PRC Ministry of State Security (MSS) Groups
China, Ministry of State Security (MSS) and its contractors (Tianjin State Security Bureau for APT10; Sichuan Juxinhe Network Technology for Salt Typhoon)
- State organ
- Ministry of State Security (MSS)
- Attribution basis
- On-record US and allied attribution to the MSS (July 2021 for Hafnium; 2018 indictment for APT10; 2025 Treasury sanctions for Salt Typhoon).
Mission Type
Strategic espionage and intellectual property theft, including mass exploitation (Hafnium), managed-service-provider compromise (APT10) and telecommunications intrusion (Salt Typhoon)
Primary Sectors
Operational Period
2009 – present
Attributed Cases
3
Attributed Cases
Activity Timeline
Attribution Basis
How firmly each operation is tied to this actor, and by whom. Confidence reflects the weight of public evidence, not intelligence-community ground truth (see methodology §08).
Attributed by Academic/Private Sector, UK Government, US Government, Allied Coalition · Consequences: Indictment, Public Naming
Attributed by US Government, EU, Allied Coalition, Academic/Private Sector · Consequences: Public Naming
Attributed by Academic/Private Sector, US Government, US Government, Allied Coalition · Consequences: Sanctions, Public Naming
TTP Pattern Summary
PRC-linked groups demonstrate proficiency in zero-day exploitation of public-facing applications, mass exploitation campaigns, and living-off-the-land techniques for persistent access. Volt Typhoon's use of legitimate system tools to avoid detection in critical infrastructure networks represents the most advanced form of this approach. Groups routinely target cloud identity infrastructure and authentication mechanisms.
Behavioural Signature
PRC-linked operations span a wide spectrum from targeted espionage (Storm-0558) to indiscriminate mass exploitation (Hafnium Exchange campaign) to strategic pre-positioning (Volt Typhoon). The willingness to shift from targeted to mass exploitation, and the Volt Typhoon pre-positioning pattern, distinguishes PRC operations from the more restrained SVR approach. Target selection reflects both traditional intelligence priorities and preparation for potential military contingencies.
Governance Footprint
Subject to the broadest multilateral attribution coalition to date (July 2021, including NATO's first attribution to China). Hafnium prompted the broadest international attribution coordination. Volt Typhoon generated the most significant Five Eyes joint advisory. PRC operations have driven major US legislative and regulatory responses including EO 14028 and proposed critical infrastructure legislation.