Each domain holds a dated chronology of named, unclassified reporting. Every entry links back to the originating advisory or research publication.
Access to water, energy, transport and communications networks held for disruption in a crisis rather than for collection.
Open chronologyIntrusions into carriers, ISPs and lawful-intercept systems supporting a global espionage collection system.
Open chronologyCompromised routers, SOHO gear and IoT stitched into botnets that obscure attribution and stage onward operations.
Open chronologyCollection against government agencies, defense organizations, law enforcement and research institutions.
Open chronologyExploitation of trust relationships between service providers and their customers to reach many victims at once.
Open chronologyPublicly known CVEs and living-off-the-land tradecraft that PRC actors rely on for initial access and persistence.
Open chronologySearch and filter every dated entry by domain, country and date range.
SentinelLABS tracked sustained espionage against Pakistani law enforcement from February 2024 to April 2026. A suspected China-nexus actor planted implants in a Balochistan Police web application handling criminal and biometric records, reaching both police staff and citizens.
CISA and partners published tactics, techniques and indicators for covert networks built from compromised SOHO routers, IoT and smart devices. The advisory describes large-scale botnet infrastructure used to obscure attribution and enable reconnaissance and intrusion.
NSA, CISA, FBI and partners detailed a deliberate and sustained campaign by PRC state-sponsored actors compromising networks worldwide to feed a global espionage system.
CISA released mobile communications best practice guidance in direct response to identified PRC-affiliated espionage against commercial telecommunications infrastructure.
CISA and partners warned that PRC-affiliated actors compromised networks of major global telecommunications providers in a broad cyber espionage campaign, and published visibility and hardening guidance for communications infrastructure.
CISA and partners outlined the current threat APT40, tied to the PRC Ministry of State Security, poses to Australian networks, drawing on ASD ACSC incident response investigations.
CISA warned critical infrastructure leaders of urgent risk from Volt Typhoon and set out specific actions to prioritize protection of their organizations.
CISA, NSA and FBI assessed that PRC state-sponsored actors are pre-positioning on IT networks for disruptive or destructive attacks against US critical infrastructure in the event of a major crisis or conflict with the United States.
Detection information and mitigations for living off the land activity, which remains effective because many organizations lack the logging and baselining needed to spot abuse of built-in tools.
CISA and the FBI urged SOHO router manufacturers to build security into design and maintenance, citing ongoing targeting of small office and home office routers by Volt Typhoon.
NSA, FBI, CISA and Japanese partners detailed BlackTech tradecraft against branch routers, and urged multinationals to review subsidiary connections and consider zero trust to limit lateral movement.
The first joint advisory on Volt Typhoon described abuse of tools already present in victim environments to maintain anonymity inside critical infrastructure IT networks.
CISA, NSA and FBI published the top Common Vulnerabilities and Exposures used by PRC state-sponsored actors since 2020, most of them in internet-facing network devices and services.
CISA, NSA and FBI described continued exploitation of publicly known vulnerabilities in telecom and network service provider equipment to build a broad network of compromised infrastructure.
A baseline reference on Chinese cyber threat behavior and trends with mitigations for federal, state and local government, critical infrastructure and the defense industrial base.
CISA and the FBI published detection and remediation guidance for APT40 intrusions alongside the Justice Department indictment of four Chinese nationals working for the Ministry of State Security.
CISA partners observed active exploitation of Exchange Server vulnerabilities, with tactics, techniques and indicators of compromise published for defenders.
CISA linked the likelihood of Chinese cyber activity to the state of the bilateral relationship and published associated TTPs and mitigations for critical infrastructure owners.
CISA observed MSS-affiliated actors relying on publicly available information sources and common open-source tooling to target US government agencies.
CISA, FBI and DoD described Chinese government use of TAIDOOR variants with proxy servers to maintain presence on victim networks and enable further exploitation.
CISA alerts covering the Cloud Hopper campaign, in which actors infiltrated global managed service providers from May 2016 for espionage and intellectual property theft across IT, energy, healthcare, communications and critical manufacturing.
Chinese government actors exploited trust relationships between IT service providers and their customers, stealing intellectual property and sensitive data from companies in at least twelve countries.