China remained the second largest adversary infrastructure hosting location at 13.55%, down from 17.57% the previous year.

China's amended Cybersecurity Law took effect on 1 January 2026 (passed 28 October 2025) with raised penalties and extraterritorial reach

China hosted 42.3% of all tracked Cobalt Strike infrastructure, the US hosted 18.9%, and Hong Kong hosted 15.8%.

BEAST threat actor leaked 700 GB of internal data from a large Chinese automotive group in late February 2026

Targeting of the logistics vertical by China-nexus actors increased by 85%.

40% of exploited vulnerabilities by China-nexus actors targeted internet-facing edge devices.

China-nexus activity increased by 38% in 2025.

67% of exploited vulnerabilities used by China-nexus actors delivered immediate system access.

Chinese state-sponsored adversaries targeted industries in 11 countries in 2025

75% of organisations in China reported implementing GenAI.

China's APT40 and Mustang Panda generated 46% of all detected APT activity.

China-aligned APT41 showed a 113% increase in activity in Q1 2025 relative to the previous quarter.

Of APT activity directed at the U.S., 47% was attributed to China and 35% to Russia-aligned groups.

Fear of China-backed threats has fallen sharply from 80% to 57% among financial organisations.

Across the globe, IT decision-makers consistently point to three dominant state-sponsored threats: Russia (73%), China (73%) and North Korea (40%).