Dutch Intelligence Says China Likely Matches U.S. in Offensive Cyber Capabilities
Summary
The MIVD assesses that China probably matches the U.S. in offensive cyber capabilities and says only a limited share of operations against Dutch interests is detected and mitigated. It links the threat to PLA restructuring and reports access to Dutch providers’ routers.
Key points
- The MIVD assesses that China probably stands on equal footing with the U.S. in offensive cyber capabilities.
- The agency estimates that only a limited proportion of Chinese cyber operations against Dutch interests is detected and mitigated.
- The MIVD links increased flexibility in Chinese tooling and infrastructure to the PLA’s 2024 cyber restructuring, and forecasts more campaigns targeting vulnerabilities in edge devices.
- The MIVD says the Salt Typhoon and RedMike campaign gained access to routers at smaller Dutch hosting and internet service providers in 2025; Dutch officials said the hackers were not believed to have penetrated beyond router-level networks.
- The report identifies telecommunications, research institutions, businesses and universities as targets, including organizations in semiconductor, quantum computing and aerospace sectors.
- The MIVD says China can better integrate offensive cyber capabilities with military operations and warns that its operations test Dutch and allied defenses.
Article Details
- Event Type
- Dutch military intelligence assessment warning that China has likely reached parity with the United States in offensive cyber capabilities, alongside reporting on Chinese cyberespionage and intrusions.
- Impact
- The MIVD estimates that only a limited proportion of Chinese cyber operations against Dutch interests is detected and mitigated. It reports that Salt Typhoon and RedMike accessed routers at smaller Dutch hosting and internet service providers in 2025; the Ministry of Defence said the hackers were not believed to have penetrated beyond the routers into internal networks. A separate investigation found that the COATHANGER campaign had infected at least 20,000 FortiGate systems worldwide, and the MIVD says infections were difficult to identify and remove. The assessment warns of risks to telecoms, research, businesses, universities, and critical sectors, and of China’s ability to integrate cyber operations with military plans.
People
Threat Actors
Salt TyphoonThe MIVD described a Chinese cyberespionage campaign tracked as Salt Typhoon and RedMike that gained access to routers at smaller Dutch hosting and internet service providers in 2025.Volt TyphoonU.S. officials and Five Eyes partners have assessed that this PLA-linked group is pre-positioning implants in Western critical infrastructure for possible activation in a future conflict.
Malware
Products
Countries
ChinaChina has likely reached parity with the United States in offensive cyber capabilities, and the Netherlands’ MIVD warns that only a limited proportion of Chinese operations against Dutch interests are detected andNetherlandsChina has likely reached parity with the United States in offensive cyber capabilities, and the Netherlands’ MIVD warns that only a limited proportion of Chinese operations against Dutch interests are detected andTaiwanWashington has said the most likely trigger is Taiwan.United StatesChina has likely reached parity with the United States in offensive cyber capabilities, and the Netherlands’ MIVD warns that only a limited proportion of Chinese operations against Dutch interests are detected and
Industries
AerospaceChina is also actively targeting Dutch researchers, businesses and universities, the MIVD says, seeking technology from the semiconductor, quantum computing and aerospace sectors.Critical infrastructureofficials and Five Eyes partners have assessed is pre-positioning implants in Western critical infrastructure for potential activation in a future conflict.Internet service and hostingThe country’s Ministry of Defence had previously confirmed “smaller internet service and hosting providers” had been targeted by the threat group, though it said the hackers were not believed to have penetrated beyondquantum computingChina is also actively targeting Dutch researchers, businesses and universities, the MIVD says, seeking technology from the semiconductor, quantum computing and aerospace sectors.