Chinese Military

Profile narrative

The threat actor is publicly identified as Chinese state‑sponsored operators, also referred to in open sources as the Chinese Military or Chinese State‑Sponsored Actors, and is assessed to be based in China. Attribution to the Chinese state is supported by multiple reports that link the activity to infrastructure owned by Tsinghua University, a Chinese academic institution, and to broader patterns of cyberespionage attributed to Beijing. The actor’s activities have been described as being conducted with at least medium confidence by Chinese state‑sponsored groups.

Targeting spans several sectors and geographic regions that align with China’s stated economic and security priorities. The actor has interfered with aviation navigation and communication systems of commercial aircraft operating in the western Pacific and South China Sea, as reported by Qantas and IFALPA. It has conducted network reconnaissance against government entities in Alaska, including the state’s Department of Natural Resources, coinciding with bilateral trade discussions. Reconnaissance has also been observed against organizations in Kenya, Brazil and Mongolia, countries that are part of China’s Belt and Road Initiative, and against the Tibetan community, which the Chinese government designates as one of the “Five Poisons” threatening domestic stability. In addition, the actor has targeted multinational corporations such as Daimler AG during periods of heightened U.S.–China trade tension and has attempted to exploit hospitality‑sector gateway devices linked to Nomadix infrastructure. Strategic objectives described in the sources include gathering intelligence to support China’s economic development goals, advancing Belt and Road Initiative interests, and monitoring perceived domestic threats.

The actor’s tactics, techniques and procedures emphasize network reconnaissance, port scanning and attempts to connect to previously compromised systems. A notable tool is the custom Linux backdoor named “ext4”, which was discovered on a Tibetan‑affiliated CentOS web server and was designed to execute hourly via a modified cron file, capture packets using libpcap, and await specific TCP flag sequences on port 443 before allowing command execution. The actor repeatedly used an IP address registered to Tsinghua University (166.111.8.246) as a launch point for scanning activities, employing services such as SSH, HTTP, SSL and VPN to masquerade as a gateway or proxy. Initial access appears to rely on probing for vulnerabilities in exposed services rather than phishing or credential theft, with the actor seeking to establish a foothold through legitimate‑looking connections to compromised servers. No other malware families are explicitly referenced in the provided material.

Significant publicly reported operations include the March 2023 incident in which vessels purporting to be Chinese military caused VHF, GNSS and radar altimeter interference affecting Qantas flights over the Pacific. In 2018, the same Tsinghua‑linked IP address conducted over one million connection attempts to Alaskan government and commercial networks, scanning ports associated with SSH, DNS, HTTP and other services amid high‑level trade talks between Alaska and China. The actor also attempted to activate the “ext4” backdoor on a Tibetan network, although the connection attempts failed due to incorrect TCP option settings. Additional campaigns cited in the sources involve the theft of personal data from Equifax, Anthem, Marriott and the Office of Personnel Management, which are attributed to Chinese military hackers and illustrate the actor’s ability to harvest large‑scale datasets for potential fusion with AI‑driven analysis. These examples demonstrate a pattern of state‑aligned cyber activity that combines reconnaissance, technical tooling and data collection to advance China’s economic and security interests.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 3 sources.