Chinese nation-state threat activity declined by 41.4% in the six months from April to September 2026, according to a new study by Trellix.
The researchers said the significant fall in detected activity could be linked to broader geopolitical developments and shifting People’s Republic of China (PRC) intelligence priorities.
These may include having a greater focus on observing Western military capabilities, such as battlefield technologies.
Overall, Chinese-aligned detection trends broadly coincided with changes in Chinese military and maritime activity around Taiwan. For example, cyber activity rose slightly from June to July 2026 at the same time as China expanded coast guard-led ‘gray-zone’ operations around the Island.
This activity includes reports of Chinese coast guard ships patrolling Taiwan-controlled waters.
Despite the sharp fall in China-aligned detections, observed PRC cyber activity remained “substantially higher” than nation-state cyber activity from Russia and Iran during the period, the researchers noted.
“The decline may reflect changes in targeting, infrastructure or detection visibility rather than a reduction in activity. The key takeaway is that lower detection levels do not necessarily mean a lower threat, particularly as China-aligned activity remains higher than that of other nation-state actors,” they wrote.
A number of Chinese nation-state espionage campaigns have gone undetected for long periods in recent years. For example, in 2025, the Chinese-nexus actor Weaver Ant was found to have infiltrated the network of an Asian telecommunications service provider and remained undetected for more than four years.
Such cases highlight that there may be significant ongoing Chinese nation-state activity occurring that has not yet been detected.
US and Turkey Primary Targets for Nation-State Actors
The Trellix report, published on November 4, found that nation-state targeting primarily focused on two countries, the US (38%) and Turkey (37.1%), which collectively represented over three-quarters of all detections from April to September.
The researchers noted that the US represents a valuable target due its status as the world’s largest economy and the concentration of high-value technology, defense and government infrastructure. Meanwhile, Turkey also represents a key strategic target given its location at the intersection of Europe, the Middle East and Central Asia, as well as its NATO membership.
The third most targeted country by nation-state actors was Germany, representing 4.4% of such activity.
Transportation and shipping and telecomS together made up over half of all detected campaign volume. The researchers said this reflects an intense focus on intelligence collection across logistics, global supply chains and telecommunications.
Over half (56%) of all detections attributed to nation-state actors came from 10 groups. The most prevalent was Russia-aligned Gamaredon (9.03%), Pakistan-linked actor APT36 (7.84%) and China-nexus actor Mustang Panda (7.52%).
Backdoors were the most common type of tool deployed by nation-state actors, observed in 20.9% of detections. This highlights these actors’ focus on long-term access over swift exploitation for intelligence-gathering purposes.
Infostealers (11.87%) was the second most common tool detected, used to assist data harvesting activities in compromised networks.