NYT: China Has Stepped Up Cyber Espionage Against Russia
10- 22.06.2025, 20:19
- 7,118

Beijing is hunting for FSB secrets.
Since the beginning of the war in Ukraine, Chinese hacker groups linked to the Chinese government have repeatedly attacked Russian companies and government agencies in search of military secrets. This is reported by The New York Times, citing cybersecurity experts.
The cyberattacks intensified in May 2022. The publication notes that they are still going on despite Presidents Vladimir Putin and Si Jinping publicly proclaiming an era of cooperation and friendship between the countries. For example, in 2023, the Sanyo hacking group was hunting for information on nuclear submarines.
According to experts interviewed by the NYT, China sees the war in Ukraine as an opportunity to gather data on modern warfare tactics, Western weapons and how to fight them. A researcher at Taiwanese cybersecurity company TeamT5 Che Chang said:
"China is likely seeking to gather intelligence on Russia's activities, including its military operations in Ukraine, defense developments and other geopolitical maneuvers."
A secret FSB document obtained by The New York Times confirms the Russian intelligence service's concern about such incidents. The document says China is seeking Russian defense experience and technology, as well as lessons learned from Russia's military experience in Ukraine. At the same time, the document calls China an "adversary." China is particularly interested in drone technology and software.
Chinese hacker groups have attacked Rostec, Russian aviation companies and government agencies using malicious files to exploit Microsoft Word vulnerabilities. Among the most active groups is Mustang Panda, which expanded its operations to Russian and European government organizations after the Russian invasion. In 2009 and 2015, China and Russia promised not to conduct cyberattacks against each other, but experts considered these agreements largely symbolic.
In late May, the Czech Ministry of Foreign Affairs released a statement about a malicious cyber campaign that lasted from 2022 and affected the country's critical infrastructure facility. The statement said it was referring to "one of the Czech Foreign Ministry's unclassified networks." In the attack, hackers compromised the e-mail accounts of Czech Foreign Ministry employees and monitored their correspondence for approximately two years.