STATE THREATS / READING THE ADVISORIES
Understand the activity.
Avoid the mythology.
Use attributed state-threat reporting to improve resilience without speculative catastrophe.
A state’s cyber capability is built through people, institutions, suppliers, access, and time. Looking only for a sophisticated piece of malware misses much of the system that makes sustained operations possible.
China’s cyber workforce, commercial contractors, vulnerability reporting, and access to critical infrastructure deserve examination together. They also require boundaries: different campaigns are not interchangeable, an indictment is not a conviction, and a credible risk scenario is not a prediction of inevitable collapse.
THE EXECUTIVE BRIEF
The decisions that matter.
- Examine the institutions and commercial relationships behind a campaign, alongside its technical tools.
- Separate documented access, assessed intent, and the consequences being modelled.
- Translate national-security reporting into specific dependencies, access decisions, and recovery tests.
THE OPERATING MODEL
Capability grows beyond a single hacking team.
The backstory includes a Bloomberg video on China’s hacking workforce. Its wider question remains useful: how does a country turn individual technical skill into a sustained capability?
Talent development, competitions, research organisations, private suppliers, and state customers can form an ecosystem. A competition result, an employer relationship, and a government operation are nevertheless different things. Participation in a technical community does not establish that a particular individual conducts state-directed intrusions.
For a business, the consequence is analytical. An adversary may acquire specialist services, use intermediaries, or retain access over time. Buying another security product will not, by itself, reveal which trusted supplier account, remote-access arrangement, or unmanaged device could support that access.
CONTRACTORS & INCENTIVES
The i-Soon disclosures made the commercial layer visible.
SentinelOne’s analysis of the February 2024 i-Soon leak examined material describing a contractor ecosystem and operational interests. Leaked conversations and documents provide leads and context; individual claims within them still require corroboration.
In March 2025, US prosecutors charged ten Chinese nationals in alleged hacking activity, including people associated with i-Soon and government customers. The allegations describe commercial hacking services and varied targets. They are prosecution allegations, not a finding that every contractor or person mentioned in a leak has been convicted.
Incentives and repeatable services are important. A customer can buy access or information without building every skill internally. That increases the need to examine how third-party administrators are selected, supervised, and removed, and how the business would recognise misuse of an otherwise valid connection.
THREE DISTINCT EVIDENCE FILES
Keep the claim attached to its evidence.
DISCLOSED MATERIAL
What a leak appears to show
Record provenance, authenticity checks, and the limits of what the material can establish.
OFFICIAL ALLEGATION
What an authority alleges
Name the authority and date. Keep allegations distinct from findings and convictions.
BUSINESS SCENARIO
What your service might lose
State assumptions about access, dependencies, and interruption before estimating consequences.
CyberSolace analytical distinctions. These are not three stages of a proven attack or a chart of a single organisation.
VULNERABILITY GOVERNANCE
A reporting rule is not proof of every subsequent use.
China’s 2021 network-product vulnerability regulation took effect on 1 September 2021. Article 7 requires network-product providers in scope to report relevant vulnerability information to the Ministry of Industry and Information Technology within two days. It also addresses remediation and notification; the regulation prohibits malicious exploitation.
That is more specific than saying every organisation worldwide must report every discovery to China within 48 hours. The existence of a reporting system does not establish that every submitted flaw is weaponised. Any claim about a particular vulnerability being withheld or used needs its own evidence.
The procurement question is broader than one country’s rule: how does a supplier handle vulnerabilities, who receives reports, when are customers told, and what happens if an important patch cannot be applied? Ask for an operational answer, including a workaround and a named owner for the residual risk.
TWO CAMPAIGNS / DIFFERENT EVIDENCE
Do not merge espionage accounts into one incident.
Microsoft’s May 2023 Volt Typhoon research described access to US critical infrastructure, including Guam, using legitimate tools and credentials. The 2024 joint government advisory assessed that the actor was pre-positioning for potential disruptive activity against critical infrastructure. That is a serious assessment of purpose, not evidence that every affected service had already been disrupted.
The distinction matters when reading telecom and Treasury reporting. In its 17 January 2025 announcement, the US Treasury associated Yin Kecheng with its own departmental compromise and separately sanctioned Sichuan Juxinhe for involvement in Salt Typhoon telecom activity. Those accounts should not be collapsed into an assertion that Salt Typhoon was proven responsible for that same Treasury incident.
Living-off-the-land techniques can make malicious activity harder to distinguish from administration. They do not make detection or removal impossible. Useful evidence includes the legitimacy of remote access, the account and device involved, the timing and purpose of administrative actions, and corroboration from identity and network records.
CONNECTED INFRASTRUCTURE
A charging flaw is not a demonstrated vehicle worm.
Electric-vehicle charging illustrates the reach of connected infrastructure. PlaxidityX’s 2024 EVerest research documented a charging-framework vulnerability, CVE-2024-37310, and its responsible disclosure and remediation. The demonstrated charging-station findings need to be distinguished from possible effects on a connected vehicle, which the researchers described as hypothetical.
This does not establish an autonomous-driving takeover, a charger-to-vehicle-to-charger worm, or a Chinese operation. Likewise, academic research on charging ecosystems identifies component and dependency risks; it is not an experiment demonstrating national grid collapse.
The defensible lesson is to examine an ecosystem rather than an isolated box. Charging equipment, management services, remote maintenance, payment, and the surrounding network may have different owners. A patchable device can remain exposed if nobody knows who maintains it or which upstream service it requires.
FROM NATIONAL RISK TO YOUR SERVICE
Model disruption without inventing a countdown.
A 24-, 48-, or 72-hour cascade is a scenario, not an established timetable for hospitals, food distribution, or fuel supply. Consequences depend on the services affected, duration, geography, reserves, alternatives, and recovery capacity. A business can still make serious preparations without presenting one imagined sequence as inevitable.
A SERVICE-DEPENDENCY FIELD NOTE
Choose one important operation and make the assumptions visible.
DEPENDENCY
What must remain available?
Name the power, communications, identity, software, supplier, and people required for a tolerable level of service.
EXPOSURE
Which trusted access could affect it?
Identify administration routes, supplier permissions, and exceptions that cross the service boundary.
RECOVERY
What can work during an interruption?
Test the fallback, communications route, recovery evidence, and authority to invoke them.
Illustrative business review. The relationship between a national threat and one organisation’s loss must be demonstrated, not assumed.
For the next review, ask the service owner to work with technology, procurement, facilities, and communications. Record what is known, what remains uncertain, and which test would change the decision. An exercise should include unavailable supplier support and reduced communications, rather than assume every dependency will cooperate.
The strategic insight survives the corrections: capability is cumulative, trusted access matters, and operational resilience reaches beyond the security team. The response becomes more useful when each claim is precise enough to support a decision.
A PRACTICAL NEXT STEP
Bring the threat back to a service you can test.
CyberSolace can help connect supplier access, operational dependencies, and recovery evidence with the decisions your management team needs to make.
SOURCES & EDITORIAL REVIEW
Historical findings and incident accounts are dated in the text. Illustrative review prompts are CyberSolace commentary. Editorial review: 20 October 2026.