China-linked cyber operations are growing significantly harder to detect and contain, as artificial intelligence (AI) and automation enable state-aligned hacking groups to conduct credential attacks and access attempts at unprecedented speed and scale, according to a new report published on 31 October 2026. The findings raise urgent concerns for governments, critical infrastructure operators, and private enterprises worldwide.

Key Developments

The report, from Colombo-based publication Asian News Post, highlights a distinctive shift in attack methodology: unlike traditional cyber campaigns that targeted a single organisation, the new AI-enabled pattern creates risks across a far broader network of interconnected entities. This supply-chain approach amplifies both the reach and the persistence of intrusions.

Central to the report's findings is the 2026 breach of US software provider ConnectWise, carried out by a China state-aligned hacking group. The attackers reportedly deployed an AI-enabled penetration-testing framework that automated significant portions of the campaign. ConnectWise's trusted connections to client organisations meant attackers could potentially reach multiple customers without independently breaching each one.

Sectors Under Threat

The ConnectWise campaign reportedly targeted organisations across the defence, energy, finance, government, and technology sectors. According to the report, concerns persist that attacker access may have endured even after the initial breach was ostensibly contained — a hallmark of advanced persistent threat (APT) operations attributed to Chinese state-linked actors.

The report also alleges that Chinese state-linked cyber actors repeatedly target suppliers and service providers on which many organisations depend, with intended victims spanning government communications, political dissidents, critical infrastructure, and private companies.

Salt Typhoon and the Telecommunications Threat

The report cites the Salt Typhoon campaign — which US authorities said compromised telecommunications networks — as a precedent. According to the publication, the campaign extended beyond the United States, prompting international warnings about the security of global telecommunications infrastructure.

'The campaign also extended beyond the United States, prompting warnings about the security of global telecommunications infrastructure. Telecommunications networks are particularly valuable because they carry enormous amounts of information about how people communicate,' the report noted.

Notably, even without intercepting every conversation, such campaigns can reportedly access call records and location data, revealing the identities and whereabouts of individuals under surveillance.

US Legal Action and the i-Soon Indictment

The report references a significant legal development: in March 2025, the US Justice Department charged 10 Chinese nationals in connection with hacking activities conducted through i-Soon, a China-based cybersecurity company. The indictment alleged that i-Soon collaborated with Chinese public security and state security agencies from 2016 to 2023 to compromise email accounts, mobile phones, servers, and websites.

This pattern of state-corporate collaboration in offensive cyber operations, critics argue, reflects a structurally embedded threat that conventional containment strategies are ill-equipped to address at the pace and scale that AI now makes possible.

What This Means Going Forward

Cybersecurity experts warn that as AI lowers the technical barrier for conducting large-scale intrusions, the window for defenders to detect and isolate breaches continues to shrink. The supply-chain vector — exploiting trusted software providers — is particularly difficult to guard against, as it turns an organisation's own security posture into a potential liability for its partners. Governments and enterprises are likely to face mounting pressure to adopt zero-trust architectures and tighten third-party vendor scrutiny in the months ahead.