Trellix Report: Chinese Nation-State Cyber Activity Drops 41.4% in Q2-Q3 2026 Amid Shifting PRC Priorities
A Trellix threat intelligence report found that detected China-aligned nation-state cyber activity fell 41.4% between April and September 2026, a decline researchers link to shifting PRC intelligence priorities, possibly including greater focus on observing Western military and battlefield technologies. Despite the drop, Chinese nation-state activity remained substantially higher than that attributed to Russia and Iran during the same period, and researchers caution that lower detection volumes do not necessarily indicate reduced threat levels, citing prior cases such as the Weaver Ant campaign that went undetected for over four years inside an Asian telecom provider. Detection trends broadly tracked Chinese military and 'gray-zone' coast guard activity around Taiwan. The report, published November 4, 2026, identifies the US (38%) and Turkey (37.1%) as the primary nation-state targets, followed by Germany (4.4%), with transportation/shipping and telecoms sectors accounting for over half of detected campaign volume.
Detalhes técnicos
Over half (56%) of all nation-state detections were attributed to just 10 groups, led by Russia-aligned Gamaredon (9.03%), Pakistan-linked APT36 (7.84%), and China-nexus Mustang Panda (7.52%). Backdoors were the most common tool type (20.9% of detections), reflecting a focus on long-term persistent access over rapid exploitation, followed by infostealers (11.87%) used for data harvesting in compromised networks.
Linha do tempo
-
Trellix Report: Chinese Nation-State Cyber Activity Drops 41.4% in Q2-Q3 2026 Amid Shifting PRC Priorities
ler a análise desta fonte ocultar
A Trellix threat intelligence report found that detected China-aligned nation-state cyber activity fell 41.4% between April and September 2026, a decline researchers link to shifting PRC intelligence priorities, possibly including greater focus on observing Western military and battlefield technologies. Despite the drop, Chinese nation-state activity remained substantially higher than that attributed to Russia and Iran during the same period, and researchers caution that lower detection volumes do not necessarily indicate reduced threat levels, citing prior cases such as the Weaver Ant campaign that went undetected for over four years inside an Asian telecom provider. Detection trends broadly tracked Chinese military and 'gray-zone' coast guard activity around Taiwan. The report, published November 4, 2026, identifies the US (38%) and Turkey (37.1%) as the primary nation-state targets, followed by Germany (4.4%), with transportation/shipping and telecoms sectors accounting for over half of detected campaign volume.
Technical Details
Over half (56%) of all nation-state detections were attributed to just 10 groups, led by Russia-aligned Gamaredon (9.03%), Pakistan-linked APT36 (7.84%), and China-nexus Mustang Panda (7.52%). Backdoors were the most common tool type (20.9% of detections), reflecting a focus on long-term persistent access over rapid exploitation, followed by infostealers (11.87%) used for data harvesting in compromised networks.