China State Cyber Operations Guide: Typhoon Groups, Edge Devices and Defence

China-linked state operators are the most persistent intrusion threat facing critical infrastructure and their suppliers, and they mostly get in through the edge devices and credentials defenders already own. CISA describes the People's Republic of China (PRC) as the most active and persistent cyber threat to US government, private sector and critical infrastructure networks, and joint advisories now carry the seals of more than twenty agencies across thirteen countries. This guide is the hub for that threat: how the PRC ecosystem of intelligence services and contractors is organised, how the main "Typhoon" and APT clusters differ, the edge device CVEs they reuse, the identity and credential techniques that keep them inside for years, and what to monitor and fix first. It is written for CNI defenders, SOC leads, network engineers and identity teams, and it links the individual actor profiles rather than repeating them.

Key takeaways

• Three mission sets, one toolkit. Pre-positioning in critical infrastructure (Volt Typhoon), long-term espionage inside telecom backbones (Salt Typhoon) and data theft through IT suppliers and cloud tenants (Silk Typhoon) all start with internet-facing devices and stolen credentials.
• Edge devices are the front door. VPN gateways, firewalls and routers from Ivanti, Palo Alto Networks, Cisco, Citrix and Fortinet appear in every major advisory, almost always as known, catalogued CVEs rather than zero-days.
• Credentials are the persistence. NTDS.dit copies, admin passwords stored on edge devices, TACACS+ secrets, SNMP community strings, SSH keys and secrets added to cloud service principals let these actors return after a patch.
• The ecosystem includes contractors. US prosecutors and allied agencies have named private PRC companies that hack for, sell data to, or build infrastructure for the state, which explains overlapping tooling and broad, opportunistic scanning.
• Patching is not eviction. Advisories repeat that a patched device can still hold attacker accounts, keys and configuration changes, so every exposure needs a compromise assessment and credential rotation.

How the PRC ecosystem is organised

Public attribution points to three state customers and a commercial layer around them. The Ministry of State Security (MSS) is the civilian intelligence service; MITRE ATT&CK records APT40 (Leviathan, Gingham Typhoon) as attributed to the MSS Hainan State Security Department and an affiliated front company. The People's Liberation Army (PLA) runs military cyber units. The Ministry of Public Security (MPS) is the police ministry and, in the March 2025 US Department of Justice case, a direct customer of contract hackers.

The commercial layer matters to defenders because it changes behaviour:

• Hacker-for-hire contractors: the Justice Department alleges that i-Soon (Anxun Information Technology) sold stolen data to at least 43 MSS and MPS bureaus in at least 31 provinces and municipalities, charging roughly $10,000 to $75,000 per email inbox breached. It describes many intrusions as speculative: scan widely, compromise what is vulnerable, then sell the data.
• Infrastructure companies: the September 2024 FBI, CNMF and NSA advisory attributes a botnet of more than 260,000 compromised routers, cameras and NAS devices (as of June 2024) to Integrity Technology Group, linked to activity tracked as Flax Typhoon.
• Intelligence suppliers: the August 2025 joint advisory AA25-239A names Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology and Sichuan Zhixin Ruijie Network Technology as providing cyber products and services to PRC intelligence services, including PLA and MSS units, in connection with Salt Typhoon-overlapping activity.

The practical consequence: a single exposed appliance may be hit by several clusters, and indicators shared between "different" groups are normal. Naming also varies by vendor: Microsoft uses the Typhoon suffix for China-based actors, CrowdStrike uses Panda, Mandiant uses APT and UNC numbers. See the Threat Actor Naming Conventions Guide.

The main groups at a glance

Aliases are taken from MITRE ATT&CK v20, which itself notes that vendor clusters overlap only partially. AA25-239A makes the same point: industry names "may not map 1:1" to government attribution.

Mission sets and what each means for you

Pre-positioning for disruption

AA24-038A (February 2024, updated March 2024) assesses that Volt Typhoon was positioning itself in IT networks to enable disruption of operational technology during a major crisis or conflict, and that this targeting is inconsistent with traditional espionage. Confirmed victims sit in Communications, Energy, Transportation Systems and Water and Wastewater Systems, including Guam, and some are small organisations that provide critical services to larger ones. Some intrusions lasted at least five years. The actors reached a vCenter server adjacent to OT and enumerated stored PuTTY sessions that could expose OT systems.

What it means: a utility, port operator or regional telecom with modest data value is still a target because of what it connects to. The IT to OT path is the asset being protected. See the OT Remote Access Guide.

Backbone and telecom espionage

AA25-239A, co-sealed by 23 agencies in 13 countries, describes actors overlapping with Salt Typhoon compromising backbone, provider edge and customer edge routers and using them to pivot into other networks, with telecom, government, transportation, lodging and military infrastructure targeted. Techniques include adding attacker IPs to ACLs (often "access-list 20"), opening SSH on non-standard high ports, building GRE and IPsec tunnels, mirroring traffic with SPAN, RSPAN and ERSPAN, and redirecting TACACS+ to capture TCP/49 authentication traffic. Salt Typhoon's ATT&CK entry includes Traffic Duplication (T1020.001), Network Device Configuration Dump (T1602.002) and Network Boundary Bridging (T1599).

What it means: if you run routers or rely on a carrier, the device configuration is now a security record that needs baselining and integrity checking. See the Telecom Network Security Guide.

Supply chain and cloud tenant theft

Microsoft's March 2025 reporting describes Silk Typhoon shifting to IT supply chain targets: remote monitoring and management firms, managed service providers, privileged access management vendors and cloud data management companies. Stolen API keys and credentials from those suppliers gave access to downstream customer tenants, most of them in state and local government and the IT sector. In tenants the actor added its own credentials to already consented applications with mailbox access and used Microsoft Graph and Exchange Web Services to take email, OneDrive and SharePoint data.

What it means: your exposure includes every vendor that holds an API key or admin path into your estate. See the Third-Party Access Guide.

Covert relay networks

Volt Typhoon proxied through compromised SOHO routers (the KV botnet), Silk Typhoon used compromised Cyberoam, Zyxel and QNAP devices that Microsoft tracks as "CovertNetwork", and the Flax Typhoon-linked botnet put 126,000 of its nodes in the United States. See the Operational Relay Box Networks Guide.

Edge device CVEs that recur in advisories

The table lists CVEs that official advisories or vendor intelligence tie to these clusters, with the date CISA added each to the Known Exploited Vulnerabilities (KEV) catalog. AA25-239A notes that no zero-day exploitation was observed in that campaign: known, patchable flaws were enough.

Two of these are well documented on NHI Mgmt Group breach pages. The Ivanti Connect Secure exploitation of 2024 shows the identity fallout: a credential harvester injected into the login page, unredacted configuration dumps, and CISA directing resets of stored API keys, service account passwords, local user passwords and certificates. The Edge Device Exploitation by Threat Actors Guide covers the exploitation pattern across all actors; hardening is in the Edge Device Security Guide.

How they abuse identities and credentials

Every cluster here converts device access into identity access. The credential types differ by mission:

Most of these are non-human identities that are rarely rotated or monitored. See the Salt Typhoon telecom intrusions, where Cisco Talos found that legitimate credentials, not exploits, were the initial access route in nearly every case it examined. The Device and IoT Identity Guide covers the device side.

Detection and measurement

These actors favour native tools and valid accounts, so detection relies on change and behaviour, not malware signatures.

• Windows and AD: AA24-038A points to ESENT Application log Event IDs 216, 325, 326, 327 and 637 (NTDS.dit copying or mounting, especially from temporary directories), Security Event ID 1102 (audit log cleared), and Terminal Services Local Session Manager Event IDs 21 to 25 for unexpected RDP sessions.
• VPN and remote access: impossible travel, unusual logon frequency or duration, new local users on devices with exploited CVEs, and VPN configuration changes.
• Network devices: AA25-239A recommends forwarding logs over an encrypted channel to a central collector, AAA command accounting, and alerts on on-box packet captures, new SPAN sessions and Guest Shell commands. Diff running configurations, ACLs, static routes, tunnels, AAA servers and local accounts against an approved baseline, and verify firmware hashes.
• Cloud tenant: Microsoft advises checking privileged service principals for newly added secrets, investigating new and multi-tenant applications and their sign-ins, and reviewing Graph and eDiscovery activity for SharePoint and mailbox exfiltration, alongside Entra Connect server logs.

Metrics that show the programme is working:

1. Median time from KEV addition to patch or mitigation on internet-facing devices, with a target in days, not weeks.
2. Percentage of network devices whose running configuration is compared to a baseline at least daily.
3. Number of edge devices holding domain-privileged or shared credentials (target: zero).
4. Percentage of privileged service principals with alerting on credential additions.
5. Percentage of supplier API keys inventoried with an owner, scope and rotation date.
6. Count of end-of-life internet-facing devices still in service.

How to prioritise and roll out

1. Inventory the edge (weeks 1 to 2): list every internet-facing VPN, firewall, router, load balancer and management interface, with owner, firmware version and end-of-life date. Match against the KEV catalog. Anything with an unpatched KEV entry is an incident candidate, not a backlog item.
2. Assess, then patch: for each exposed device, run the vendor integrity tool where one exists, capture logs and configuration before changing anything, then patch. Microsoft's Ivanti guidance is explicit: patch, run the Integrity Checker Tool and terminate active sessions.
3. Rotate what the device knew: local admin passwords, VPN service accounts, LDAP bind accounts, API keys, certificates, TACACS+ and RADIUS secrets and SNMP communities. Test rotation on one device first and keep the previous configuration for rollback.
4. Isolate management planes: move management to a dedicated VRF or out-of-band network, disable Smart Install, Telnet, HTTP management and Guest Shell where unused, and restrict management access with allowlist ACLs.
5. Harden tier 0 identity: phishing-resistant MFA for administrators, separate admin accounts, gMSAs for service accounts, cloud-native privileged cloud accounts and Conditional Access with no Global Administrator exemptions, as AA24-038A recommends.
6. Govern supplier access: inventory vendor API keys and multi-tenant apps, remove unused grants, and agree rotation and notification obligations.
7. Hunt for dwell time: assume historic access. Review the event IDs above as far back as logs allow, and plan eviction carefully: AA25-239A warns against alerting the actors before artefacts are collected.

Decision guidance

• Small organisations and critical service providers: the biggest gains are replacing end-of-life edge devices, changing default credentials, removing domain admin from anything internet-facing, and turning on vendor auto-update. AA24-038A specifically notes small providers to larger CNI as victims.
• Large enterprises: invest in configuration baselining for network devices, a tier 0 programme covering sync servers and federation, and supplier key governance. Run compromise assessments, not just vulnerability scans.
• Telecoms and ISPs: follow AA25-239A in full, including routing authentication, strict eBGP prefix filtering, GTSM and removal of default IKE policies.
• Replace or rebuild: if a device cannot be verified clean, or is past end of life, replace it rather than patch it. The Edge Device End of Life Replacement Playbook sets out the steps.

Common failure patterns

• Patch and walk away: applying a fix to an exploited VPN without hunting or rotating credentials. CISA warned in AA24-060B that the Ivanti integrity checker could miss compromise; attacker accounts and stolen secrets survive patching.
• Domain admin on the edge: VPN appliances bound to AD with highly privileged accounts, so one appliance compromise becomes a domain compromise, as AA24-038A describes.
• Unmonitored router configuration: no baseline, no command accounting, no central logs, so a new ACL entry or GRE tunnel goes unnoticed for years.
• Shared secrets that never change: TACACS+ keys, SNMP communities and Type 7 passwords set at installation and never rotated.
• Trusting supplier keys implicitly: vendor API keys with tenant-wide rights and no owner, no IP restriction and no alerting on use.
• Short log retention: 30 days of logs against a dwell time measured in years makes scoping impossible.

Lessons from incidents

• Salt Typhoon telecom intrusions: access persisted for more than three years in one case, and the actor moved from one carrier's devices to another's. Configuration files exposed SNMP strings and weakly encrypted local passwords. See the Salt Typhoon telecom intrusions breach analysis.
• Ivanti Connect Secure, 2024: zero-day exploitation from December 2023 by China-nexus UNC5221, then mass exploitation and over 1,700 compromised devices within days of disclosure, with session hijacking used to bypass MFA in at least one victim. See the Ivanti Connect Secure exploitation breach analysis.

Framework mapping

Practitioner checklist

• Maintain a current inventory of internet-facing devices with firmware and end-of-life dates, matched daily against the KEV catalog.
• Treat any unpatched KEV entry on an edge device as a possible compromise: collect evidence, run integrity tools, then patch.
• Remove domain-privileged accounts from edge devices and vault every device admin password.
• Rotate local accounts, service accounts, API keys, certificates, TACACS+ and RADIUS secrets and SNMP communities after any edge exposure.
• Move network device management to a dedicated VRF or out-of-band network and disable Smart Install, Telnet, HTTP and Guest Shell where unused.
• Baseline router and firewall configurations and alert on new ACL entries, tunnels, SPAN sessions, local accounts and packet captures.
• Alert on ESENT Event IDs 216, 325, 326, 327 and 637, Security Event ID 1102 and unexpected RDP sessions.
• Alert on new credentials added to privileged service principals and review multi-tenant apps and EWS grants.
• Inventory supplier API keys and RMM, MSP and PAM vendor access, with owners, scopes and rotation dates.
• Retain identity, VPN and network device logs long enough to scope multi-year dwell time.

Standards and references

• CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• NSA, CISA, FBI and partners: AA25-239A Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System
• FBI, CNMF and NSA: People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations
• US Department of Justice: Charges Against Chinese Contract Hackers and Law Enforcement Officers
• Microsoft Threat Intelligence: Silk Typhoon Targeting IT Supply Chain
• CISA: China Cyber Threat Overview and Advisories
• MITRE ATT&CK: Volt Typhoon (G1017)
• CISA: Known Exploited Vulnerabilities Catalog

Related NHI Mgmt Group resources: Volt Typhoon Threat Actor Profile · Salt Typhoon Threat Actor Profile · Silk Typhoon Threat Actor Profile Guide · Edge Device Exploitation by Threat Actors Guide · Iran State Cyber Operations Guide