China's Cyber Power Surge: A Growing Threat to Global Security

The rapid expansion of China’s cyber capabilities has placed it firmly on the global map as a “cyber superpower.” As the digital landscape evolves, this development presents significant challenges for nations attempting to defend their critical infrastructure from sophisticated cyberattacks. Sandra Joyce, Vice President of Google Threat Intelligence, recently highlighted the increasing complexity of China’s cyber activities during the Google Cloud Next 2025 event, where she explained that Chinese state-sponsored cyber actors are developing advanced strategies that are difficult to detect and combat. In this article, we explore the growing threat posed by China in cyberspace, its current tactics, and the potential consequences for global security.

China’s Cyber Capabilities on the Rise: A Growing Concern

China’s rise to cyber superpower status is becoming increasingly evident as it enhances its cyber warfare capabilities. This transformation is largely driven by the nation’s focus on gaining intelligence through cyber espionage rather than direct destructive attacks, a contrast to the strategies employed by other nation-state actors like Russia and North Korea. According to Sandra Joyce, China’s cyber operations have intensified since 2021, with a marked increase in the exploitation of zero-day vulnerabilities—previously unknown security flaws in software that can be used for malicious purposes.

A particularly alarming aspect of these developments is the Chinese state hackers’ ability to operate under the radar, bypassing security controls that once helped detect foreign intrusions. For example, the Volt Typhoon group, a Chinese state-backed hacking collective, demonstrated this capability by infiltrating U.S. government and critical infrastructure networks over an extended period. The attackers utilized sophisticated techniques to avoid detection, particularly by targeting devices like firewalls and edge devices, where traditional endpoint detection systems are often ineffective.

One of the key factors contributing to the success of these cyber intrusions is the Chinese actors’ use of rented infrastructure, which is refreshed approximately every 30 days, making it harder for cybersecurity professionals to trace the origin of the attacks. Furthermore, these hackers frequently start with commodity malware during their initial penetration of a system, before escalating to more advanced backdoor methods once they’ve gained full control.

China’s Cyber Espionage Focus and Its Potential for Destruction

While China’s cyber efforts are currently concentrated on espionage—stealthily gaining access to sensitive data and systems—it has yet to unleash large-scale destructive cyberattacks. In contrast, other nation-state actors such as Russia, Iran, and North Korea have demonstrated their willingness to disrupt critical infrastructure, using cyber means to inflict damage on a massive scale. Despite this, government officials have expressed concern that China is positioning itself within global critical infrastructure, potentially preparing for more destructive actions should geopolitical tensions rise or military conflict ensue.

Joyce emphasized that although China has not yet engaged in destructive cyberattacks, its actions could evolve rapidly. “Espionage remains China’s primary tactic,” she noted, suggesting that China may be waiting for the right moment to use its access to critical infrastructure as leverage, particularly in the event of escalating geopolitical conflicts.

The Real Threat: Cybercriminals Continue to Dominate

Despite the growing threat from nation-state actors, the most pressing concern for global cybersecurity remains cybercriminals. Joyce pointed out that financially motivated cybercriminals continue to be the primary source of cyberattacks. In many cases, these cybercriminals are exploiting basic security vulnerabilities such as credential theft and phishing. While the methods used by cybercriminals aren’t necessarily new, the scale and automation of these attacks are what makes them particularly dangerous.

Heather Adkins, VP of Engineering at Google, further elaborated that the rise in automated cybercriminal platforms has drastically lowered the barriers to entry for aspiring hackers. Today, even individuals with limited technical knowledge can carry out large-scale attacks, thanks to the widespread availability of hacking tools and services. This shift has resulted in an explosion of cybercrime activity, with campaigns now reaching unprecedented levels of frequency and impact.

What Undercode Say:

China’s rise as a cyber superpower is undeniably concerning, not just because of its enhanced capabilities but because of the new tactics it has adopted to bypass existing security measures. Its ability to evade detection, particularly through techniques like leveraging rented infrastructure and focusing on edge devices, means that organizations need to rethink their cybersecurity strategies. As Joyce pointed out, security systems that are not designed to detect and respond to threats on these devices are a major vulnerability. This represents a significant challenge to both private and public sectors worldwide, as traditional defenses are proving inadequate against this advanced level of cyber intrusion.

The espionage-centric focus of Chinese cyber operations also sets it apart from the more destructive cyberattacks carried out by other nation-states. China’s approach is far more subtle but no less dangerous, as it allows the country to infiltrate and gather intelligence without necessarily alerting its targets. This could make it particularly effective in a long-term strategy to destabilize nations through cyber means, all while avoiding direct confrontation or military escalation.

One of the main concerns is that

While nation-state actors like China are becoming increasingly sophisticated, it is important to remember that cybercriminals continue to pose a significant threat. Cybercrime is no longer just about financial gain—it’s about scale and automation. The ability for even low-skilled hackers to launch mass-scale attacks has fundamentally changed the landscape of cybersecurity, placing unprecedented pressure on organizations to defend against these attacks. As these threats continue to evolve, a coordinated, global response will be essential to protect against cyber warfare in all its forms.

Fact Checker Results:

China’s cyber espionage efforts have been widely acknowledged, but the lack of destructive attacks differentiates it from other nations like Russia or North Korea. The exploitation of zero-day vulnerabilities has significantly increased since 2021, with an alarming focus on critical infrastructure. Cybercriminals, meanwhile, remain the more frequent perpetrators of cyberattacks, with increasing automation making it easier for them to carry out large-scale operations.