China has been identified as a “cyber superpower” by Sandra Joyce, Vice President of Google Threat Intelligence Group, who spoke at the Google Cloud Next 2025 event. Joyce highlighted the significant increase in China’s cyber capabilities, including a surge in zero-day vulnerability exploitation by Chinese state hackers since 2021. These hackers have shown remarkable skill in bypassing security controls and remaining undetected in networks, as demonstrated by the extended intrusion by the Volt Typhoon group in US government and critical infrastructure networks.
One concerning aspect of these cyber activities is the utilization of the “visibility gap” by Chinese state actors. By focusing on devices where traditional endpoint detection and response solutions do not operate, such as firewalls and edge devices, these actors have been able to avoid detection. Moreover, the use of rented infrastructure, updated every 30 days, has made it harder to track these hackers compared to identifying actor-controlled infrastructure used in intrusions.
Another tactic commonly employed by Chinese state actors is the initial use of commodity malware before deploying more advanced backdoors once full access is secured. Despite the access gained to critical infrastructure in the US and allies, such as energy and water, China has refrained from launching destructive attacks unlike other major nation-state cyber actors like Russia, Iran, and North Korea who have demonstrated such capabilities in the past.
Government officials have cautioned that China may be positioning itself within critical infrastructure systems to be able to initiate destructive attacks in case of escalating geopolitical tensions or military conflict. While espionage remains China’s primary focus, there is a possibility of unknown capabilities lurking beneath the surface.
Amidst concerns about nation-state cyber activities, Joyce emphasized that financially motivated cybercriminals pose the most significant threat currently. Heather Adkins, VP Engineering at Google, pointed out that cybercriminals often exploit basic security vulnerabilities like credential compromise and phishing attacks. Despite the familiarity with these tactics, the scale and automation of attacks are escalating, making it easier for cybercriminals to operate en masse without requiring complex hacking skills.
Overall, the evolving landscape of cyber threats involves a complex interplay between nation-state actors like China and cybercriminals perpetrating financially motivated attacks. As China solidifies its position as a cyber superpower, the challenge of combating its sophisticated cyber capabilities remains a top priority for cybersecurity professionals worldwide.