Trellix Finds Chinese Cyber Activity Fell 41% in 2026

A Trellix study published on 4 November 2026 finds that Chinese nation-state threat activity declined by 41.4% in the six months from April to September 2026. The researchers say the drop in detections could reflect changes in targeting, infrastructure or detection visibility rather than a real reduction in activity, noting that China-aligned activity remained higher than that of other nation-state actors such as Russia and Iran during the period.

They also point to long-running campaigns that have gone undetected for extended periods, for example Weaver Ant’s infiltration of a telecoms network in 2025, which underscores ongoing Chinese-state activity that may not yet be fully seen.

The Trellix analysis identifies the United States (38%) and Turkey (37.1%) as the primary targets for nation-state actors from April to September 2026, with Germany at 4.4% and the logistics, shipping and telecom sectors accounting for more than half of detected campaign volume. About 56% of detections attributed to nation-state actors involved ten groups, led by Russia-aligned Gamaredon (9.03%), Pakistan-linked APT36 (7.84%) and China-nexus Mustang Panda (7.52%).

The report notes that backdoors were the most common tool used (20.9%), with Infostealers ranking second (11.87%), reflecting a focus on long-term access and data harvesting in compromised networks. The article attributes these findings to Trellix researchers and their methodology.