Ministry of State Security

Profile narrative

The threat actor is known by the aliases MSS, Ministry of State Security, and Guoanbu, and is based in China. Multiple public attributions explicitly link the actor to the Ministry of State Security of China, indicating a state‑nexiated entity. The actor’s identity is consistently referenced in official reports and media analyses as representing Chinese state security interests. No alternative affiliations or criminal consortiums are described in the provided sources.

Targeting has included government delegations and parliamentary institutions in Belgium and Australia, media outlets critical of the Chinese government, defense contractors supporting U.S. naval research, large hospitality chains such as Starwood, health insurers like Anthem, and credit‑reporting firms such as Equifax. The geographic scope of observed operations spans Europe, Oceania, and the United States. Strategic objectives described in the sources are espionage‑gathering of political, policy, and personal data, and ideological efforts to assert control over information and suppress criticism. No public source cites a financial motive for the actor’s activities.

Observed tactics include the deployment of bot networks to generate high‑volume traffic, attempts to install spyware for credential and data harvesting, and the use of message manipulation, denial‑of‑service, and data‑manipulation techniques to disrupt services and alter content. Exfiltration of stolen information has been a recurring outcome, with attackers seeking passport details, credit card data, travel itineraries, policy documents, proprietary technical data, health identifiers, and security‑clearance records. Defenders have noted the use of honey‑pot environments to analyze these methods, but the actor’s own tooling style is reflected in the reliance on automated bots and stealthy data‑collection tools.

Representative campaigns cited in the material are the 2019 bot‑driven attack on a Belgian trade mission in China that averaged 135 attacks per hour and attempted to install spyware targeting political data and passwords, the 2019 intrusion into Australia’s national parliament and major political parties that compromised policy documents on taxation and foreign affairs along with private email communications, the 2014‑2015 compromise of Starwood hotels that exposed roughly five hundred million guest records including passport details and credit card information, the 2015 Office of Personnel Management breach that yielded records on over twenty‑one million individuals including security‑clearance holders, the theft of Equifax data affecting 145 million Americans’ personal information, the Anthem breach that exposed 78 million Americans’ health identification numbers and employment details, and the compromise of a U.S. Navy contractor working on submarine warfare technology that resulted in the exfiltration of secret plans for a supersonic anti‑ship missile. These incidents illustrate a pattern of targeting governmental, media, defense, and commercial sectors to collect strategic intelligence.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.