# Chinese cyber ops rely on contractors, scale

Published: 2023-01-30 · Severity: medium · Sectors: telecommunications, government-national, defense, technology, infrastructure
Canonical: https://vorant.io/reports/684ee397-2ac6-5606-9dea-817c4e1071b9/chinese-cyber-ops-rely-on-contractors-scale

> China's cyber operations model uniquely leverages contracted hackers, vulnerability supply-chain control, and legal frameworks compelling tech firms to aid state espionage at unprecedented scale.

China has developed a distinctive cyber operations model that diverges significantly from Western approaches through its systematic use of contracted hacking teams, state control over domestic vulnerability research, and legal authority to compel private-sector cooperation. According to a joint October 2022 CISA-FBI-NSA advisory, Chinese state-linked groups have actively exploited Common Vulnerabilities and Exposures since 2020 to target US and allied networks. Experts note that China's 2017 Cyber Security Law and National Intelligence Law provide intelligence services broad authority to access data and co-opt companies for national security investigations.

The operations are characterized by massive scale rather than fundamentally different techniques. China maintains more hackers and bureaucrats dedicated to cyber operations than any regional competitor, with activity focused primarily on intellectual property theft, economic advantage, and advancing scientific research. The country has established a mature operational segmentation system allowing multiple teams to rapidly exploit vulnerabilities once discovered, as demonstrated in the 2021 Microsoft Exchange Server compromise. Notable is the blurred line between state and non-state actors, exemplified by figures like Tan Dailin who transitioned from patriotic hacker to contracted MSS operator while maintaining criminal side businesses.

Since 2018, Chinese operations have grown more sophisticated and scalable, increasingly targeting supply chains and service providers rather than individual entities. The government has tightened control over the domestic vulnerability supply chain, requiring researchers to disclose findings to authorities rather than participate in international conferences. China also actively promotes surveillance technology and cyber capabilities abroad through diplomatic exchanges and training programs in the Global South, supporting broader goals around international norm-making in multilateral institutions.

## Mentioned in this report

- Threat actors: Tan Dailin, WICKED PANDA
- Campaigns: Titan Rain

Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-chinas-cyber-operations

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/684ee397-2ac6-5606-9dea-817c4e1071b9/chinese-cyber-ops-rely-on-contractors-scale.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup