Chinese Cyber Attack Statistics 2026: Hidden Cyber Risks Exposed

Chinese cyber operations continue to reshape global cybersecurity strategy. Government agencies, telecom providers, defense contractors, and energy operators now face sustained campaigns linked to espionage, infrastructure disruption, and long-term intelligence gathering. In the United States, investigations into Salt Typhoon and Volt Typhoon exposed how attackers infiltrated telecom and critical infrastructure systems for months without detection. Meanwhile, Asia-Pacific governments reported millions of daily attack attempts targeting public networks and semiconductor supply chains.

These attacks influence everything from military readiness and financial stability to AI development and global telecommunications security. As governments increase cyber defense spending and businesses strengthen incident response programs, understanding the scale and direction of Chinese cyber activity has become essential. Explore the full article for a detailed statistical breakdown of Chinese cyber attacks, threat actors, targeted sectors, and emerging trends shaping.

Editor’s Choice

• Chinese cyberattacks targeting Taiwan’s infrastructure averaged 2.6 million attacks per day in 2025, marking a 6% year-over-year increase.
• The FBI stated that Chinese-linked Salt Typhoon operations affected organizations across more than 80 countries.
• U.S. officials revealed that Salt Typhoon hackers accessed data connected to over 1 million individuals during telecom intrusions.
• CrowdStrike reported a 42% increase in exploited zero-day vulnerabilities during 2025, with China-linked actors among the most active groups.
• FBI Director Christopher Wray described Chinese cyber actors as the “most active and persistent cyber threat” facing U.S. infrastructure.
• The average eCrime breakout time dropped to 29 minutes in 2025, increasing pressure on organizations to detect advanced intrusions quickly.
• Seven major Chinese APT groups conducted coordinated campaigns across ASEAN countries, Japan, and Taiwan between 2023 and 2025.
• U.S. and allied agencies warned in 2025 that Chinese cyber actors increasingly rely on covert relay networks to hide espionage operations.
• Volt Typhoon infiltrated operational technology networks in U.S. utility infrastructure for nearly 10 months before detection.
• Researchers found that AI-assisted cyber operations contributed to an 89% rise in AI-enabled attacks globally during 2025.

Recent Developments

• In April 2026, the FBI declared a suspected Chinese surveillance-system breach a “major incident” due to national security risks.
• U.S. and Canadian agencies warned in late 2025 that Chinese hackers deployed sophisticated malware designed for long-term persistence in government systems.
• Intelligence assessments in 2026 stated that China’s cyber capabilities now rival those of the United States in several operational areas.
• Google’s threat intelligence reporting showed China-linked groups doubled zero-day exploitation activity during 2025.
• Taiwan’s National Security Bureau documented 40 Chinese joint combat readiness patrols paired with cyberattack escalation in 2025.
• U.S. agencies disclosed that Chinese hackers targeted telecom surveillance infrastructure tied to lawful intercept systems.
• CISA issued updated advisories in 2025 warning organizations about Chinese state actors feeding a global espionage system through compromised networks.
• Security researchers observed Chinese cyber groups increasingly using malware-free intrusion methods, making detection more difficult.
• In 2025, multiple China-linked campaigns targeted Taiwan’s semiconductor ecosystem, including suppliers and financial analysts.
• Analysts reported that Chinese cyber operations expanded beyond espionage into pre-positioning for potential geopolitical conflict scenarios.

Global Overview of Chinese Cyber Attacks

• China remains one of the world’s most active nation-state cyber operators, according to multiple Western intelligence assessments.
• Chinese cyber campaigns frequently target telecommunications, defense, energy, manufacturing, and government systems worldwide.
• Salt Typhoon operations reached organizations in 80 countries, making it one of the broadest cyber espionage campaigns disclosed in recent years.
• Researchers identified a growing shift toward attacks against operational technology and industrial control systems.
• Chinese-linked actors increasingly exploit edge devices such as routers and VPN infrastructure for initial access.
• Intelligence agencies reported that China-linked attackers maintain access within some victim environments for months or years before discovery.
• Analysts observed a rise in supply-chain compromises linked to Chinese espionage groups during 2024 and 2025.
• Malware-free techniques accounted for 82% of detections in modern threat campaigns during 2025, reflecting tactics used by advanced Chinese operators.
• China-linked campaigns increasingly target cloud environments and remote administration systems to evade detection.
• Security analysts noted that geopolitical tensions around Taiwan and semiconductor restrictions accelerated cyber activity across Asia-Pacific networks.

China-Origin Attacks Dominate State-Sponsored Cyber Activity

• China recorded the highest number of state-sponsored attacks, with 189 data theft incidents, making it the top country of origin in the chart.
• Data theft is the biggest attack category for China, accounting for 189 cases, far ahead of Russia’s 77 and Iran’s 62.
• China also leads in hijacking with misuse, with 105 attacks, showing that Chinese threat actors are heavily involved in both data theft and system misuse.
• Russia ranks second in data theft, with 77 attacks, but it shows a more balanced spread across categories, including 69 hijacking-with-misuse attacks and 61 disruption attacks.
• Iran shows a strong presence in hijacking with misuse, recording 63 attacks, slightly higher than its 62 data theft attacks.
• North Korea stands out for hijacking with misuse, with 44 attacks, which is higher than its 32 data theft incidents.
• The United States appears in the data with lower attack counts, including 22 data theft attacks, 17 disruption attacks, and 11 hijacking-with-misuse attacks.
• Disruption attacks are most strongly linked to Russia, which recorded 61 disruption incidents, compared with China’s 23 and Iran’s 24.
• Data theft and doxing attacks are relatively limited, with Russia leading this category at 18 cases, followed by Iran with 13 and the United States with 5.
• Ransomware activity is highest for China, with 18 ransomware attacks, followed by Russia with 8, Iran with 4, and North Korea with 1.
• Germany and France show very low activity levels compared with the major state-sponsored actors, with Germany recording only 3 data theft attacks and France just 1.
• Overall, the data suggests that China-origin cyber operations are heavily concentrated on data theft, while Russia shows stronger activity in disruption-based attacks.

Growth Trends in Chinese Cyber Operations

• China-nexus cyber espionage activity surged 150% in 2024–2025.
• Targeted attacks in financial services, media, manufacturing, and industrial sectors rose up to 300%.
• Chinese state-sponsored attacks escalated by 150% among nation-states in 2025.
• Average attacker breakout time fell to 48 minutes, with the quickest observed at 51 seconds.
• Chinese cyber威胁 against Taiwan averaged 2.6 million attacks per day on infrastructure in 2025.
• 78% of semiconductor IP attacks now exploit EDA tool supply chains (up from 65%).
• 1,400+ semiconductor IP breaches are projected for 2025, a 12% year-over-year increase.
• 71% of fabrication facilities are now compromised by nation-state actors.
• New cloud intrusions increased 26% in 2024 compared with 2023.
• Chinese threat groups account for approximately 4% of all targeting activity against manufacturers.

Chinese State-Sponsored vs Non-State Cyber Activity

• China-nexus cyber espionage activity surged 150% in 2024 compared to the previous year.
• Chinese hackers breached more than 50 telecommunications companies across 42 countries in a single campaign.
• At least seven separate Chinese APT groups conducted coordinated campaigns across ASEAN, Japan, Taiwan, and Indo-Pacific nations.
• Over 78% of Chinese hacking attacks are aimed at data theft, compared to 60% for Russian actors.
• Chinese APT groups are active for an average of 3 years and target around 4 countries per group.
• APT41 has been active for 13 years, combining state-sponsored espionage with financially motivated cybercrime.
• U.S. companies lose $225–$600 billion annually from intellectual property theft and counterfeit goods, largely from Chinese cyber operations.
• Over 57,000 ransomware attacks were recorded in the Asia-Pacific region in the first half of 2024 alone.

Targeted Sectors in China-Linked Cyber Operations

• Government & Defense was the most targeted sector, accounting for 26% of China-linked cyber operations.
• Telecommunications ranked second with 22%, showing that communication networks remain a major focus for cyber espionage and surveillance.
• Together, Government & Defense and Telecommunications made up 48% of all targeted sectors, nearly half of the total activity.
• Manufacturing & Industrial organizations represented 18% of targeted operations, highlighting risks to supply chains, industrial systems, and intellectual property.
• Financial Services accounted for 14%, indicating continued interest in banking systems, payment infrastructure, and sensitive financial data.
• Energy & Critical Infrastructure made up 12% of the targeting share, showing that essential services remain vulnerable to China-linked cyber campaigns.
• Media & Technology had the smallest share at 8%, but it still reflects interest in information control, technology platforms, and digital influence channels.
• The data suggests that China-linked cyber operations are concentrated on strategic, intelligence-rich, and infrastructure-heavy sectors rather than random targets.
• The top three sectors, Government & Defense, Telecommunications, and Manufacturing & Industrial, accounted for 66% of all targeting activity.
• This sector breakdown shows that China-linked cyber campaigns are strongly aligned with national security, economic intelligence, industrial advantage, and geopolitical influence.

Chinese Cyber Attacks on Critical Infrastructure

• U.S. officials confirmed Volt Typhoon targeted energy grids, transportation systems, water utilities, and communications infrastructure across the United States.
• Investigators discovered Chinese-linked hackers maintained unauthorized access to U.S. infrastructure systems for up to 300 days before discovery.
• The FBI warned in 2025 that Chinese cyber actors had infiltrated systems serving more than 23 U.S. pipeline operators.
• Analysts reported a 70% increase in operational technology targeting by state-backed groups between 2023 and 2025.
• Volt Typhoon primarily exploited outdated routers and edge devices rather than custom malware to avoid detection.
• U.S. agencies disclosed Chinese cyber actors focused on pre-positioning attacks capable of disrupting civilian infrastructure during geopolitical conflict.
• More than 55% of critical infrastructure organizations globally experienced ransomware or espionage-related attacks during 2025.
• Security researchers observed increased targeting of maritime logistics and port operations linked to Indo-Pacific trade routes.
• Chinese-linked campaigns increasingly targeted renewable energy infrastructure, including solar and battery supply systems.
• The average cost of a cyberattack affecting critical infrastructure exceeded $5.4 million globally in 2025.

Chinese Cyber Operations Targeting Telecommunications

• Salt Typhoon compromised 7 telecommunications companies across 42 countries in a global espionage campaign.
• Chinese hackers breached more than 50 telecom and government agencies by exploiting cloud platform features to hide their tracks.
• The telecom sector ranked among the top 5 most-targeted industries for nation-state cyber campaigns during 2025.
• Some telecom intrusions linked to Chinese actors remained undetected for over 18 months before discovery.
• More than 1 million individuals were affected by telecom-related espionage intrusions uncovered in 2025.
• Chinese threat actors compromised devices tied to 5 additional telecom providers in 2025, including 2 U.S.-based companies.
• Telecom attacks linked to Chinese groups surged after semiconductor export restrictions tightened in 2024 and 2025.
• Threat actors increasingly use living-off-the-land techniques and credential theft within telecom environments to evade detection.
• Researchers identified attacks targeting submarine cable infrastructure and satellite communication systems across the Asia-Pacific region.

Chinese Hacking Tactics Against Taiwan’s Critical Infrastructure

• Attacks on hardware and software vulnerabilities were the most common tactic, accounting for 57% of Chinese hacking activity against Taiwan’s critical infrastructure.
• DDoS attacks ranked second with a 21% share, showing that service disruption remains a major cyber pressure tactic.
• Social engineering attacks made up 18% of incidents, highlighting the continued importance of phishing, impersonation, and human-targeted cyber tactics.
• Supply chain attacks represented the smallest share at 4%, but they remain highly sensitive because they can compromise trusted vendors, software, or infrastructure partners.
• The top two tactics, hardware/software vulnerability attacks and DDoS attacks, together accounted for 78% of all observed hacking tactics.
• Vulnerability exploitation alone was nearly 3 times higher than DDoS attacks, showing that weaknesses in systems and software were the primary attack surface.
• The data suggests that Taiwan’s critical infrastructure faces the greatest cyber risk from technical exploitation, rather than purely human-driven or supplier-based attack methods.

Chinese Cyber Operations Targeting Europe

• European intelligence agencies detected a 40% increase in Chinese cyber espionage targeting telecom providers and government ministries in 2025.
• Germany, the UK, and France faced over 120 China-linked intrusion attempts against research institutions and defense suppliers during 2025.
• Chinese cyber groups targeted more than 45 European semiconductor and AI firms following U.S.-EU technology cooperation agreements in 2025.
• European telecom infrastructure attacks linked to Chinese actors increased by more than 35% between 2024 and 2025.
• The UK sanctioned 2 individuals and 1 company associated with APT31 over cyber espionage operations targeting lawmakers and voter data.
• Researchers found Chinese groups increasingly targeted maritime logistics systems connected to 18 European ports in 2025.
• Europe’s financial and banking networks remained a major focus, with credential theft attempts rising 52% for intelligence collection.
• EU cybersecurity agencies reported a 47% rise in attacks using compromised VPN and cloud credentials during 2025.
• Europe increased cyber defense investments by more than €2.3 billion in response to Chinese and Russian cyber threats during 2025.

Chinese Cyber Attacks on the United States

• FBI officials described China as the largest long-term cyber threat facing U.S. national security.
• Chinese-linked actors targeted more than 20 U.S. critical sectors, including defense, healthcare, energy, and transportation.
• The U.S. government estimated that Chinese intellectual property theft costs the American economy between $225 billion and $600 billion annually.
• Salt Typhoon operations breached at least 8 U.S. telecommunications providers and targeted over 80 countries globally.
• U.S. authorities dismantled a botnet of over 260,000 compromised devices, including 385,000 unique U.S. victim routers.
• Researchers observed increased targeting of U.S. semiconductor and AI companies after export-control measures expanded in 2025, with China-nexus activity surging 150%.
• China-linked phishing campaigns targeting U.S. government contractors rose by over 40% during 2025.
• Federal cybersecurity spending in the United States exceeded $13 billion in 2025, partly driven by concerns over Chinese cyber threats.

U.S. Experts Show Strong Concern Over China-Linked Cyber Attacks

• Retired military experts show the highest concern, with 87% saying cyber attacks from China are a “very serious” problem for the U.S.
• Business and trade experts rank second, with 70% expressing strong concern, showing that China-linked cyber threats are viewed as a major risk to commerce, supply chains, and trade operations.
• Scholars also report high concern, with 66% identifying Chinese cyber attacks as a very serious U.S. national security issue.
• Government experts follow closely, with 63% saying the threat is very serious, reflecting concern within U.S. policy and public-sector circles.
• News media experts show comparatively lower concern, with 50% rating the issue as very serious.
• The general public matches news media experts at 50%, suggesting that public concern is significant but lower than concern among military, business, academic, and government experts.
• The biggest gap appears between retired military experts at 87% and the general public at 50%, a difference of 37 percentage points.
• Overall, the data shows that U.S. expert groups are more alarmed about China-linked cyber attacks than the general public.

Chinese Cyber Operations Targeting Asia-Pacific

• Taiwan reported an average of 2.6 million cyberattack attempts per day against government and infrastructure networks in 2025.
• 173 attacks targeted Taiwan in 2025, far exceeding activity levels in other Asia-Pacific countries from China-linked APT groups.
• The APAC region saw a 38% year-over-year increase in cyber attacks in Q1 2025, with organizations facing 2,934 attacks per week on average.
• The semiconductor and IT sectors were the most frequently targeted in Asia-Pacific, with over 200 targeted attacks out of 150,000+ detected incidents in 2025.
• Asia-Pacific organizations experienced a 28% increase in credential theft incidents tied to state-aligned actors during 2025.
• Ransomware attacks in APAC surged by 51% in 2025, with 80% of data breaches beginning via system intrusions.
• Over 30,000 new vulnerabilities were disclosed in 2024, a 17% increase, with 14% of breaches starting through vulnerability exploitation.
• TeamT5 tracked more than 510 APT operations globally in 2025, with Chinese actors responsible for the majority targeting Asia-Pacific.
• Salt Typhoon may have compromised the data of millions of Australians, marking a major escalation in Chinese cyber espionage in the Indo-Pacific.

Chinese Cyber Attacks on Technology and Telecom Companies

• Chinese-nexus cyber activity surged 150% overall in 2025 compared to the previous year.
• Threats to the technology sector increased by over 119% from Q4 2024 to Q1 2025.
• Hackers breached more than 50 telecommunications companies across 42 countries in one Salt Typhoon campaign.
• Telecom and technology firms accounted for nearly 30% of all state-sponsored espionage incidents in 2025.
• China’s cyber army launched an average of 2.63 million intrusion attempts per day targeting critical infrastructure.
• The average breach cost for technology companies surpassed $5 million globally in 2025.
• AI-enabled cyber attacks rose by 47% globally in 2025, with many targeting AI chip and cloud firms.
• More than 1 million customer records were exposed during telecom espionage operations uncovered in 2025.
• 68% of cyber threat analysts report that AI-generated phishing attempts are harder to detect in 2025.
• The fastest breakout time for adversaries in 2025 dropped to just 51 seconds, with an average of 48 minutes.

Financial Sector Targeting by China-Linked Cyber Groups

• Financial institutions saw a +38% increase in attacks, showing that the finance sector has become a major target for China-linked cyber activity.
• Finance-related espionage campaigns affected 37 countries, highlighting the global scale of these operations.
• Around 30 financial institutions were targeted in an AI-assisted cyber campaign, suggesting attackers are increasingly using advanced tools to improve targeting and efficiency.
• The finance sector accounted for 14% of China-linked cyber campaigns, making it one of the notable areas of focus for cyber espionage.
• The data shows that China-linked groups are not only targeting government and defense networks but are also expanding operations against banks, financial services, and investment-related institutions.
• The combination of rising attack volume (+38%) and multi-country impact (37 countries) indicates that financial cyber threats are becoming more organized, scalable, and persistent.
• AI-assisted targeting of 30 institutions points to a shift toward more sophisticated cyber operations, where automation and intelligence tools may help attackers identify weaknesses faster.
• Overall, the financial sector remains a high-value target because it holds sensitive customer data, transaction records, payment systems, and economic intelligence.

Major Chinese-Attributed Cyber Incidents and Breaches

• Volt Typhoon maintained covert access for up to 5 years in some U.S. critical infrastructure systems before discovery.
• Salt Typhoon compromised 200+ organizations across 80 countries, according to FBI confirmation in August 2025.
• APT31 targeted thousands of U.S. and foreign politicians, plus millions of Americans whose accounts were potentially compromised.
• China launched 2.63 million cyberattacks per day against Taiwan’s semiconductor ecosystem and critical infrastructure in 2025.
• U.S. authorities dismantled the KV Botnet, with hundreds of infected devices used by Volt Typhoon to conceal attacks.
• Phishing campaigns impersonating government agencies increased by 1,265 percent, with AI-enabled attacks rising 47 percent globally.
• China-nexus cyber activity surged 150% overall in 2024, with financial services and manufacturing seeing up to 300% spikes.
• Salt Typhoon intrusions remained undetected for 18 months in one network, exposing data on over 1 million individuals.

Chinese Advanced Persistent Threat (APT) Groups by the Numbers

• Security analysts tracked more than 20 active China-linked APT groups operating globally during 2025.
• APT41 remained one of the most active Chinese cyber espionage groups targeting healthcare, telecom, and gaming sectors.
• APT31 operations targeted millions of individuals, including lawmakers, journalists, and government personnel.
• Volt Typhoon specialized in stealth-focused attacks against operational technology and critical infrastructure systems.
• Researchers identified at least seven coordinated Chinese APT campaigns targeting Asia-Pacific governments between 2023 and 2025.
• APT40 focused heavily on maritime, engineering, and academic organizations connected to South China Sea interests.
• China-linked APT groups increasingly use living-off-the-land techniques instead of custom malware deployments.
• Analysts reported that many Chinese APT campaigns prioritize persistence and intelligence collection over financial gain.
• APT10 previously targeted managed IT service providers to compromise large international enterprise networks.
• Chinese APT campaigns increasingly incorporate AI-assisted reconnaissance and automated phishing workflows.

Most Common Chinese Cyber Attack Techniques

• Vulnerability exploitation is the most common Chinese cyber attack technique, accounting for 57% of observed activity.
• The data shows that Chinese-linked attackers heavily rely on exploiting software flaws, unpatched systems, and security weaknesses.
• Phishing & social engineering ranks second with 18%, showing that human-targeted attacks remain a major entry point.
• Supply chain compromise represents 13% of attacks, highlighting growing risks from third-party vendors, software providers, and connected partners.
• Credential theft accounts for 9%, indicating that stolen usernames, passwords, and access tokens continue to support cyber intrusion campaigns.
• DDoS & disruption attacks make up 7%, showing that some campaigns focus on service outages and operational disruption.
• Malware implants & backdoors account for 6%, suggesting attackers often seek long-term access inside targeted networks.
• Zero-day exploits represent 5%, showing that advanced Chinese cyber operations still use previously unknown vulnerabilities, though less frequently than known flaw exploitation.
• Living-off-the-Land (LotL) techniques account for 4%, meaning attackers also use legitimate system tools to avoid detection.
• Overall, the data suggests Chinese cyber operations in 2026 are led by technical exploitation, supported by phishing, supply chain attacks, credential abuse, and stealth tactics.

Economic Impact and Estimated Costs of Chinese Cyber Attacks

• Chinese intellectual property theft costs the U.S. economy between $225 billion and $600 billion annually.
• The average global cost of a data breach reached $4.88 million in 2025.
• Critical infrastructure breaches linked to nation-state actors exceeded $5.4 million per incident on average.
• Telecom espionage incidents generated significant regulatory, legal, and remediation costs across multiple countries.
• Cybersecurity spending worldwide surpassed $215 billion in 2025 as governments and enterprises responded to rising threats.
• U.S. federal cybersecurity funding exceeded $13 billion during 2025 amid concerns about Chinese cyber operations.
• Semiconductor and technology companies faced billions in potential intellectual property exposure tied to espionage attacks.
• Financial institutions reported increasing compliance and cyber insurance costs due to geopolitical cyber risks.
• Analysts estimated that downtime from major infrastructure cyber incidents can exceed $500,000 per hour in some industries.
• Businesses worldwide increased spending on zero-trust security architectures and threat intelligence platforms in response to Chinese cyber campaigns.

Future Outlook and Forecast of Chinese Cyber Threats

• China-nexus cyber operations are expected to keep surpassing other nations in 2026, with forecasts emphasizing sustained high-volume activity and stealthy tradecraft.
• Threat actors are expected to use AI as the norm in 2026, accelerating social engineering, phishing, and recon across the attack lifecycle.
• Cloud systems remain a priority target, as recent campaigns have abused legitimate cloud services and APIs to hide command-and-control traffic across 53 organizations in 42 countries.
• Telecommunications and telecom providers are likely to stay in focus, with one 2026 campaign targeting providers worldwide and overlapping government networks.
• Semiconductor and AI-related espionage is intensifying, with one China-linked group focusing on semiconductors, defense, telecom, and advanced technology sectors globally.
• Export-control pressure is reshaping chip strategy, and one 2026 analysis says China’s domestic share of its AI chip market could rise to 50%.
• Operational technology and critical infrastructure are expected to face more pressure, with OT described as a major target in geopolitical cyber conflicts and industrial systems facing mounting attacks.
• Undersea cable risk is rising, and the global subsea cable systems market is projected to grow by about $4 billion over the next 4 years.
• Cybersecurity spending is projected to keep climbing through 2030, with the global cybersecurity market forecast at $500.70 billion by 2030 in one estimate and $699.39 billion by 2034 in another.
• Stronger cyber coordination is also emerging, as the U.S., Britain, Australia, and Japan have been discussing deeper security cooperation to counter China’s influence.

Frequently Asked Questions (FAQs)

Conclusion

Chinese cyber operations have evolved into one of the most significant cybersecurity challenges facing governments, businesses, and infrastructure operators. The data shows a clear shift toward long-term espionage, stealth-based intrusions, operational technology targeting, and AI-assisted attack techniques. From telecom surveillance campaigns like Salt Typhoon to infrastructure-focused operations linked to Volt Typhoon, Chinese threat actors continue to expand both their technical capabilities and global reach.

The United States, Europe, and Asia-Pacific nations have responded with higher cybersecurity spending, stricter telecom regulations, and stronger intelligence-sharing partnerships. At the same time, industries such as telecommunications, semiconductors, finance, defense, and energy remain under sustained pressure from increasingly advanced attacks.

As geopolitical competition intensifies around AI, semiconductor manufacturing, and critical infrastructure security, cyber operations will likely remain central to state strategy. Organizations that invest in zero-trust architectures, rapid threat detection, operational technology security, and supply-chain resilience will be better positioned to reduce exposure to future Chinese cyber threats.