Strategic Support Force of the People's Liberation Army - The Cyber Security Incident Database (CSIDB)

Attribution profile

Type: Nation State
Location: China
Known incidents: 1 incident
Sources: 0 sources
First seen: 2018-12-19
Last seen: 2018-12-19
Updated: 2026-10-14 01:44
Aliases: 3 aliases

STIX characteristics

Threat actor characteristics are available to members.

Profile narrative

The Strategic Support Force (SSF) of the People's Liberation Army, also referred to as SSF, is a Chinese state‑affiliated threat actor based in China. It has targeted diplomatic and government bodies, including ministries of foreign affairs, European Union diplomatic networks, United Nations agencies, financial ministries, trade unions and policy think tanks, primarily in Europe and within international organizations. The actor’s observed tactics involve phishing emails to gain initial access and the exploitation of common vulnerabilities, with no specific malware families referenced in the reporting. Attribution to the SSF is publicly established, linking the activity to the PLA’s Strategic Support Force and thus to the Chinese state. A representative example is the 2018‑12‑19 campaign that compromised Cyprus’s Ministry of Foreign Affairs, accessed the EU’s COREU network and subsequently affected UN agencies and other institutions, resulting in unauthorized access to sensitive diplomatic correspondence.

Incidents

Attributed incidents are available to members.

1 incident

Sources

Sources available to members: 0 sources.