Beijing's hackers are playing the long game

• Even the most routine spying campaign could leave China with backdoors to destruction for years to come.

Driving the news: At least three China-based hacking groups exploited vulnerable SharePoint servers in the last month, according to Microsoft.

• Researchers at Eye Security, which first discovered the SharePoint flaws, estimates that more than 400 systems were compromised as part of the SharePoint attacks.
• In this case, hackers also stole machine keys. That means the attackers can regain access whenever they want — even after the system is patched — unless admins take rare manual steps to rotate keys.

The big picture: China's state-linked hackers have been growing in sophistication over the last few years as they focus more on targeting technology and software providers with hundreds of customers, often including government agencies.

By the numbers: More than 330 cyberattacks last year were linked to China, double the total from 2023, according to CrowdStrike data shared with the Washington Post.

• Those numbers continued to climb in early 2025, according to CrowdStrike.

Between the lines: At least three major Chinese government teams have been targeting U.S. networks in recent years.

• Volt Typhoon has focused on breaking into endpoint detection tools to burrow deep into U.S. critical infrastructure, including pipelines, railways, ports and water utilities. Their goal is to maintain persistent access and be prepared to launch destructive attacks in the event of contingencies such as a war over Taiwan, experts say.
• Salt Typhoon, known for its compromises of global telecom networks, has focused on traditional espionage and spying. This group tapped cell phones belonging to President Trump, Vice President Vance and other top government officials. The FBI believes that threat is now "largely contained."
• Silk Typhoon — which has been linked to a recent breach of the U.S. Treasury Department and is known for the global 2021 Microsoft Exchange hacks — has been ramping up its work in recent months. The group uses previously undetected vulnerabilities, known as zero-days, to break into networks.

Zoom in: Researchers at cybersecurity firm SentinelOne have uncovered more than 10 patents tied to Silk Typhoon's work — a rarity among nation-state hackers.

• The patents — detailed in a report published Thursday — suggest the group was at one point developing new offensive tools, including to encrypt endpoint data recovery, conduct phone and router forensics and decrypt hard drives.

• The researchers also found that Silk Typhoon has links to at least three private sector companies.

The intrigue: Beijing's growing reliance on private contractors adds another layer of complexity — shielding state involvement while expanding capability.

• A DOJ indictment released last month details how the Shanghai State Security Bureau directed employees at tech companies to hack into computers across U.S. universities and businesses to steal information.
• A trove of leaked documents stolen from private Chinese contractor I-Soon early last year also highlighted how hired hackers targeted several U.S. government agencies, major newspapers and research universities.

State of play: China's growing cyber prowess comes as the Trump administration has diminished resources for its own cyber defenses.

• At least a third of the workforce at the Cybersecurity and Infrastructure Security Agency has left through voluntary buyouts, early retirements or layoffs. The Trump administration also wants to cut its budget.

Yes, but: The administration is expected to invest heavily in its own offensive cyber powers — with $1 billion from the "One Big Beautiful Bill" heading to the Pentagon for just that purpose.

What to watch: Intelligence agencies around the world are experimenting with AI and exploring new agentic possibilities.

• AI companies have increasingly warned that nation-state hackers are actively playing with their tools.