“The decline may reflect changes in targeting, infrastructure or detection visibility rather than a reduction in activity. The key takeaway is that lower detection levels do not necessarily mean a lower threat, particularly as China-aligned activity remains higher than that of other nation-state actors,” Trellix researchers wrote.
Trellix finds a 41.4% drop in China-aligned detections, April–September 2026
A new study by Trellix reports a 41.4% decline in detected Chinese nation-state threat activity across the six months from April to September 2026. The figure, published on November 4, quantifies an abrupt fall in detections but comes with an explicit caution from the authors: lower detection counts do not automatically equate to a reduced operational threat.
Comparative threat landscape: China still tops Russia and Iran
Even with the reported drop, Trellix emphasised that observed PRC cyber activity remained “substantially higher” than nation-state cyber activity from Russia and Iran during the same period. That comparative ranking suggests China-aligned campaigns continued to account for a large share of detections despite the overall decline.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildLinkages to military and maritime developments around Taiwan
Researchers tied changes in cyber detection patterns to broader geopolitical movements and shifting PRC intelligence priorities. Trellix suggested one possible refocus: observing Western military capabilities, including battlefield technologies. The study noted that China-aligned detection trends broadly coincided with changes in Chinese military and maritime activity around Taiwan. Specifically, Trellix recorded a slight rise in cyber activity from June to July 2026 that occurred as China expanded coast guard-led “gray-zone” operations — including reports of Chinese coast guard ships patrolling Taiwan-controlled waters.
Primary national targets: US and Turkey dominate detections
Trellix found nation-state targeting largely concentrated on two countries: the United States (38%) and Turkey (37.1%). Together those two accounted for more than three-quarters of all detections between April and September. Germany ranked third at 4.4%. The report framed the U.S. as a valuable target given its large economy and concentration of high-value technology, defense and government infrastructure, while it described Turkey as strategically important because of its geographic position and NATO membership.
Sectors in focus: transportation, shipping and telecommunications
Across campaign volume, transportation and shipping plus telecommunications together constituted over half of detected activity. Trellix interprets that distribution as reflecting an “intense focus on intelligence collection across logistics, global supply chains and telecommunications,” underscoring interest in infrastructure that supports movement of goods and information.
Techniques and persistent actors: backdoors, infostealers, and long-standing intrusions
The report breaks out the most common tools and groups. Backdoors were the single most observed tool type, appearing in 20.9% of detections — a sign of emphasis on long-term access rather than quick exploitation. Infostealers were the second most common tool at 11.87%, used to harvest data from compromised environments. Trellix also reported that 56% of all detections were attributable to just 10 groups, led by Russia-aligned Gamaredon (9.03%), Pakistan-linked APT36 (7.84%) and China-nexus Mustang Panda (7.52%).
In addition, the report highlighted prior examples of lengthy undetected operations. It cited a 2025 incident in which the Chinese-nexus actor Weaver Ant infiltrated the network of an Asian telecommunications service provider and remained undetected for more than four years — an illustration of the gap that can exist between activity and detection.
What this means for the US, Turkey, and transportation and telecoms
- United States: As the single largest national target in Trellix’s dataset (38%), US networks and organizations managing high-value technology, defense and government systems are central to this pattern of detections and should weigh the report’s warning that detection declines do not necessarily indicate diminished intent.
- Turkey: With 37.1% of detections, Turkey’s strategic location and NATO membership explain its prominence in the dataset; the concentration of activity there reflects cross-regional intelligence priorities described by Trellix.
- Transportation, shipping and telecommunications: Together making up over half of detected campaign volume, these sectors appear to be primary collection targets for logistics, supply-chain and communications intelligence. The prevalence of backdoors and infostealers in detections underscores an emphasis on persistent access and data harvesting in those environments.
Trellix’s analysis presents a clear tension: a marked, quantifiable fall in detections juxtaposed with evidence and prior incidents that show nation-state campaigns can remain active and hidden for years. The researchers’ own conclusion frames the central question left by the numbers — whether the drop reflects a real reduction in operations, changes in targeting and infrastructure, or simply shifts in detection visibility — and that uncertainty is the operational reality security teams and national decision-makers will face in the months ahead.
