By: Sofiqua Yesmin, Research Analyst, GSDN
Cyberspace has become a pivotal arena for global power competition, where nations leverage digital tools to project influence, gather intelligence, and prepare for conflict. Among these actors, China has emerged as a formidable cyber power, developing sophisticated capabilities that alarm the United States. From espionage and intellectual property theft to potential disruptions of critical infrastructure, China’s cyber operations pose a multifaceted threat to U.S. national security, economic stability, and global influence. This article explores the evolution of China’s cyberwarfare capabilities, the strategic motivations driving them, the specific risks they present to the U.S., and why these developments are a growing concern for American policymakers and security experts.
The Evolution of China’s Cyberwarfare Capabilities
China’s ascent as a cyber powerhouse reflects decades of strategic investment in technology, policy, and military organization. The People’s Republic of China (PRC) has prioritized cyberspace as a critical domain to advance its national objectives, integrating cyber operations into its broader military and geopolitical strategies.
Historical Development
China’s cyberwarfare journey began in the late 1990s, when it recognized the potential of information technology to offset the military superiority of adversaries like the U.S. The concept of “informatized warfare,” introduced in the early 2000s, emphasized integrating digital systems into military operations to enhance precision and coordination. This evolved into “intelligentized warfare” by the 2020s, incorporating artificial intelligence (AI), big data, and advanced computing to create agile, data-driven operations.
A key milestone was the 2015 establishment of the People’s Liberation Army Strategic Support Force (PLASSF), which unified cyber, space, and electronic warfare under one command. In 2024, the PLASSF was restructured, with cyber operations transferred to the newly formed PLA Cyberspace Force, signaling China’s intent to further specialize its cyber capabilities. Estimates suggest China’s cyber workforce, including military personnel and civilian contractors, ranges from 50,000 to 100,000, underscoring its significant investment in human resources.
Organizational Structure
China’s cyber operations involve a complex network of state-sponsored actors, including the PLA, the Ministry of State Security (MSS), and advanced persistent threat (APT) groups like APT31 (Zirconium), APT40, and Volt Typhoon. These groups, while sometimes operating independently, are increasingly coordinated under centralized command to align with national objectives. The PLA Cyberspace Force focuses on three core missions: cyber intelligence, defense, and offensive operations. This includes developing advanced malware, exploiting zero-day vulnerabilities, and conducting large-scale espionage.
China’s domestic technology sector, including companies like Huawei and ZTE, supports these efforts by providing infrastructure that can be leveraged for both defensive and offensive purposes. The 2017 Cybersecurity Law mandates private companies to cooperate with state security efforts, effectively extending China’s cyber reach into the private sector.
Technological Advancements
China has made remarkable strides in technologies that enhance its cyberwarfare capabilities. AI-driven tools enable automated cyberattacks, rapid data analysis, and precise targeting. Cloud computing provides scalable platforms for large-scale operations, while research into quantum computing threatens to disrupt modern encryption standards. China’s dominance in 5G technology, through companies like Huawei, amplifies its ability to conduct surveillance and cyber operations globally, as its telecommunications infrastructure is adopted by nations worldwide.
China’s Cyber Strategy and Motivations
China’s cyberwarfare strategy aligns with its broader national goals: ensuring domestic stability, asserting regional dominance, and challenging U.S. global leadership. Cyber operations allow China to pursue these objectives without triggering open conflict, operating in the “gray zone” below the threshold of war.
Strategic Objectives
- Espionage and Intellectual Property Theft: China uses cyber operations to steal intellectual property, trade secrets, and sensitive government data to accelerate its technological and economic growth. These efforts reduce reliance on foreign innovation and bolster industries like AI, semiconductors, and aerospace.
- Critical Infrastructure Targeting: China is developing capabilities to disrupt critical infrastructure—such as power grids, telecommunications, and transportation systems—in adversary nations. These operations aim to deter intervention in regional conflicts, particularly over Taiwan, by threatening significant disruption.
- Influence and Disinformation Campaigns: China employs cyber tools to shape narratives and undermine adversaries through disinformation. These campaigns target domestic audiences to reinforce regime legitimacy and international audiences to sow discord or promote pro-China narratives.
- Strategic Deterrence: By prepositioning malware in critical systems, China creates a deterrent effect, signaling its ability to inflict damage during a conflict. This mirrors nuclear deterrence, aiming to dissuade adversaries from actions contrary to China’s interests.
Regional and Global Ambitions
In the Indo-Pacific, China’s cyber operations focus on asserting dominance over neighbors like Vietnam, Japan, and Taiwan. Vietnam has faced frequent cyberattacks tied to South China Sea disputes, while Taiwan endures persistent attempts to disrupt its government and military systems. Globally, China seeks to challenge U.S. dominance in cyberspace and promote a state-controlled internet model, as outlined in its 2015 white paper on a “Community with a Shared Future in Cyberspace.” By exporting surveillance technologies and cyber norms to authoritarian regimes, China extends its global influence.
Specific Threats to the United States
China’s cyber operations pose direct and indirect threats to the U.S., targeting government, industry, and critical infrastructure with increasing sophistication.
Espionage and Intellectual Property Theft
Chinese cyber actors have been linked to major breaches targeting U.S. entities. The 2021 Microsoft Exchange Server attack, attributed to the Hafnium group, compromised thousands of organizations, including U.S. government agencies and private firms. APT31 has targeted U.S. officials and critics of the PRC, collecting sensitive data for further intrusions. These operations have resulted in the theft of intellectual property worth billions, undermining U.S. technological leadership and economic competitiveness. The U.S. intelligence community has highlighted China’s goal to surpass the U.S. as the global AI leader by 2030, with cyber espionage playing a central role.
Critical Infrastructure Vulnerabilities
China’s ability to target U.S. critical infrastructure is a growing concern. The Volt Typhoon group, identified in 2023, has prepositioned malware in U.S. communications, energy, transportation, and water systems. FBI Director Christopher Wray has described this as a “defining threat,” aimed at disrupting civilian infrastructure to deter U.S. intervention in a potential Taiwan conflict. In 2024, Chinese hackers breached U.S. telecommunications networks, accessing sensitive data and potentially compromising national security communications. These incidents highlight China’s strategy of embedding cyber weapons for future activation.
Disinformation and Influence Operations
China has expanded its use of cyber tools for disinformation, targeting U.S. public opinion and democratic processes. In 2025, a Chinese-led campaign on WeChat targeted a Canadian politician, demonstrating cross-border influence capabilities. Similar tactics have been used to spread divisive content in the U.S., particularly during elections, undermining trust in institutions and exacerbating social polarization.
Military and Strategic Implications
China’s cyber capabilities enhance its military strategy, particularly in a potential Taiwan conflict. By targeting U.S. military logistics, command-and-control systems, and infrastructure, China could delay or disrupt U.S. intervention, giving the PLA a strategic edge. The integration of cyber operations with space and electronic warfare creates a multi-domain threat that challenges U.S. military preparedness.
Why the U.S. is Concerned
The U.S. views China’s cyberwarfare capabilities as a significant threat due to their potential to disrupt national security, economic stability, and geopolitical influence. Several factors amplify these concerns.
National Security Risks
The ability to disrupt critical infrastructure poses a direct threat to U.S. security. A successful cyberattack on power grids or transportation systems could cause widespread disruption, erode public confidence, and hinder military operations. The Volt Typhoon operation, for instance, underscores the risk of China paralyzing essential services during a crisis, particularly in a Taiwan scenario.
Economic Implications
The economic toll of Chinese cyber espionage is substantial. Stolen intellectual property undermines U.S. competitiveness in high-tech industries, threatening long-term economic growth. Disruptions to supply chains or infrastructure could have cascading effects, impacting global markets and U.S. businesses with international operations.
Geopolitical Competition
China’s cyber capabilities are part of a broader strategy to challenge U.S. global leadership. By promoting a state-controlled internet model and exporting surveillance technologies, China seeks to reshape international cyber norms, clashing with U.S. values of openness and freedom. Cyberattacks on U.S. allies in the Indo-Pacific, such as Japan and Vietnam, weaken regional stability and challenge the U.S.-led security architecture.
Challenges in Attribution and Deterrence
Attributing cyberattacks to Chinese state actors is challenging, complicating U.S. responses. Groups like Volt Typhoon are believed to be state-sponsored, but China’s denials and counter-accusations of U.S. cyberattacks create diplomatic hurdles. Cyber deterrence is also difficult, as the lack of clear escalation thresholds allows China to operate with relative impunity in the gray zone.
U.S. Responses and Mitigation Strategies
The U.S. is actively countering China’s cyber threat through a combination of defensive, offensive, and diplomatic measures, though challenges persist.
Strengthening Cybersecurity
The Cybersecurity and Infrastructure Security Agency (CISA) leads efforts to protect critical infrastructure, collaborating with private sector partners to identify vulnerabilities and share threat intelligence. The FBI has emphasized partnerships with industry and academia to build resilience against Chinese cyberattacks.
International Cooperation
The U.S. has sought to build coalitions to counter China’s cyber activities. In 2024, eight nations, including the U.S., Australia, and Japan, issued a joint advisory attributing malicious cyber activity to China. Proposals for an Indo-Pacific cyber intelligence-sharing coalition aim to enhance regional cooperation and deter Chinese aggression.
Offensive Capabilities
U.S. Cyber Command (USCYBERCOM) has developed offensive cyber capabilities to disrupt Chinese operations, such as neutralizing Volt Typhoon’s infrastructure in 2024. These actions demonstrate the U.S.’s ability to respond proactively, though they risk escalation if not carefully managed.
Diplomatic Efforts
Diplomatic engagement has yielded mixed results. The 2015 U.S.-China cyber agreement temporarily reduced commercial espionage, but violations have eroded trust. Establishing bilateral cyber norms and crisis management mechanisms remains critical but challenging due to ideological differences.
Conclusion
China’s cyberwarfare capabilities represent a sophisticated and evolving threat to the United States, encompassing espionage, infrastructure disruption, and influence operations. The U.S. is concerned about the immediate risks to national security and economic stability, as well as the long-term implications for its global leadership. China’s ability to operate below the threshold of war, combined with its technological advancements and strategic ambitions, makes it a formidable adversary in cyberspace.
Countering this threat requires a comprehensive approach, integrating robust cybersecurity, international partnerships, offensive capabilities, and diplomatic engagement. However, the complexities of attribution, deterrence, and escalation in cyberspace pose ongoing challenges. As the digital domain becomes increasingly contested, the U.S. must remain adaptive and collaborative to safeguard its interests against China’s cyber ambitions.
About the Author
Sofiqua Yesmin, is doing postgraduation in International Relations from Amity University, Noida, India. Her research interests lie at the intersection of security studies, foreign policy, and geopolitical shifts—particularly in South Asia and the Indian Ocean Region.
