Loading story…
FireEye identified APT40 as a China-nexus espionage group active since at least 2013, targeting engineering, transportation, and defense organizations with a strong focus on maritime technologies and other sectors tied to China’s strategic interests. The group has used web server exploitation, spearphishing, web shells, credential theft, lateral movement, and legitimate platforms such as GitHub, Google, and Pastebin for command-and-control, while expanding targeting to countries relevant to the Belt and Road Initiative, including the U.S. and U.K.
Separate reporting alleged that APT40 is operated through a Hainan-based network tied to China’s Ministry of State Security (MSS), with front companies and recruitment activity linked to alleged intelligence officer Ding Xiaoyang. The broader reporting portrays APT40 as part of a larger Chinese state-directed cyber ecosystem in which responsibility for major offensive operations shifted from the PLA toward the MSS, supporting long-term espionage goals such as intellectual property theft, strategic intelligence collection, and rapid exploitation of newly disclosed vulnerabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Within a year of the December 2016 UUV seizure, FireEye observed APT40 masquerading as a UUV manufacturer and targeting universities engaged in naval research. FireEye linked this activity to the group's support for Chinese maritime objectives.
FireEye referenced a December 2016 incident in which China's People's Liberation Army Navy seized a U.S. Navy unmanned underwater vehicle in the South China Sea. The event was used as context for later APT40 targeting related to naval research.
Intrusion Truth claims that around 2015 the Chinese government moved the bulk of offensive cyber operations from the PLA to the Ministry of State Security. It links the shift to efforts to improve deniability after scrutiny of PLA-linked activity such as Unit 61398.
Intrusion Truth states that Cyb3rSleuth publicly identified Zhang Changhe in 2013 as a PLA-linked hacker. The article says Zhang Changhe worked as an assistant professor at the PLA Engineering University.
Intrusion Truth says a disgruntled PLA hacker identified as Wang wrote publicly in 2013 about conducting hacking for China. The article cites this as evidence of PLA-linked cyber activity during that period.
FireEye reported that APT40 had been active since at least 2013 and assessed its operations supported China's naval modernization effort. The group focused on engineering, transportation, and defense targets tied to maritime technologies.
A QQ group described as for 'internal members only' and later cited in research on an alleged APT40-linked network was created with 25 members. The group was used as part of the argument linking Ding Xiaoyang and others to Hainan state security structures.
A 2009 Renren exchange cited by Intrusion Truth said Ding Xiaoyang had started a new job with the Hainan Provincial Department of the Ministry of Public Security in Haikou. The article argues this may have been cover for Ministry of State Security work.
After the 2001 collision between a U.S. EP-3 aircraft and a Chinese F-8 fighter jet, Chinese hacktivists reportedly launched sustained DDoS attacks and website defacements against U.S. targets, with U.S. hacktivists retaliating against Chinese targets.
Intrusion Truth states that Hafnium and multiple Chinese APT groups concurrently exploited the Microsoft Exchange Server vulnerability. The article presents this as an example of overlapping Chinese state-linked and contractor activity.
Intrusion Truth published research claiming APT40 was operated through a Hainan-based front-company network and run by the Hainan department of the Ministry of State Security. The article identified Ding Xiaoyang as a likely operator or coordinator tied to that apparatus.
FireEye publicly reported on APT40, describing its maritime-focused espionage targeting, China-based indicators, and rapid weaponization of disclosed vulnerabilities. The company assessed with moderate confidence that APT40 is a state-sponsored Chinese cyber espionage actor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
intrusiontruth.wordpress.com
Open sourceintrusiontruth.wordpress.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google-owned Mandiant detailed how **APT41**, a China-linked threat group also known as **Double Dragon**, continues to blend state-aligned espionage with financially motivated intrusions. The reporting describes a long-running operation in which the group targets organizations across multiple sectors and geographies while using a broad toolkit of malware, compromised infrastructure, and hands-on-keyboard tradecraft to steal data, maintain persistence, and support intelligence collection. Mandiant said APT41 stands out because it operates at the intersection of **nation-state espionage** and **cybercrime**, shifting between strategic targeting and profit-driven activity without separating the two missions. The group has been tied to intrusions affecting enterprises worldwide and remains notable for its adaptability, operational scale, and ability to exploit trusted environments to advance both theft and surveillance objectives.
Jul 12, 2026
Multiple reports linked the Chinese espionage group **APT10**—also tracked as **MenuPass** and **Cicada**—to long-running intrusions that used **Poison Ivy**, **ChChes**, and **Sodamaster** against governments, NGOs, telecoms, legal, pharmaceutical, academic, media, and managed service provider targets across Asia, Europe, and North America. FireEye previously clustered Poison Ivy activity into the `menuPass`, `admin@338`, and `th3bug` campaigns, while Palo Alto documented `th3bug` watering-hole attacks that delivered Poison Ivy through compromised websites and infrastructure tied together by shared command-and-control patterns. Trend Micro also reported that the Japan-focused **ChessMaster** espionage campaign overlapped with APT10 in targeting, malware packaging, infrastructure, and tradecraft, and Symantec later said Cicada/APT10 expanded operations through prolonged intrusions, in some cases beginning with Microsoft Exchange access and persisting for months. Separate attribution research traced historical domain registrations, phishing metadata, social media accounts, and company records to alleged Tianjin-based operators including **Gao Qiang**, **Zhang Shilong**, and **An Zhiqiang**. Investigators said APT10-linked infrastructure such as `chromeenter[.]com`, `js001.3322[.]org`, `xiaohong[.]org`, and related domains connected to Tianjin email addresses, phone numbers, hostnames, and online personas including `fisherxp`, `baobeilong`, and `@gbaike`. The reporting argued that these overlaps tied real-world individuals and a Tianjin technology company to infrastructure associated with earlier **Cloud Hopper** and FireEye-tracked APT10 activity, strengthening claims that the group’s malware campaigns and domain operations were run by operators based in Tianjin, China.
Aug 15, 2026
Chinese state-linked intrusion groups have continued broad cyberespionage operations against governments, critical infrastructure, telecommunications, finance, technology, and research organizations across Europe, Southeast Asia, Russia, the United States, and other regions. Public reporting from ENISA/CERT-EU, CISA, and private threat intelligence firms links multiple campaigns to clusters including **APT27**, **APT30**, **APT31**, **GALLIUM**, **Mustang Panda**, **APT41/RedGolf**, **TA459**, and **RedHotel**, with activity focused on information theft, persistent access, and in some cases economic espionage. Authorities and researchers said these actors repeatedly exploited exposed enterprise systems such as Microsoft Exchange, SharePoint, Zimbra, Pulse Connect Secure, Citrix ADC, F5 BIG-IP, VMware vCenter, Atlassian Confluence, and ManageEngine, while also using spear-phishing, EU-themed lures, and spoofed domains to gain entry.
Aug 15, 2026