# Chinese State Hacking Groups The intrusion units linked to China's intelligence and military apparatus — principally the **Ministry of State Security (MSS)** and the People's Liberation Army. Where [[Russian State Hacking Groups]] lean toward loud disruption and influence operations, China's leading groups specialize in **long-horizon strategic objectives**: large-scale economic and intellectual-property theft, deep espionage, and — most alarmingly in recent years — quietly pre-positioning inside the critical infrastructure of rival states. Microsoft tracks the major government-linked Chinese actors under weather-themed **"Typhoon"** names (CrowdStrike uses "Panda"; Mandiant uses APT numbers). ## Volt Typhoon — pre-positioning for sabotage Disclosed publicly in 2023–2024 by Microsoft and CISA, **Volt Typhoon** burrowed into U.S. critical-infrastructure networks — power, water, communications, and transportation, including facilities on Guam — not to steal data but to **establish persistent, pre-positioned access** that could be activated to disrupt or sabotage during a future crisis, such as a conflict over **Taiwan**. Its hallmark is **"living off the land"**: using legitimate built-in system tools rather than custom malware, which makes the intrusion blend into normal administration and evade detection. U.S. officials framed it as a fundamental shift — from espionage toward battlefield preparation. ## Salt Typhoon — the worst telecom hack in U.S. history **Salt Typhoon**, linked to the MSS, executed what officials have called the most damaging telecommunications breach in American history. Beginning around 2024, it compromised at least nine U.S. telecom carriers — including **AT&T, Verizon, Lumen, and T-Mobile** — and gained access to: - **Call and text metadata** for more than a million users, including phones tied to the **Trump and Vance** campaign and **Harris** campaign staff; - The **CALEA "lawful intercept" systems** — the court-ordered wiretap infrastructure U.S. law enforcement relies on — meaning the surveillance backdoor built for American agencies became an open door for Chinese intelligence. Carriers announced containment in December 2024, but officials repeatedly cautioned the group might retain footholds; by August 2025 the FBI reported Salt Typhoon had hit roughly **200 organizations across 80 countries**, and allied agencies (including Australia's ASIO) named both Salt and Volt Typhoon as ongoing infrastructure threats into late 2025. ## Right-wing-KB relevance The Typhoon campaigns sit at the center of contemporary U.S.–China security politics and several themes this vault tracks. Salt Typhoon is a live demonstration of the **"going dark" / encryption-backdoor dilemma** (see [[Crypto Wars and Encryption Policy]]): a wiretap capability mandated for lawful access became a catastrophic vulnerability when a hostile state walked through it — vindicating long-standing warnings that backdoors cannot be reserved for the "good guys." Volt Typhoon reframes cyber from espionage toward **infrastructure hostage-taking**, raising the stakes of any Taiwan contingency. And the campaigns are the offensive complement to China's defensive [[Great Firewall]] — the same state projecting power outward while sealing its own networks. ## Distinct from neighbors - **[[Russian State Hacking Groups]]** — Russia favors disruption, sabotage, and election influence; China favors economic espionage and quiet infrastructure pre-positioning. - **[[Great Firewall]]** — China's *inward-facing* censorship/surveillance system; the Typhoon groups are its *outward-facing* offensive operations. - **Volt vs. Salt Typhoon** — Volt pre-positions in infrastructure for potential sabotage; Salt conducts mass telecom/espionage collection. - **"Living off the land"** — the stealth technique (using native tools) characteristic of Volt Typhoon, distinct from custom-malware intrusions. ## See Also - [[Russian State Hacking Groups]] - [[Great Firewall]] - [[Supply-Chain Attack]] - [[Crypto Wars and Encryption Policy]] - [[Information Warfare Hub]] - [[Cybersecurity Lexicon]] - [[Cybersecurity]] — defending networks and infrastructure, and the politics of who is responsible