China Threat Overview and Advisories

Report to CISA

CISA works to ensure U.S. critical infrastructure, government partners, and others have the information and guidance to defend themselves against state-sponsored cybersecurity risks.

An image portraying a cybersecurity threat

State-Sponsored Cyber Threat Advisories

Review China-specific advisories here.

View Publications

Threat Environment

The Office of the Director of National Intelligence’s 2026 Annual Threat Assessment highlights persistent cyber threats to U.S. government, private sector, and critical infrastructure networks posed by Chinese government-linked cyber actors. These advanced persistent threat (APT) actors, such as Volt Typhoon and Salt Typhoon, exhibit tactics and target selection that extend beyond traditional cyber espionage or intelligence-gathering operations.

CISA, NSA, and FBI assess that Chinese government-linked APT actors are positioning themselves within information technology networks, enabling lateral movement to operational technology systems—the hardware and software that control critical infrastructure. This positioning allows them to disrupt critical functions at a time of their choosing. The relatively recent breach of U.S. telecommunications infrastructure by Chinese government-linked Salt Typhoon actors underscores the growing scope and sophistication of China’s cyber capabilities. CISA continues to address a wide range of Chinese state-sponsored cybersecurity threats.

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

Chinese Government-linked threat actors enabled by the Integrity Technology Group using botnets, VPNs, living off the land techniques, and exploitation tools to exfiltrate data and establish persistence.

View advisory

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

China-Based Super Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. SI Companies

CISA and partners issued this advisory to help U.S. super intelligence (SI) companies and their ecosystems identify, mitigate, and share information on knowledge distillation campaigns by China-based companies seeking to extract proprietary capabilities.

View Advisory

Collaboration in Action

CISA is actively countering the evolving cyber threats posed by Chinese state-sponsored APT actors through strategic initiatives to strengthen the defense of U.S. critical infrastructure. By working closely with U.S. government agencies, international partners, and industry stakeholders, CISA is fostering a more secure cyberspace, making it increasingly difficult for Chinese government-linked cyber threat actors to execute large-scale compromises.

Key CISA initiatives to actively strengthen defenses against Chinese state-sponsored APTs include:

Facilitating public-private collaboration to leverage private sector partner visibility and capabilities, collectively defending against Chinese government-linked cyber threat actors by hardening network edge devices.
Providing cybersecurity capabilities, services, and tools to address the most pressing and prevalent threats.
Partnering to investigate and mitigate zero-day and n-day exploitation of network edge devices by sophisticated Chinese government-linked cyber threat actors.
Strengthening cloud infrastructure on a large scale.
Collaborating with Sector Risk Management Agencies and critical infrastructure owners/operators to address sector-specific challenges, including those affecting the nation's pipeline infrastructure, aviation sector, and water/wastewater sector.