Fewer Chinese State-Linked Cyber Detections Do Not Mean a Lower Threat, Trellix Warns

Detected Chinese nation-state cyber activity dropped by 41.4% in the six months from April to September 2026, according to a new Trellix study. The researchers suggested the fall could be linked to wider geopolitical developments and shifting intelligence priorities in China, such as a greater focus on observing Western military capabilities. Detection trends also broadly matched changes in Chinese military and maritime activity around Taiwan, with a slight rise in cyber activity from June to July as China expanded coast guard-led 'gray-zone' operations near the island.

Despite the drop, China-aligned activity stayed "substantially higher" than nation-state activity from Russia and Iran. The researchers said the decline may reflect changes in targeting, infrastructure or detection visibility rather than a real reduction in activity. They pointed to past cases of long-running, undetected espionage. In 2025, the Chinese-nexus group Weaver Ant was found to have been inside an Asian telecommunications provider's network for more than four years without being noticed.

The report, published on November 4, found that nation-state targeting focused mainly on the United States (38%) and Turkey (37.1%), together accounting for over three-quarters of all detections in the period. The researchers described the US as a valuable target because of its economy and its concentration of technology, defence and government infrastructure, and Turkey as strategically important because of its location and NATO membership.