In 2025, the US and its allies attributed the massive Salt Typhoon cyber espionage campaign against Western telecommunications infrastructure to multiple China-based private firms.
These companies provided critical tools and services to China’s intelligence agencies, enabling highly sophisticated network compromises.
However, as of mid-2026, the exact roles these private entities played remain publicly unclear. This ambiguity highlights a fundamental shift in how Chinese state-sponsored threat actors operate.
Instead of relying on monolithic military units, these campaigns now utilize an interconnected ecosystem of private contractors, malware developers, and independent access brokers.
To accurately track and counter these threats, security researchers must move beyond the traditional “Advanced Persistent Threat” (APT) label and adopt a model of composite responsibility.
Chinese Contractors Aid Espionage
This evolution significantly complicates attribution and incident response for network defenders.
Disrupting a military-run operation carries high geopolitical stakes, while taking down a private contractor’s botnet might not trigger the same diplomatic fallout.
Furthermore, commercial tasking introduces dangerous ambiguity regarding whether a destructive attack was explicitly ordered by the state or resulted from a contractor’s own recklessness.
Activity conducted on private initiative requires an entirely different framework for response than a tightly controlled, state-directed campaign.
According to Bindinghook research, Modern campaigns frequently feature multiple entities contributing distinct functions, making it crucial to identify who acts as the operator, the enabler, or the state director.
Private-sector companies often develop and sell core capabilities used across various state-linked operations.
For example, developers sold the ShadowPad backdoor to suspected PLA units and the contractor Chengdu404, meaning responsibility for APT41 activity logically extends to the software creators themselves.
Data brokers also play a massive role by reselling stolen information to multiple government customers, adding layers of separation between the initial breach and the end intelligence consumer.
Hackers linked to APT27 regularly stole data and sold it through intermediaries like i-Soon, further muddying the attribution waters for threat intelligence analysts.
The ecosystem also heavily relies on specialized access and infrastructure providers to sustain long-term operations.
Initial access brokers, such as the MSS-linked contractor UNC5174, routinely compromise networks and sell their footholds to interested parties.
Some threat groups even engage in “premier pass-as-a-service,” securely sharing persistent access to critical network assets with other Chinese hacking teams.
Private companies also supply the network infrastructure needed to execute these complex campaigns. The US recently disrupted the Raptor Train botnet, attributing the malicious infrastructure to Integrity Technology Group.
This private firm built and managed the covert network used by the Flax Typhoon threat actor, demonstrating how enablers operate independently of the groups that deploy the payloads.
Recognizing this composite responsibility allows policymakers and defenders to differentiate roles and apply targeted countermeasures against specific operators, enablers, and state directors.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
