Chinese Cyber Espionage on the Rise: A New Era of Aggression
In a sobering reminder of the evolving threat landscape, CrowdStrike's 2025 Global Threat Report has revealed a staggering 150% surge in Chinese-backed cyber espionage operations across the world in 2024. This significant increase marks a worrying trend, as high-profile campaigns like Volt Typhoon and Salt Typhoon made headlines in the past year, but are likely only a fraction of the extensive Chinese cyber espionage activity that has been unfolding in the shadows.
Targeted Industries Under Siege
Critical industries such as finance, media, and manufacturing saw up to a 300% spike in targeted attacks, highlighting the growing sophistication and aggressiveness of Chinese cyber espionage operations. The sheer breadth and depth of this activity underscore the need for organizations to reassess their security posture and implement robust defenses against these threats.
New Adversaries Emerge
CrowdStrike identified seven new China-nexus adversaries in 2024, further underscoring the evolving threat landscape. The cybersecurity provider also claimed to have blocked over 330 cyber-intrusion attempts attributed to Chinese hacking groups, demonstrating its commitment to protecting organizations from these threats.
AI-Powered Deception on the Rise
CrowdStrike's Adam Meyers, Head of Counter-Adversary Operations, noted that "China's increasingly aggressive cyber espionage, combined with the rapid weaponization of AI-powered deception, is forcing organizations to rethink their approach to security." This trend highlights the growing reliance on artificial intelligence (AI) by cyber threat actors to stay one step ahead of modern security tools.
Generative AI: A Tool for Threat Actors
Generative AI, also known as GenAI, was used by cyber threat actors more than ever in 2024. While its primary use was to supercharge social engineering across cybercriminals and nation-state actors, some groups, especially Iran-nexus actors, leveraged GenAI for other purposes like vulnerability research and exploitation.
The Year of the Enterprising Adversary
CrowdStrike's 13th Global Threat Report dubbed 2024 "The Year of the Enterprising Adversary" due to the maturation of threat actors. They have figured out new ways to gain access and evade detection by modern security tools, making it essential for organizations to stay vigilant and adapt their security strategies to counter these evolving threats.
Global Threat Report in Numbers
In this report, CrowdStrike tracked 257 tracked adversaries, with 26 new threat actors emerging over the past year. It also detected over 140 activity clusters, representing identified malicious activity with unknown attribution. These findings underscore the complexity and sophistication of modern cyber threats.
New Countries of Origin for Nation-State Actors
CrowdStrike added two new countries of origin for nation-state threat actors in 2024: Egypt, with actors tracked as 'Sphinx', and Kazakhstan, with actors tracked as 'Saiga.' This development highlights the growing involvement of more nations in deploying cyber intrusions and cyber espionage operations.
A Growing Concern
"Seeing more nations deploying cyber intrusions and cyber espionage operations is a significant concern," Meyers concluded. As the threat landscape continues to evolve, it is essential for organizations and governments to remain vigilant and proactive in countering these threats.