Collection against government agencies, defense organizations, law enforcement and research institutions.
SentinelLABS tracked sustained espionage against Pakistani law enforcement from February 2024 to April 2026. A suspected China-nexus actor planted implants in a Balochistan Police web application handling criminal and biometric records, reaching both police staff and citizens.
CISA and partners outlined the current threat APT40, tied to the PRC Ministry of State Security, poses to Australian networks, drawing on ASD ACSC incident response investigations.
A baseline reference on Chinese cyber threat behavior and trends with mitigations for federal, state and local government, critical infrastructure and the defense industrial base.
CISA and the FBI published detection and remediation guidance for APT40 intrusions alongside the Justice Department indictment of four Chinese nationals working for the Ministry of State Security.
CISA observed MSS-affiliated actors relying on publicly available information sources and common open-source tooling to target US government agencies.
CISA, FBI and DoD described Chinese government use of TAIDOOR variants with proxy servers to maintain presence on victim networks and enable further exploitation.