Reports Highlight China-Led Expansion of Offensive Cyber Operations and Targeting of Defense and Critical Infrastructure

Multiple reports and leaked documents indicate China-linked cyber operations are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout Vedere Labs analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s Onnara System, including theft of civil servants’ GPKI certificates and credentials, and noted Taiwan’s National Security Bureau reporting an average of 2.63 million attacks per day last year.

Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called “Expedition Cloud”—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including power/energy transmission, transportation, and smart home infrastructure. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the U.S. defense industrial base, describing a shift beyond classic espionage into supply-chain attacks, workforce infiltration, and battlefield-adjacent operations; Google attributed much of the activity to Chinese, Russian, Iranian, and North Korean actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.