PRC State-Sponsored Actors (Organ Not Named)
China; governments attribute these operations to the PRC state without naming the responsible organ in public
- State organ
- None named
- Attribution basis
- On-record attribution to the PRC by the US and allies; no organ named.
Mission Type
Pre-positioning in critical infrastructure (Volt Typhoon), cloud email espionage (Storm-0558), personnel data theft (OPM)
Primary Sectors
Operational Period
2014 – present
Attributed Cases
4
Attributed Cases
Activity Timeline
Attribution Basis
How firmly each operation is tied to this actor, and by whom. Confidence reflects the weight of public evidence, not intelligence-community ground truth (see methodology §08).
Attributed by US Government, Academic/Private Sector, US Government · Consequences: Public Naming
Attributed by Contested/Unknown, Academic/Private Sector · Consequences: No Formal Response
Attributed by US Government, Academic/Private Sector · Consequences: Public Naming
Attributed by US Government, UK Government, Allied Coalition, Academic/Private Sector · Consequences: Law-Enforcement Action, Public Naming
TTP Pattern Summary
Living-off-the-land techniques with legitimate system tools (Volt Typhoon), forged authentication tokens from a stolen signing key (Storm-0558), and long-dwell credential-based access to government networks (OPM).
Behavioural Signature
Operations favour persistent, quiet access over disruption. Attribution names the PRC but not a service, so these cases are kept apart from the MSS and PLA profiles rather than assigned to one by assumption.
Governance Footprint
Five Eyes joint advisories on Volt Typhoon (2023, 2024), a court-authorised takedown of the KV botnet (2024), and the Cyber Safety Review Board report on Storm-0558 (2024). The OPM breach produced no formal foreign-policy response.