China Chopper, and Cobalt Strike will intercept activity from many different Chinese clusters, given the shared tooling economy.

• Harden identity and cloud management planes. Silk Typhoon's 2024 and 2025 campaigns targeting stolen API keys and OAuth tokens demonstrate that the identity layer is now a primary objective. Enforce phishing-resistant MFA, audit service principal activity, rotate API keys on a defined schedule, and monitor for anomalous OAuth consent grants.

• Segment and monitor operational technology networks. Volt Typhoon's pre-positioning activity is specifically aimed at OT environments in water, energy, and transportation. Remove direct internet exposure of OT, enforce separation between IT and OT, and monitor for any IT-originated reconnaissance into OT subnets.

How Picus Helps Simulate Chinese APT Attacks?

We also strongly suggest simulating the Chinese APT attacks to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Security Validation Platform. You can also test your defenses against other APT attacks, such as Lazarus, Salt Typhoon, and Fancy Bear, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Chinese APT groups:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial  of the Picus Security Validation Platform.