Sign in Get in touch
World risk · Technology and cyber · Tech & chip controls

Allies publicly blame China for a new break-in to critical infrastructure

The test Between 26 Oct 2026 and 25 Oct 2027, government agencies of at least two Five Eyes countries jointly publish an advisory or statement attributing a new intrusion into a critical infrastructure sector to actors they call Chinese state-sponsored or Chinese government-linked.

Not under way · Confidence: medium · Reviewed 25 Oct 2026 · Scores from 1 to 10

This page answers: What could happen, how it is scored, and who is exposed?

Using this page
  1. Read the two scores: Likelihood and Impact are kept apart.
  2. Check what is happening, each fact with its source.
  3. Use the calendar for the dates to watch.

Follow this riskSign in to follow; one weekly email if you ask for it.

Likelihood
6Elevated steady this month
Impact
4Elevated steady this month
Breadth6
Depth2
Duration4
Hard to substitute4
Canada pointNot added0

Impact is the average of the four parts, rounded, plus one point when Canada is directly hit on two or more channels, up to 10.

Two separate scales from 1 to 10. Strature never multiplies or merges them.

What changed

Dated, newest first

  1. AA26-281A, 8 Oct 2026: FBI, CISA, NSA with UK, Australia, Canada, Japan, New Zealand and Spain on Chinese government-linked actors; Integrity Technology Group named as a China-based for-profit company with links to the Chinese government; government, critical manufacturing, healthcare, IT victims. [3]
  2. CISA's Chris Butera: Chinese government-affiliated actors continue to position themselves within critical infrastructure networks. [4]

Why it matters

Allied cyber agencies have named China-linked actors in at least five joint publications in three years, the latest on 8 Oct 2026. Canada's Cyber Centre co-sealed every one, and says a Canadian telecom's devices were breached in February 2025. Cited sources lean towards another joint attribution within twelve months, short of a base case; its impact is in patching, procurement rules and diplomacy, not in prices.

Why Likelihood 6 Pushes: about one or two a year; Cyber Centre expects continued targeting to mid-2027; CISA says actors continue to position in critical infrastructure. Brakes: truce diplomacy; guidance without naming a state.

Why Impact 4 Threshold case: one more joint advisory with no outage. Canada hit on one channel only (at least 20 government networks).

The other facts on file (6)
  • AA25-239A, 27 Aug 2025: 23 agencies, 13 countries; telecoms, government, transport, lodging, military; observed in US, Australia, Canada, New Zealand, UK. [1] (3 Sep 2025)
  • Three network devices of a Canadian telecom compromised by likely Salt Typhoon in mid-Feb 2025; continued targeting almost certain over two years. [2] (19 Jun 2025)
  • AA24-038A, 7 Feb 2024: Volt Typhoon footholds in US communications, energy, transport, water for at least five years in some cases. [5] (7 Feb 2024)
  • AA24-190A, 8 Jul 2024: eight countries on APT40, assessed to work for the MSS. [6] (8 Jul 2024)
  • Treasury sanctioned Sichuan Juxinhe (which it said was directly involved in Salt Typhoon) and Yin Kecheng, an individual it described as a cyber actor, on 17 Jan 2025; US government allegations, not court findings. [7] (17 Jan 2025)
  • Canada's NCTA 2025-2026: PRC the most sophisticated and active state cyber threat; at least 20 GC networks compromised in four years, all known federal compromises since resolved (published 30 Oct 2024; information as of 20 Sep 2024). [8] (30 Oct 2024)

Where it sits

Bab el-MandebStrait of HormuzStrait of MalaccaPanama CanalSuez CanalTaiwan Strait11. Allies publicly blame China for a new break-in to critical infrastructure: Elevated impact · possible1 · Elevated impact · possibleBab el-MandebStrait of HormuzStrait of MalaccaPanama CanalTaiwan StraitUNITED STATESCHINATAIWANSOUTH KOREAJAPANNETHERLANDSPACIFIC OCEANINDIAN OCEANMap data: Natural Earth (public domain).
Bab el-MandebStrait of HormuzStrait of MalaccaPanama CanalSuez CanalTaiwan Strait11. Allies publicly blame China for a new break-in to critical infrastructure: Elevated impact · possibleBab el-MandebStrait of HormuzStrait of MalaccaPanama CanalSuez CanalUNITED STATESCHINATAIWANJAPANINDIAN OCEANMap data: Natural Earth (public domain).

How it spreads

If

Between 26 Oct 2026 and 25 Oct 2027, government agencies of at least two Five Eyes countries jointly publish an advisory or statement attributing a new intrusion into a critical infrastructure sector to actors they call Chinese state-sponsored or Chinese government-linked.

Not under way

Channels 4 on the card

  1. CanadaThe Cyber Centre co-seals these advisories; PRC actors target Canadian telecoms and government networks; one channel hit.
  2. Telecoms and edge devicesAdvisories ask operators to patch and hunt in exposed routers and edge devices.
  3. Sanctions and rulesAttribution has been followed by US sanctions on a named Chinese company; more listings or procurement curbs possible (Strature's view).
  4. US-China relationsA new attribution would land during truce talks.

Sectors 2

  • Technology
  • Energy and pipelines

Who is exposed

Countries
United States, Canada, United Kingdom, Australia, New Zealand, Japan, Germany
Sectors
Technology, Energy and pipelines, Ports and logistics

Three scenarios and their signposts

  1. S1

    Business as usual

    One or two more joint advisories on China-linked actors, with technical detail and no new sanctions.

  2. S2

    Naming and sanctions

    An advisory is followed by US or allied sanctions or indictments, as in January 2025.

  3. S3

    Quiet year

    Truce diplomacy mutes public attribution; agencies publish guidance without naming China.

The signposts of each scenario
PathSignpost
S1A CISA AA27- advisory co-sealed by the Cyber Centre
S2A Treasury press release naming a Chinese firm
S3No joint China advisory by mid-2027

No probability is given for the three paths.

Dates to watch

Calendar

The dates to watch

A dot is a day, a bar a month or a year; a hollow mark is tentative. The line marks today.

  1. Jun 2027 End of the Cyber Centre's two-year outlook from its June 2025 bulletin [2] Tentative · Window
  2. 25 Oct 2027 Scored window ends Declared · Strature date

    Remind me

Sign in, with alerts on, for an email 7 days and 1 day before.

SourceStrature world-risk card; the dates cite the sources below.
Exhibit R-3 · WORLD · strature.net

The other side

Public attribution gives operators the indicators to find and remove intruders, and joint advisories show allied agencies working together. Firms that secure network edge devices, and trusted equipment makers, gain business when advisories prompt replacement (Strature's view).

Connected in Strature

Sources

8 sources, numbered as the text cites them

  1. Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (AA25-239A). CISA, NSA, FBI and partner agencies · 27 Aug 2025 · Official · confidence high · retrieved 25 Oct 2026
  2. Cyber threat bulletin: PRC cyber actors target telecommunications companies as part of global cyberespionage campaign. Canadian Centre for Cyber Security · 19 Jun 2025 · Official · confidence high · retrieved 25 Oct 2026
  3. Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (AA26-281A). CISA, FBI, NSA and partner agencies · 8 Oct 2026 · Official · confidence high · retrieved 25 Oct 2026
  4. CISA, FBI, NSA and international partners warn of China-based cybersecurity company enabling threat actors to target multiple critical infrastructure sectors worldwide. CISA · 8 Oct 2026 · Official · confidence high · retrieved 25 Oct 2026
  5. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A). CISA, NSA, FBI and partner agencies · 7 Feb 2024 · Official · confidence high · retrieved 25 Oct 2026
  6. People's Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action (AA24-190A). ASD's ACSC and partner agencies · 8 Jul 2024 · Official · confidence high · retrieved 25 Oct 2026
  7. Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise. US Department of the Treasury · 17 Jan 2025 · Official · confidence high · retrieved 25 Oct 2026
  8. National Cyber Threat Assessment 2025-2026 (information as of 20 Sep 2024). Canadian Centre for Cyber Security · 30 Oct 2024 · Official · confidence high · retrieved 25 Oct 2026

Reviewed 25 Oct 2026 · version 1 · last change: reviewed · All risks