In recent years, China's role in global digital and economic systems has expanded, accompanied by a steady increase in cyber activity linked to Chinese-nexus operators.

To better understand this risk, Darktrace conducted a long-term review and threat hunt for evidence of cybersecurity incidents involving Chinese-nexus operators across its customer base over the last three years.

This review examined anomalous activity detected by Darktrace from mid-from July 2022 to September 2025. The goal of the report is to help defenders identify Chinese-nexus activity earlier - even as tools, infrastructure, and APT labels continue to change