Chinese State-Backed Threat Actors: Key Tactics and Defensive Priorities
Summary
A Picus overview of Chinese state-backed threat actors highlights shared relay networks built from compromised edge devices, contractor and tooling ecosystems, rapid appliance exploitation, stealth techniques, and defenses including patching, device replacement and en
Key points
- The article says a CISA-led advisory describes shared relay networks built from compromised SOHO routers, IoT devices and end-of-life edge appliances, routing activity through geographically local nodes.
- It describes contractor-supported operations and shared tools such as ShadowPad, PlugX, HyperBro and Cobalt Strike, which can complicate attribution based on tooling alone.
- The article says groups rapidly exploit internet-facing appliances, sometimes within hours or days of vulnerability disclosure, citing products including Ivanti, Fortinet, Cisco, Juniper and Microsoft Exchange.
- Described post-compromise techniques include DLL sideloading, living-off-the-land binaries, web shells and, among some actors, hypervisor- or firmware-level implants.
- The overview highlights Volt Typhoon’s use of the KV-Botnet, UNC3886’s targeting of hypervisors and network appliances, and Salt Typhoon’s focus on telecommunications infrastructure.
- Recommended defenses include rapidly patching exposed appliances, replacing end-of-life devices, monitoring behavior such as LOLBin abuse and DLL sideloading, and hardening identity and cloud access.
Article Details
- Topic
- Chinese state-sponsored threat actor tradecraft, shared covert networks, and defensive priorities
MITRE ATT&CK
T1003 · OS Credential DumpingThe article describes LSASS credential dumping and extraction of NTDS.dit.T1014 · RootkitUNC3886 and Salt Typhoon use rootkits for stealthy persistence.T1053.005 · Scheduled TaskScheduled tasks are described as a common persistence mechanism.T1059.001 · PowerShellGroups use PowerShell for post-compromise execution.T1078 · Valid AccountsOperators use stolen credentials and valid accounts to access target environments.T1090.003 · Multi-hop ProxyOperators route traffic through multiple compromised devices to obscure its origin.T1190 · Exploit Public-Facing ApplicationGroups exploit internet-facing appliances and services for initial access.T1195.002 · Compromise Software Supply ChainEvasive Panda has replaced legitimate software updates with trojanized payloads.T1199 · Trusted RelationshipAPT10 compromised managed service providers to access downstream customer environments.T1486 · Data Encrypted for ImpactStorm-2603 has reportedly deployed Warlock ransomware after SharePoint exploitation.T1505.003 · Web ShellGroups deploy web shells on public-facing servers and appliances for persistence.T1547.001 · Registry Run Keys / Startup FolderRegistry Run keys are described as a common persistence mechanism.T1566.001 · Spearphishing AttachmentMustang Panda and other groups deliver malicious documents through spear-phishing emails.T1566.002 · Spearphishing LinkAPT31 uses credential-phishing campaigns targeting individuals.T1574.002 · DLL Side-LoadingMultiple groups abuse legitimate executables to load attacker-controlled DLLs.
CVE
CVE-2021-26855Microsoft · Microsoft Exchange Server 2013 Cumulative Update 21; Microsoft · Microsoft Exchange Server 2013 Cumulative Update 22; +22 more] Vulnerabilities commonly exploited (context for timely patching, often observed in exploitation) – CVE-2021-26855 (Exchange ProxyLogon), CVE-2021-44228 (Log4Shell), and numerous Ivanti/Citrix/VMware/FortiOS CVEs.CVE-2021-44228Apache Software Foundation · Apache Log4j2(context for timely patching, often observed in exploitation) – CVE-2021-26855 (Exchange ProxyLogon), CVE-2021-44228 (Log4Shell), and numerous Ivanti/Citrix/VMware/FortiOS CVEs.CVE-2023-46805Ivanti · ICS; Ivanti · IPSIn January 2024, the group chained CVE-2023-46805 and CVE-2024-21887 to compromise thousands of Ivanti Connect Secure and Policy Secure devices within a short timeframe.CVE-2024-21887Ivanti · ICS; Ivanti · IPSIn January 2024, the group chained CVE-2023-46805 and CVE-2024-21887 to compromise thousands of Ivanti Connect Secure and Policy Secure devices within a short timeframe.CVE-2025-0282Ivanti · Connect Secure; Ivanti · Neurons for ZTA gateways; +1 moreThis activity continued through 2024 and 2025 with additional Ivanti zero-day exploitation, including CVE-2025-0282 and CVE-2025-22457, highlighting a persistent focus on edge infrastructure as an entry point.CVE-2025-22457Ivanti · Connect Secure; Ivanti · Neurons for ZTA gateways; +1 moreThis activity continued through 2024 and 2025 with additional Ivanti zero-day exploitation, including CVE-2025-0282 and CVE-2025-22457, highlighting a persistent focus on edge infrastructure as an entry point.CVE-2025-53770Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreNotable CVEs exploited: CVE-2021-26855 (Exchange ProxyLogon), CVE-2021-44228 (Log4Shell), and CVE-2025-53770 (SharePoint ToolShell, observed in 2025 activity).CVE-2025-53771Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreModus operandi: Storm-2603 emerged in mid-2025 through exploitation of the SharePoint ToolShell vulnerability chain, specifically CVE-2025-53770 and CVE-2025-53771.
Threat Actors
APT10Reportedly compromised managed service providers to reach downstream customers during Operation Cloud Hopper.ARMORY CASTLEA China-nexus cluster reported to have exploited Ivanti edge appliances at scale and deployed appliance-specific web shells.BRONZE HIGHLANDReportedly compromises service providers and manipulates software update traffic to deliver trojanized payloads.Flax TyphoonThe article reports that Raptor Train was operated on its behalf as a covert network of infected devices.HafniumReportedly mass-exploited Exchange ProxyLogon; the article identifies Silk Typhoon as its alternate name.Mustang PandaReportedly targets governments and NGOs using spear-phishing, DLL sideloading, and PlugX variants.Salt TyphoonReportedly compromised telecommunications carriers and established persistent access to network infrastructure.Silk TyphoonIdentified by the article as HAFNIUM; reportedly shifted toward abuse of stolen credentials, API keys, and OAuth tokens.SPIRE CASTLEReportedly conducts espionage and financially motivated operations and uses shared malware including ShadowPad.Storm-2603A China-nexus cluster reported to exploit SharePoint ToolShell and sometimes deploy Warlock ransomware.UNC3886A China-nexus cluster reported to exploit hypervisors and network appliances and deploy infrastructure-level implants.Volt TyphoonAttributed to PRC state-sponsored activity, the group uses compromised routers as relays and maintains low-profile access to critical infrastructure.
Malware
BUSHWALK‘web shells on public-facing servers remain a primary persistence mechanism’ (China Chopper, ASPXSpy, BUSHWALK).China ChopperA shared malware/tooling economy (ShadowPad, PlugX, HyperBro, Cobalt Strike, China Chopper) drives cross-group reuse of implants, RATs, web shells, and loaders, complicating attribution by artifact alone.HyperBroA shared malware/tooling economy (ShadowPad, PlugX, HyperBro, Cobalt Strike, China Chopper) drives cross-group reuse of implants, RATs, web shells, and loaders, complicating attribution by artifact alone.Medusa[T1014 ] Rootkit – Use of kernel/hypervisor/rootkit implants for deep persistence: ‘REPTILE Linux kernel rootkit, MEDUSA rootkit’ (UNC3886).Moonbouncerelay model, OT pre-positioning), UNC3886 (hypervisor and network appliance implants), APT41 (UEFI Moonbounce), and Storm-2603 (SharePoint ToolShell â Warlock ransomware).PlugXThe ecosystem leverages an industrial contractor model, a shared malware/tooling economy (e.g., ShadowPad, PlugX), and advanced tradecraft such as DLL sideloading and hypervisor/UEFI implants to enable scale andShadowPadThe ecosystem leverages an industrial contractor model, a shared malware/tooling economy (e.g., ShadowPad, PlugX), and advanced tradecraft such as DLL sideloading and hypervisor/UEFI implants to enable scale andVIRTUALPITA[UEFI / Hypervisor implants ] Indicators of deep persistence at firmware/infrastructure layer – Moonbounce (UEFI implant), VIRTUALPITA / VIRTUALPIE (ESXi implants), MEDUSA (rootkit).Warlockand network appliance implants), APT41 (UEFI Moonbounce), and Storm-2603 (SharePoint ToolShell â Warlock ransomware).
Products
Cisco IOS XECommon initial access vectors now emphasize rapid exploitation of internet-facing appliances (Ivanti, Fortinet, Cisco IOS XE, Juniper, Citrix, Exchange, SharePoint, PAN-OS) often within days of CVE disclosure.ESXi[UEFI / Hypervisor implants ] Indicators of deep persistence at firmware/infrastructure layer – Moonbounce (UEFI implant), VIRTUALPITA / VIRTUALPIE (ESXi implants), MEDUSA (rootkit).FortiManagerIts campaigns frequently chain zero-day vulnerabilities across platforms such as VMware ESXi, vCenter, Fortinet FortiGate and FortiManager, and Juniper Junos OS, enabling deep persistence beneath the operating system.Fortinet FortiGateIts campaigns frequently chain zero-day vulnerabilities across platforms such as VMware ESXi, vCenter, Fortinet FortiGate and FortiManager, and Juniper Junos OS, enabling deep persistence beneath the operating system.Ivanti Connect Secure[Vulnerable Appliances / Products ] Frequently targeted internet-facing equipment and services (useful for detection/pivot hunts) – Ivanti Connect Secure, Cisco IOS XE, Fortinet FortiOS, and NetGear ProSAFE.Junos OS[T1542.003 ] Modify Firmware – Firmware and infrastructure implants on network devices and routers: ‘firmware- and infrastructure-level implants … Junos OS backdoors’ (UNC3886, Salt Typhoon).Microsoft Exchange ServerCommon initial access vectors now emphasize rapid exploitation of internet-facing appliances (Ivanti, Fortinet, Cisco IOS XE, Juniper, Citrix, Exchange, SharePoint, PAN-OS) often within days of CVE disclosure.Microsoft SharePointCommon initial access vectors now emphasize rapid exploitation of internet-facing appliances (Ivanti, Fortinet, Cisco IOS XE, Juniper, Citrix, Exchange, SharePoint, PAN-OS) often within days of CVE disclosure.Policy SecureIn January 2024, the group chained CVE-2023-46805 and CVE-2024-21887 to compromise thousands of Ivanti Connect Secure and Policy Secure devices within a short timeframe.VMware vCenter ServerIts campaigns frequently chain zero-day vulnerabilities across platforms such as VMware ESXi, vCenter, Fortinet FortiGate and FortiManager, and Juniper Junos OS, enabling deep persistence beneath the operating system.
Tools
Cobalt StrikeA shared malware/tooling economy (ShadowPad, PlugX, HyperBro, Cobalt Strike, China Chopper) drives cross-group reuse of implants, RATs, web shells, and loaders, complicating attribution by artifact alone.Earthworm[T1571 ] Non-Standard Port – Use of non-standard or tunneled channels such as FRP and Earthworm: ‘tools such as FastReverseProxy (FRP), Earthworm’ (Volt Typhoon).FastReverseProxy[T1571 ] Non-Standard Port – Use of non-standard or tunneled channels such as FRP and Earthworm: ‘tools such as FastReverseProxy (FRP), Earthworm’ (Volt Typhoon).ImpacketKey malware and tools: Minimal custom malware, with reliance on tools such as FastReverseProxy (FRP), Earthworm, Impacket, and extensive use of native Windows binaries.Mimikatz[T1003 ] OS Credential Dumping – Credential harvesting via Mimikatz and NTDS.dit extraction: ‘Mimikatz and LSASS dumping remain standard’ and ‘NTDS.dit extraction using ntdsutil’ (Volt Typhoon signature).ScanBox[T1595 ] Active Scanning – Use of ScanBox and reconnaissance frameworks to fingerprint targets prior to exploitation: ‘leverages the ScanBox reconnaissance framework to fingerprint users’ (Aquatic Panda).
Countries
AustraliaJapan remains a long-term strategic focus, alongside sustained activity in the U.S., U.K., Canada, and Australia.Indonesiainstitutions, with a strong focus on Southeast Asia, including Myanmar, Vietnam, the Philippines, Indonesia, and ASEAN-affiliated entities.JapanJapan remains a long-term strategic focus, alongside sustained activity in the U.S., U.K., Canada, and Australia.MalaysiaIts operations focus on Malaysia, Australia, the United States, the United Kingdom, Germany, and countries across South and Southeast Asia, aligning closely with strategic maritime priorities.Myanmarorganizations, and policy research institutions, with a strong focus on Southeast Asia, including Myanmar, Vietnam, the Philippines, Indonesia, and ASEAN-affiliated entities.Philippinespolicy research institutions, with a strong focus on Southeast Asia, including Myanmar, Vietnam, the Philippines, Indonesia, and ASEAN-affiliated entities.United StatesChinese cyber espionage dates back to the late 1990s and early 2000s, when reconnaissance and intellectual property theft campaigns targeting U.S.Vietnamand policy research institutions, with a strong focus on Southeast Asia, including Myanmar, Vietnam, the Philippines, Indonesia, and ASEAN-affiliated entities.
Industries
Aerospacedefense contractors, aerospace firms, and government agencies first emerged as a coordinated effort.Defensedefense contractors, aerospace firms, and government agencies first emerged as a coordinated effort.Educationincluding healthcare, telecommunications, technology, gaming, government, defense, pharmaceuticals, education, automotive, travel, media, and semiconductors.EnergyTarget sectors and regions: APT27 targets government, defense, aerospace, energy, and technology organizations worldwide, with a strong focus on intergovernmental bodies and political institutions across East Asia,Governmentdefense contractors, aerospace firms, and government agencies first emerged as a coordinated effort.Managed service providersTarget sectors and regions: APT10 has consistently targeted managed service providers (MSPs), aerospace, satellite, engineering, telecommunications, pharmaceuticals, and government organizations.TechnologyActive since 2010 | Attributed to the MSS Guangdong State Security Department through the front company Boyusec, also known as Guangzhou Bo Yu Information Technology.Telecommunicationsand European aerospace, defense, telecommunications, and technology firms before shifting around 2015 toward Hong Kong political organizations, pro-democracy activists, and regional governments.Transportationacross the United States and allied nations, including water and wastewater systems, energy, transportation, communications, and government networks.Water and wastewaterTyphoon targets critical infrastructure across the United States and allied nations, including water and wastewater systems, energy, transportation, communications, and government networks.