Cyberwarfare is the strategic use of computer technology to disrupt the functions of a state or organization, specifically through the deliberate targeting of information systems for military or tactical purposes. In the People's Republic of China, it is related to the aggregate of cyberattacks attributed to state organs and related advanced persistent threat (APT) groups.

Concept

History The People's Republic of China did not have the capability to conduct cyber offensive operations until after 1991, the year it connected to the internet. In 1992, the People's Liberation Army (PLA)'s journal Foreign Military Arts stated that US was researching "computer virus weapons" that would have the potential to attack civilian targets and military targets. In the late 1990s, pro-government hacktivists such as Honker Union launched denial-of-service attacks on websites of perceived enemies such as the Taiwanese government and the Indonesian government following the May 1998 Indonesia riots.

The PLA began to develop cyber offensive capabilities after the United States bombed the Chinese embassy in Belgrade in 1999. Chinese Communist Party (CCP) leadership believed that the US had intentionally bombed the embassy and viewed China as lacking in leverage against the US. To reduce the gap in leverage, the general secretary of the CCP, Jiang Zemin, approved the development of cyber offensive capabilities in 2000. In a December 2000 speech to the Central Military Commission (CMC), Jiang stated, "[I]nformation warfare is in the ascendant on the stage of warfare, with electronic network warfare and computer network warfare as the principle means."

At the December 2002 CMC meeting, Jiang instructed the PLA to invest heavily in information warfare development and the PLA therefore established the All-Military Informatization Leading Small Group to coordinate this development.In 2004, when he became Chairman of the CMC, Hu Jintao instructed the PLA to engage in a "new historic mission" to defend China's interests in the electromagnetic (and space) domains. In 2004, the PLA attacked the networks of NASA, Lockheed Martin, Sandia National Laboratories, and other institutions in a cyber attack known as Titan Rain.

CCP leadership perceived that China was at an increasing risk of cyber threats from abroad. This perception was shaped from 2000 to 2010 by the early 2000s color revolutions, the Russian cyberattacks during the 2008 Russo-Georgian war, and the US-Israel Stuxnet cyberattack on Iran. The 2010s surveillance disclosures by Edward Snowden about the extent of US global surveillance programs also highlighted to CCP leadership the risks the country faced through its reliance on foreign hardware, software, and internet infrastructure.

The PLA's first cyber blue team was established in Guangzhou Military Region in May 2011 to test regular PLA unit's cyber defenses. At the 18th National Congress of the Chinese Communist Party in 2012, Hu Jintao stated China should "implement the military strategy of active defense for the new period, and enhance military strategic guidance as the times so require. We should attach great importance to maritime, space, and cybersecurity."

As part of its response to the United States intelligence activities in China demonstrated through the Snowden disclosures, the CCP in 2014 formed the Cybersecurity and Information Leading Group and the National People's Congress passed the 2017 Cyber Security Law. Under the general secretaryship of Xi Jinping, the Chinese government has sponsored regular hacking competitions to identify top talent for state recruitment and, since 2018, has legally required all vulnerabilities discovered to be reported solely to the Ministry of Industry and Information Technology. In 2018, Chinese nationals stopped participating in international hacking competitions.

During the New Gutian Conference, Xi Jinping stated that cyber conflict was one of the main areas of military competition for the PLA and described the PLA as needing to overcome its "ostrich" attitude and rigid ways of thinking in this area. According to Xi's remarks, "Currently some work is not at all suitable for the requirements of the cyber era, and it is already increasingly clear that ideas and concepts and work methods are lacking in this age".

In a 2016 cybersecurity speech, Xi stated that government, the PLA, and private enterprise should acquire cyber technology at the level of its rivals and that China needed to develop a "situational awareness posture at all times and in all locations". Xi stated that "if others use air strikes and we are still using swords and spears, that is unacceptable; offensive and defensive capabilities must be symmetrical." In 2019, he stated that China "continues to advance in the direction of balancing offensive and defensive cyber power" and that the country's "cyber-security deterrence capability to strike back continues to grow."

In 2020, a Chinese cybersecurity firm, Qihoo 360, publicly claimed that a cyber espionage campaign was attributed to the Central Intelligence Agency. In a December 2024 meeting, a Chinese Ministry of Foreign Affairs official stated that Chinese cyberattacks against U.S. infrastructure are a response to American policies toward Taiwan.

Academic Fiona Cunningham writes that while it has targeted U.S. critical infrastructure with Volt Typhoon, as of mid-2024, there have been no public reports of a Chinese cyberattack with a scope similar to the United States-Israel Stuxnet cyberattack on Iran, or the Russian cyberattacks on Ukraine's power grid).

In 2025, Chinese advanced persistent threat Salt Typhoon was reported to have infiltrated over 200 targets in over 80 countries, gaining access to several United States House of Representatives committees as well as phones belonging to Donald Trump and JD Vance.

Organization While some details remain unconfirmed, it is understood that China organizes its resources as follows:

"Specialized military network warfare forces" () - Military units specialized in network attack and defense. "PLA-authorized forces" () - network warfare specialists in the Ministry of State Security (MSS) and the Ministry of Public Security (MPS). "Non-governmental forces" () - civilian and semi-civilian groups that spontaneously engage in network attack and defense.

In response to claims that Chinese universities, businesses, and politicians have been subject to cyber espionage by the United States National Security Agency since 2009, the PLA announced a cyber security squad in May 2011 to defend their own networks.

Since Xi became General Secretary of the Chinese Communist Party in 2012, the Ministry of State Security (MSS) gained more responsibility over cyberespionage compared with the PLA, and currently oversees various advanced persistent threats. According to security researcher Timo Steffens, advanced persistent threat (APT) groups in China leverage skills from private as well as public institutions and individuals, including smaller companies and hackers that take on government contracts.

On 31 December 2015, the PLA established the Strategic Support Force (PLASSF). The PLASSF combined PLA cyber units from various PLA bodies into the Network Systems Department which included cyber intelligence, defense, and attack capabilities. In April 2024, the PLASSF was dissolved and its cyberwarfare capabilities and personnel were transferred to the newly created People's Liberation Army Cyberspace Force.

In 2017, Foreign Policy estimated China's "hacker army" personnel at between 50,000 and 100,000 individuals.

List of related APTs

Allegations of espionage and cyber-attacks

African Union In 2020, Japan's Computer Emergency Response Team (CERT) reported that a suspected Chinese hacking organization dubbed "Bronze President" had hacked and extracted footage from the AU Headquarters' security cameras.

ASEAN In 2022, Chinese state-affiliated hackers compromised the email system of the ASEAN Secretariat.

Australia In May 2013, ABC News claimed that the Chinese government stole blueprints to the headquarters of the Australian Security Intelligence Organisation (ASIO). In May 2023, Australia, alongside other Five Eyes member states, identified the Chinese government behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure. In July 2024, government agencies from eight nations, including the Australian Signals Directorate, released a joint advisory on APT40.

Belgium In April 2024, the Belgian Foreign Ministry summoned the Chinese envoy after reports emerged that Chinese spies (APT31) hacked the laptops of key lawmakers such as the head of the Belgian Foreign Affairs Committee and former prime minister Guy Verhofstadt.

Brazil In 2022, a Chinese advanced persistent threat called ChamelGang, or CamoFei, attacked the presidency of Brazil in a cyber-espionage operation that used ransomware as a cover, according to a report by SentinelOne and Recorded Future.

Canada

Officials in the Canadian government claimed that Chinese hackers compromised several departments within the federal government in early 2011, though the Chinese government has denied involvement. In 2014, Canada's Chief Information Officer claimed that Chinese hackers compromised computer systems within the National Research Council. In May 2023, Canada's Communications Security Establishment identified the Chinese government as being behind the "Volt Typhoon" advanced persistent threat targeting critical infrastructure. In July 2024, government agencies from eight nations, including the Canadian Centre for Cyber Security, released a joint advisory on APT40.

Cuba In April 2026, it was reported that Chinese state-backed hackers compromised the emails of 68 officials at the embassy of Cuba in Washington, D.C. due to vulnerabilities in outdated Microsoft Exchange Servers.

Czech Republic In 2021, Czech Minister of Foreign Affairs Jan Lipavský was targeted in a Chinese cyberespionage campaign by the Ministry of State Security's APT31 group. In response, Lipavský stated "[t]his just proves the assessment in our Security Strategy, which states that the rising assertiveness of China is a systemic challenge that needs to be dealt with in coordination with our trans-Atlantic allies." In May 2025, the Czech Ministry of Foreign Affairs stated that it was targeted by APT31, saying that "[s]uch behavior undermines the credibility of the People’s Republic of China and contradicts its public declarations."

Denmark In March 2025, Denmark's Centre for Cyber Security (CFCS) stated that the Danish telecom sector was being actively targeted by state-backed hackers from China.

European Union On 22 June 2020, during COVID-19 pandemic, EU Commission President Ursula von der Leyen called out the People's Republic of China for allegedly conducting cyberattacks against EU hospitals and health care institutions. In May 2025, Kaja Kallas condemned the People's Republic of China for what she called a "malicious cyber campaign" against the Czech Ministry of Foreign Affairs and threatened sanctions. In March 2026, the EU imposed sanctions on China-based Integrity Technology Group and Anxun Information Technology for cyberattacks on multiple EU member states, including on critical infrastructure.

Finland In March 2021, the Finnish Security and Intelligence Service said China's APT31 had targeted the country's parliament in a cyber attack. In March 2024, Finnish police confirmed that APT31 breached the Parliament of Finland in March 2021.

France In May 2024, several French lawmakers, all belonging to the Inter-Parliamentary Alliance on China (IPAC), revealed that they had been targeted by China's APT31.

Germany