Influence of Chinese Hacker Organizations on U.S. Foreign Policy

Chinese cyber-espionage groups have again demonstrated their capacity to target U.S. organisations tied to policy-making, highlighting the ongoing threat posed by state-linked actors. The campaign began with a mass scan on 5 April 2025, preceding an initial breach that used exploits including CVE-2022-26134, CVE-2021-44228, CVE-2017-9805, and CVE-2017-17562.

The latest intrusion, observed in April 2025 against a prominent U.S. non-profit active in policy advocacy, showcased sophisticated techniques and shared tooling among Chinese groups such as Kelp, Space Pirates, and APT41. The activity resumed on 16 April with a surge of suspicious commands testing connectivity and internal reach, focusing on a system at 192.0.0[.]88, and employing checks across multiple protocols.

Analysts note automated processes and persistence through scheduled tasks using schtasks, with MSBuild.exe processing an outbound.xml file to inject code into csc.exe and reach a command-and-control server, a pattern that underlines the potential for long-term access and lateral movement.