Experts dissect China's state cyber-operations model
An Atlantic Council expert panel analyzes how China blends state security services, contracted hackers, and private tech firms to conduct large-scale espionage and IP theft.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Atlantic Council '5x5' piece brings together five China cyber policy experts to discuss the structure, evolution, and distinguishing features of Chinese state-linked cyber operations. Panelists highlight the 2021 Microsoft Exchange Server exploitation and the career of Tan Dailin (aka WickedRose, linked to APT41/WICKED PANDA) as illustrative of China's model: a blend of patriotic hacking talent, contracted teams, and formal ties to the Ministry of State Security (MSS) and People's Liberation Army (PLA), with operational segmentation allowing rapid, wide distribution of exploits once stealth is lost.
The discussion emphasizes that China's cyber apparatus relies heavily on non-state contractors and private tech companies (citing Huawei and Alibaba as examples) operating under legal frameworks like the 2017 Cybersecurity Law and National Intelligence Law, which compel cooperation with state security services. Experts note China's operations have grown in scale and sophistication since 2018, shifting toward supply-chain attacks, targeting of service providers, and increased focus on US critical infrastructure such as natural gas pipelines. The piece also references the historic Titan Rain campaign and the Nortel/Huawei espionage case as examples of long-running economic and political intelligence collection.
Overall, this is an analytical/policy piece rather than an incident report — it contains no new technical indicators, active exploitation details, or fresh vulnerability disclosures, but provides structural and historical context on China's cyber threat landscape, including references to APT41 and past CISA/FBI/NSA advisories on exploited CVEs.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-chinas-cyber-operations
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs