It’s not just Salt Typhoon: All China-backed attack groups are showcasing specialized offensive skills | CyberScoop<\/title> <meta name=\"description\" content=\"CrowdStrike observed significant growth in China\u2019s offensive cyber capabilities last year as more groups used sector-specific skills to target critical industries and technologies.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/china-specialized-offensive-skills-crowdstrike\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"It's not just Salt Typhoon: All China-backed attack groups are showcasing specialized offensive skills\"> <meta property=\"og:description\" content=\"CrowdStrike observed significant growth in China\u2019s offensive cyber capabilities last year as more groups used sector-specific skills to target critical industries and technologies.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/china-specialized-offensive-skills-crowdstrike\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2025-02-27T08:01:00+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1278\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1739294329g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1739821441g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1740512861g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=9586249c695df0f3b26c\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83645\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83645\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-specialized-offensive-skills-crowdstrike%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-specialized-offensive-skills-crowdstrike%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83645 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/china-specialized-offensive-skills-crowdstrike\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.738019169329\">\n<div class=\"single-article__header-content\" readability=\"34.655601659751\">\n<p> CrowdStrike observed significant growth in China\u2019s offensive cyber capabilities last year as more groups used sector-specific skills to target critical industries and technologies. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83645\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"The Chinese national flag flies outside the Ministry of Foreign Affairs in Beijing on July 26, 2023. (Photo by GREG BAKER\/AFP via Getty Images)\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=768,511 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=1024,682 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=1536,1022 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=600,399 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=1014,675 1014w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-2.jpg?resize=1266,843 1266w\" sizes=\"(max-width: 1014px) 100vw, 1014px\"><figcaption> The Chinese national flag flies outside the Ministry of Foreign Affairs in Beijing on July 26, 2023. (Photo by GREG BAKER\/AFP via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"47.086787564767\"><body readability=\"95.160158311346\"><\/p>\n<p>Cyberattacks carried out by China-backed nation-state actors surged last year, showcasing technical advancements and specialized targeting in a broader escalation of the country\u2019s ability to infiltrate global critical infrastructure, CrowdStrike said in an <a href=\"https:\/\/www.crowdstrike.com\/en-us\/global-threat-report\/\">annual threat report<\/a> released Thursday.<\/p>\n<p>\u201cAfter decades of investment into China\u2019s offensive capabilities, they\u2019re now on par with other world powers,\u201d Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, said during a media briefing.<\/p>\n<p>China-linked intrusions jumped a \u201cterrifying\u201d 150% across all sectors in 2024 compared to 2023, Meyers said. The most significant increases were in financial services, media, manufacturing, industrials and engineering, sectors that experienced triple or quadruple the amount of China-related intrusions compared to the previous year.<\/p>\n<p>CrowdStrike observed significant growth in China\u2019s offensive cyber capabilities last year, with more nation-state-backed threat groups using specialized skills to target specific industries and technologies unique to those sectors. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Out of the seven new China-linked threat groups CrowdStrike identified last year, five showed distinct specializations and advanced capabilities. Among them were three groups, tracked as Liminal Panda, Locksmith Panda and Operator Panda, which targeted specific tasks and tools related to telecom networks.<\/p>\n<p>Operator Panda, a Chinese threat group more commonly known as Salt Typhoon, was linked to a <a href=\"https:\/\/cyberscoop.com\/salt-typhoon-national-security-council-chinese-spying\/\">spree of attacks on U.S. and global telecom providers<\/a> that started two years before U.S. officials discovered it last spring. The <a href=\"https:\/\/cyberscoop.com\/salt-typhoon-china-ongoing-telecom-attack-spree\/\">group remains active<\/a>, found on five additional telecom networks as recently as January, Recorded Future\u2019s Insikt Group said in a report earlier this month. <\/p>\n<p>The different specializations displayed by these groups marks a notable shift in the country\u2019s offensive capabilities, brought on by the country\u2019s yearslong effort to develop and maintain highly trained and readily available technical talent, the report found.<\/p>\n<p>The China-linked threat groups are also increasing efforts to stay undetected on the networks, Meyers said. Multiple threat groups established operational relay box (ORB) networks, which are botnets consisting of hundreds or thousands of compromised edge devices to route traffic during intrusions to obfuscate their operations.<\/p>\n<p>\u201cWhat used to be smash-and-grab \u2014 they would come in, steal what they could and leave \u2014 now they want enduring and persistent access,\u201d Meyers said.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Chinese threat groups pose a significant threat to critical infrastructure, particularly Volt Typhoon, a group CrowdStrike tracks as Vanguard Panda. That group has targeted critical infrastructure of logistics networks related to maritime operations, air transportation and intercontinental travel, Meyers said. <\/p>\n<p>China\u2019s offensive cyber operations are still largely focused on intelligence gathering, according to Meyers. Yet, as officials have warned, China-linked threat groups are <a href=\"https:\/\/cyberscoop.com\/chinese-cyber-threats-fbi-operation-botnet\/\">proactively intruding critical infrastructure networks<\/a> and maintaining access to potentially limit U.S. efforts to respond to conflicts, such as if China decides to invade Taiwan.<\/p>\n<p>If there is a conflict with China over Taiwan, the U.S. government would likely send a carrier strike team to the Taiwan Straits to try to dissuade China\u2019s aggression, Meyers said. \u201cIf they can\u2019t get food and water and all the things they need to constantly restock, then it\u2019s going to be real difficult to deter China,\u201d he said.<\/p>\n<p>\u201cThat is why pre-positioning, or what we would call operational preparation of the environment, are so important to be on the lookout for and why we need to deter China from doing these things,\u201d Meyers said.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.9065934065934\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/china-specialized-offensive-skills-crowdstrike\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It’s not just Salt Typhoon: All China-backed attack groups are<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[271,2350,78,3707,256,2953,288,1498],"tags":[277,2354,86,3708,262,2956,294,1499],"class_list":["post-7402","post","type-post","status-publish","format-standard","hentry","category-china","category-crowdstrike","category-cybersecurity","category-nation-state-threats","category-research","category-salt-typhoon","category-threats","category-volt-typhoon","tag-china","tag-crowdstrike","tag-cybersecurity","tag-nation-state-threats","tag-research","tag-salt-typhoon","tag-threats","tag-volt-typhoon"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/china\/\" rel=\"category tag\">China<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/crowdstrike\/\" rel=\"category tag\">CrowdStrike<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/nation-state-threats\/\" rel=\"category tag\">nation state threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/research\/\" rel=\"category tag\">Research<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/salt-typhoon\/\" rel=\"category tag\">Salt Typhoon<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/volt-typhoon\/\" rel=\"category tag\">Volt Typhoon<\/a>","tag_info":"Volt Typhoon","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7402"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7402\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7402,"date":"2025-02-27T02:01:00","date_gmt":"2025-02-27T08:01:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83645"},"modified":"2025-02-27T02:01:00","modified_gmt":"2025-02-27T08:01:00","slug":"its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/02\/27\/its-not-just-salt-typhoon-all-china-backed-attack-groups-are-showcasing-specialized-offensive-skills\/","title":{"rendered":"It\u2019s not just Salt Typhoon: All China-backed attack groups are showcasing specialized offensive skills"},"content":{"rendered":"