China-Linked Cyber Threat Activity Drops 41% in 2026

Detected China-linked cyber threat activity fell by 41.4% during the six-month period between April and September 2026, according to a study by Trellix.

Despite the significant decline in detections, researchers noted that Chinese-aligned activity remains substantially higher than the nation-state cyber activity observed from Russia and Iran during the same period.

Shifting Strategic Priorities and Detection Risks

The decline may reflect changes in targeting, infrastructure, or detection visibility rather than a true reduction in offensive operations. Researchers warned that lower detection levels do not necessarily equate to a lower threat level, citing instances where Chinese-nexus actors have remained undetected in networks for several years.

The risk of long-term undetected persistence is well-documented. In 2025, the Chinese-nexus actor Weaver Ant was found to have infiltrated an Asian telecommunications provider and remained undetected for more than four years.

The Trellix study suggested the recent drop could be linked to evolving intelligence priorities within the People’s Republic of China (PRC), potentially involving an increased focus on monitoring Western military capabilities and battlefield technologies. A minor increase in cyber activity was recorded between June and July 2026, coinciding with expanded Chinese coast guard-led ‘gray-zone’ operations around Taiwan.

Primary Targets and Industry Focus

Nation-state targeting was heavily concentrated on two countries: the United States (38%) and Turkey (37.1%), which together accounted for over three-quarters of all detections. Germany was the third most targeted nation, representing 4.4% of activity.

The telecommunications, transportation, and shipping sectors were heavily impacted, collectively making up more than half of all detected campaign volumes. This suggests an intense intelligence-gathering focus on global supply chains and logistics infrastructure.

Common Tactics and Threat Actors

In terms of technical deployment, backdoors were the most frequent tool used by nation-state actors, appearing in 20.9% of detections. This indicates a strategic preference for maintaining long-term access for intelligence gathering rather than immediate exploitation. Infostealers were the second most common tool, utilised in 11.87% of cases to assist in data harvesting.

Among the specific groups identified, the China-nexus actor Mustang Panda accounted for 7.52% of detections. Other highly active groups included the Russia-aligned Gamaredon (9.03%) and the Pakistan-linked APT36 (7.84%).