# Chinese state-sponsored actors target US critical infrastructure

Published: 2025-06-20 · Severity: routine · Sectors: government-national, defense, financial-services, energy, healthcare, education, technology, manufacturing, infrastructure
Canonical: https://vorant.io/reports/2b6fc1d2-4cbd-515c-91bd-a096ad5dbedd/chinese-state-sponsored-actors-target-us-critical-infrastructure

> NSA/CISA/FBI detail Chinese state-sponsored tactics exploiting public vulnerabilities in critical and commercial systems worldwide.

NSA, CISA, and FBI assess that People's Republic of China state-sponsored cyber actors pose a major threat to U.S. and allied cyberspace assets. These actors aggressively target political, economic, military, educational, and critical infrastructure personnel and organizations to steal sensitive data, critical technologies, intellectual property, and PII. Priority targets include managed service providers, semiconductor companies, the Defense Industrial Base, universities, and medical institutions. The activity supports China's long-term economic and military development objectives.

The advisory documents observed trends in Chinese state-sponsored operations: actors use rotating virtual private servers and common open-source or commercial penetration tools to mask activities; they consistently scan for and exploit publicly disclosed vulnerabilities in major applications including Pulse Secure, Apache, F5 Big-IP, and Microsoft products within days of disclosure; and they deploy encrypted multi-hop proxies and SOHO devices as operational nodes to evade detection. The full campaign employs reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, and command-and-control tactics mapped to MITRE ATT&CK.

Defenders should prioritize patching critical and high-severity vulnerabilities on externally facing equipment, implement comprehensive network and endpoint monitoring for C2 activity and credential misuse, deploy anti-malware and intrusion prevention systems, apply domain reputation filtering, enforce strong credentials and multi-factor authentication for remote access, and monitor for phishing and malicious attachments.

## Mentioned in this report

- Threat actors: China-nexus activity (unattributed)

## Detection guidance (public sample)

### BITS Job Created via Bitsadmin or PowerShell to Download From Remote URL

ATT&CK: T1197

Detects bitsadmin /transfer or Start-BitsTransfer pulling content from an HTTP(S) source, a living-off-the-land download and persistence method used in state-sponsored intrusions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: BITS Job Created via Bitsadmin or PowerShell to Download From Remote URL
description: Detects bitsadmin.exe /transfer (or /addfile) and PowerShell Start-BitsTransfer
  fetching content from an HTTP(S) URL. Generalises on the BITS abuse pattern rather
  than any specific URL or job name.
status: experimental
tags:
- attack.stealth
- attack.persistence
- attack.t1197
logsource:
  category: process_creation
  product: windows
detection:
  selection_bitsadmin:
    Image|endswith: \bitsadmin.exe
    CommandLine|contains:
    - /transfer
    - /addfile
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains: Start-BitsTransfer
  selection_url:
    CommandLine|contains:
    - http://
    - https://
  filter_ms:
    CommandLine|contains:
    - .microsoft.com
    - .windowsupdate.com
  condition: (selection_bitsadmin or selection_ps) and selection_url and not filter_ms
falsepositives:
- Software deployment scripts that use BITS to fetch installers from internal or vendor
  URLs
- Administrators using bitsadmin to download patches
level: medium
id: 54a3b9cd-3d3d-5769-97f8-a932b82c6fef
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b
```

### Scheduled Task Created Running Payload From User-Writable Path

ATT&CK: T1053.005

Detects schtasks.exe /create registering a task whose action runs from user-writable locations such as AppData, Temp, Public or ProgramData, a common persistence/execution pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scheduled Task Created Running Payload From User-Writable Path
description: Detects schtasks.exe creating a task whose action (/tr) points into user-writable
  directories such as AppData, Temp, Users\Public or ProgramData. Generalises on the
  technique, not on task names or filenames.
status: experimental
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
    - /create
    - /tr
  selection_path:
    CommandLine|contains:
    - \AppData\
    - \Temp\
    - \Users\Public\
    - \ProgramData\
  filter_known:
    CommandLine|contains:
    - OfficeClickToRun
    - GoogleUpdate
    - \Microsoft\Teams\
  condition: selection and selection_path and not filter_known
falsepositives:
- Per-user application updaters registering tasks from AppData
- Software deployment tooling that stages installers in ProgramData or Temp
level: medium
id: 95be796c-18c4-540c-832c-a402d7707640
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b
```

### Local Account Created via Net Command

ATT&CK: T1136.001

Detects net.exe or net1.exe creating a local user account with 'user /add', a common persistence step after compromise of an externally facing system. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Local Account Created via Net Command
description: Detects net.exe/net1.exe invoked with 'user' and '/add' to create a local
  account, which attackers use to establish persistent access on compromised hosts.
status: experimental
tags:
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - ' user '
    - ' /add'
  filter_domain:
    CommandLine|contains: ' /domain'
  condition: selection and not filter_domain
falsepositives:
- Administrators or provisioning scripts creating local service or break-glass accounts
- Imaging or lab build scripts
level: medium
id: e5bea512-0993-5630-9c80-f8ca2bedb61f
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2b6fc1d2-4cbd-515c-91bd-a096ad5dbedd/chinese-state-sponsored-actors-target-us-critical-infrastructure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup