China’s cyber espionage becomes harder to contain due to AI-enabled scale, speed

New Delhi: China-linked cyber operations, particularly by state-aligned hacking groups, are becoming harder to contain as artificial intelligence (AI) and automation allow attackers to conduct credential attacks and access attempts at unprecedented speed and scale, a new report has said.

The report from Colombo-based publication Asian News Post also pointed to a pattern of attack that can create risks across a much broader network of organisations unlike traditional attacks that targeted a single organisation.

The report mentioned the 2026 breach of US software provider ConnectWise-- a trusted technology supplier done by a China state-aligned group tracked using an AI-enabled penetration-testing framework that automated parts of its campaign.

The campaign targeted organisations across the defence, energy, finance, government and technology sectors creating concerns of access that persisted even after the initial breach was contained.

ConnectWise's software has trusted connections to other organisations, using which the attackers could reach multiple customers without breaking into each organisation independently.

The publication alleged that Chinese state-linked cyber actors repeatedly target suppliers, service providers on which many organisations depend while their intended victims could be government communications, political dissidents, critical infrastructure and private companies.

It cites previous campaigns including Salt Typhoon, which US authorities said compromised telecommunications networks.

"The campaign also extended beyond the United States, prompting warnings about the security of global telecommunications infrastructure. Telecommunications networks are particularly valuable because they carry enormous amounts of information about how people communicate," the report noted.

Even without intercepting every conversation, the campaign can gain access to call records and related data to reveal parties in communication and their location.

"In March 2025, the US Justice Department charged 10 Chinese nationals in connection with hacking activities conducted through i-Soon, a China-based cybersecurity company," the report said.

The indictment said the company collaborated with Chinese public security and state security agencies from 2016-2023 to compromise email accounts, mobile phones, servers and websites.

ABOUT THE AUTHOR

IANS

[email protected]