Name: Threat Briefing: How China’s Strategic Objectives are Reshaping the Threat Landscape
Uploaded: 2026-07-21T15:30:14.791Z
Duration: 1 h 3 min 4 s
Description: Threat Briefing: How China’s Strategic Objectives are Reshaping the Threat Landscape

Transcript for "Threat Briefing: How China’s Strategic Objectives are Reshaping the Threat Landscape": Okay. Good morning, everyone. I'm Matt Mooney, director of strategic geopolitical intelligence at Recorded Futures Insight Group, the research and analysis arm of the company. I'm joined today by two Insight Group analysts, Seva Shana Reiley and Devin Thorn, to discuss how China's accelerating assertiveness in strategic competition continues to pose cyber and non cyber threats to key industry sectors, technologies, and geographies. We're also joined by Kathleen Kuzma, senior technical marketing manager, who provide a live demonstration of the Recorded Future Reform. So in today's threat briefing, we will outline the key trends in China's domestic and international activities in support of strategic competition grounded in its recently published five year plan, explain how China is likely seeking to achieve its objectives through overt and covert means, and identify the technologies and industry sectors at heightened risk, and showcase how the Recorded Future platform can help defenders protect their networks and assets. And so I'm gonna pause here, and ask each of our participants to introduce themselves, and we'll start with setup. Thank you so much, Matt, and hi, everyone. I'm Sara Scannarelli. I'm a principal threat intelligence analyst here in Recorded Futures Instigroup. My focus is on tracking Chinese and North Korean state sponsored threat groups from a technical perspective, spanning malware and infrastructure analysis and intrusion clustering. And I also collaborate closely with our detection engineering and our geopolitical intelligence teams to be able to give the most complete picture possible of the threat. Great. Thanks, Trevor. And I'm Devin Thorn, Recorded Future Insights Group's principal threat intelligence analyst for China geopolitics. So the opposite side of the coin from Seva, kind of all things non cyber, China's military modernization, foreign policy objectives, intelligence activities, propaganda strategies. And, you know, I'm excited for the discussion, and to be here today. And I'm Kathleen Kuzma. I lead our technical marketing, which is essentially our field sales or solution engineering organization. I'll be jumping back on later in the discussion to walk through how our customers are using Recorded Future to track associated threats with China both from the cyber perspective as well as the geopolitical perspective. And so looking forward to being included with all of these great speakers here today. Great. Thank you all. So a couple of quick housekeeping items before we dive in. First, the start briefing is being recorded and an on demand, recording will be made available to registrants after it ends. And second, the format today is moderated q and a. So please enter your questions in the, question bar on the right hand side of the screen, and we'll answer those that we can. And so with that, let's go ahead and dive in. Devin, perhaps you can sort of kick us off with an overview of how China sees the world today and what that means for the current threat landscape. Of course. So I guess at the strategic level, an important, component I'd say an important component of today's threat landscape is particularly the Chinese leadership's likely assessment that their predictions for a future in which Beijing wields, international influence that is greater to or ideally, is equal to or or ideally greater than The United States, those predictions they feel are likely quickly coming true. You can see in authoritative sources and who how they speak about themselves and their strategic intentions, that they argue the balance of power is currently undergoing a, quote, unquote, deep adjustment and that what they call, changes unseen in a century are accelerating. Analysts from China's, main civilian intelligence service, so that's the Ministry of State Security or MSS, and they're kinda gonna come up several times during today's discussion, I think. They put it even more bluntly, saying that at 250 years old, The US is an empire in twilight. So there are, you know, kind of a number of events over the last year or so, and even before that, that are likely feeding this, perspective. Those include the use of China's use of global export controls to force The US to moderate its policies toward China and China's reported role in pushing Iran to accept that initial ceasefire with The US back in April, which kind of supports the CCP or Chinese Communist Party's propaganda claims that China is a force for stability in the world in contrast to The US. Another example here that I think is worth highlighting is the shared language adopted by The US and China back in May to describe the bilateral relationship as a, quote, unquote, constructive relationship of strategic stability. Now The US does make some modifications to that, but China's leadership likely sees this as a step toward sort of achieving a coequal status with The US that particularly accounts for the CCP's objectives and gives a little bit of deference to those. Now I wanna be fairly clear here. Right? None of this is to say that China's, perceptions are necessarily accurate. And just as importantly, I don't see Beijing as necessarily communicating that it has achieved its goals or is taking some kind of, victory lap. In fact, authoritative Chinese sources, again, are quite clear that their desired future still requires, an ongoing and, in some areas, intensifying struggle against, you know, domestic risks, political, oppositional forces and oppositional forces worldwide, and then just other threats and upheavals. CCP general secretary Xi Jinping, really kind of brought this home in a speech on July 1, where he repeatedly referenced this concept of, struggle against something in both the historical and the future context, and he applied this concept to both domestic and international challenges. So, you know, the things that are likely on Xi Jinping's mind include at home, economic problems, such as insufficient, effective demand, demographic shifts, and, quote, unquote, extremely difficult task transitioning to, a new model of economic growth. All of these are emphasized in particular in China's fifteenth five year plan or FYP that was issued back in March this year. And And if we look internationally, right, the shifting balance of power that ultimately from China's leadership's perspective is beneficial to China is also leading to the opposition that it must overcome, such as from The US, and give and it's giving rise to a kind of more volatile, external environment as can be seen with events, in Iran over the last several months. So all of this, right, to kinda bring bring this back to the threat landscape, all of these challenges need to be managed as the CCP pushes forward toward their ambitions. And combined with their likely positive assessment of China's trajectory, I think we're sort of starting to see an even deeper assertiveness and especially a proactivity in Beijing's foreign policy and their efforts to mitigate risks and secure the objectives, that are gonna help China drive toward what's called national rejuvenation. Great. Thank you, Devin. So it sounds like the CCP feels validated in its approach to strategic competition with The US, and it will sort of achieve this rejuvenation as you've named it. What do you see as the key areas China is focused on now? Right. You know, I I think that China's leadership likely believes that, you know, when they turn to a more assertive foreign policy a number of years ago at this point, that was the correct choice. And then more moreover, they believe that China has the capabilities or sometimes what they call the elements necessary to achieve further success. And as far as where their focus is now, three of the major issues, I think, are achieving technological self reliance in strategic areas, improving, particularly China's ability to manage the international environment, and then finally, progressing events in and around and related to Taiwan toward unification. Okay. So can you tell us a bit more about why you identified technology as the first objective here? And could you give us a sense more precisely of what China is interested in? Yeah. So I put, you know, technological achievement first because it's really at the core of China's strategy for this national rejuvenation, this return to a place of prominence and leadership in the world, harnessing the application of major breakthroughs in artificial intelligence, AI, you know, and other technologies is is central to Xi Jinping's vision, not only of a modern economy, but also a world class military capability and almost certainly an effective domestic and then also, you know, by extension, an external, security architecture. And this emphasis here, you know, on the centrality of of technology is very clear in the fifteenth five year plan. The second major objective identified in that document is greatly increasing China's science and technology self reliance. And if you look at the substantive policy chapters, the first three deal with using advanced technologies to upgrade China's manufacturing base, striving for breakthroughs in what they call critical core technologies, and then improving China's level of digitalization through computing resources and AI. Now in terms you know, I guess, you know, try to get down into the specifics. Obviously, AI, as I've said a number of times already, that's a a huge focus. Embodied AI specifically, so things like humanoid robots, that's also getting a lot of new attention in this latest iteration of the development plan. Other, what they call critical core technologies, include semiconductors, foundational software, advanced materials, biomanufacturing. And I I particularly highlight those because not only are they critical core technologies, they are sort of designated for what China is referring to as unconventional measures to achieve breakthroughs. And so, really, what that means is sort of an all out push to make sure they, can be self sufficient or as self sufficient as possible in those over the next, you know, five years or so. But, of course, the fifteen five year plan is a massive document. It covers a lot. There are a lot of other technologies also present. Some of those that are receiving more infer more attention than they did back in 2021 with the fourteenth five year plan include technologies for, quantum communication, deep space, deep sea, hydrogen energy, nuclear energy, new type batteries. And then, you know, still again, there are other areas. Brain computer interface technology or BCI technology, is another major one you can see being actioned. So there's a lot, but the ones I've named here, I think, are are pretty important, relatively new focuses for them. Great. Thank you, Adam. So what do you think stakeholders in these technology fields, AI, semiconductors, quantum, etcetera, can expect in the medium term, as far as risks to their interests are concerned? And so maybe we could start with Fema. Sure. Thank you. So over the last decade and more, a substantial portion of targeting by Chinese cyber threat groups for economic espionage has been quite aligned overall to the country's strategic priorities, not only in terms of technology theft, like think design blueprints or production setups, but also in terms of business models so that Chinese entities, particularly state owned enterprises, can better compete in foreign markets. And so if you are a company in a sector that is key to Chinese strategic interests or particularly if you are a standout innovator in your sector or if you are competing with Chinese companies in key strategic sectors, then you are quite likely to become a target of cyber espionage. So RedGolf, which broadly aligns with APT forty one, is a great example of this. They have had incredibly varied targeting, really going after a wide variety of sectors. And overall, we know that through time, RedGolf has historically closely aligned with five year plan development goals, including semiconductors, high-tech manufacturing, you know, advanced health care and diagnostics, for example. But they also, for example, targeted the automotive sector. And that was particularly interesting because, of course, China has put significant investment and focus into the development of e vehicles and its export of e vehicles, including to Europe and Latin America. There's also another element to this, which is that often when it comes to espionage, Chinese state sponsored drug groups won't only directly target a company or entity, but also their ecosystem and supply chain. And what I mean by this is the entities that are funding a specific company or standard project, regulators for a specific sector of interest, patent offices, lawyers offices that represent the target company, trade unions. Also, they may target company subsidiaries and sister companies. And, you know, and this is not only for supply chain access even though that can also be the case. It is also to gather more information about a whole ecosystem, gathering that broadened context. So for example, again, with Red Gulf in 2025, this group also targeted trade groups and think tanks and law firms, as well as specific government entities quite prior to the point where The US and China were holding trade negotiations. And so this was likely to garner insight into what US policy might be going into those negotiations into the first place. Red Juliet, which broadly aligns with Flux typhoon, is another great example here. This is one of the primary threat groups targeting Taiwan. They have targeted Taiwanese government, academia, technology, diplomatic organizations, and their twenty twenty five activity in particular, it's quite likely that among other more traditional espionage and intelligence collection, it provided insight into industrial policy, export control responses, r and d ecosystems, and strategic commercial planning. So it's a whole of ecosystem kind of approach to targeting. And so as an organization, you really have to look at what am I involved in in terms of my customers, in terms of my investments, projects, you know, that are in an area of strategic interest to the Chinese government. Because you may not be targeted just because of you, but also because of strategic customers that you have or third parties that you have. Oh, that's great. Thank you, Suvebo. Devin, is there anything you want to add? The only the only thing I might add is that, you know, foreign technology acquisition, whether it's illicit through cyber means, or illicit through, sort of, you know, other other methods, a core part is is a core part of China's approach to economic and technological development at at this point. So even, you know, as we see the country's ability to innovate at the cutting edge and it's becoming a leader in certain, areas, you know, cyber enabled economic espionage, foreign talent recruitment, acquisitions of foreign companies, you know, all of these approaches and many others, they're very likely to kind of remain in play to ensure that China, retains its leading position well into the future. Great. Devin, earlier you mentioned that China will be trying to improve its ability to manage the international environment. What will that look like? Yeah. So I think, you know, this is an area where we might see kind of the most acceleration in China's assertiveness over, the next five years. Obviously, this is kind of a very wide ranging, topic that's gonna cover a lot of different activities. But I think, you know, some that I would highlight would be intelligence collection, cognitive shaping, new legal frameworks, and then reforms to the international system. And if maybe I have a a few minutes, I can go through a couple of those in in more detail. By all means. Yeah. So may maybe we can start with that last one, you know, reforms to the international system. This is something that China, China's leadership has communicated interest in for a number of years now, but we're finally getting to a point where they are increasingly vocal and clear about kind of what that might look like. I mean, it's still not totally defined. I don't wanna set up, you know, wrong expectations here. But they're they're sort of getting more and more insistent. They're putting more action behind some of these ideas to foster what they call a multipolar world. And, you know, there's a lot of components to this. The United Nations or the UN sort of system and that architecture would be at the core. China really wants to emphasize dialogue as a problem solving mechanism, ideas of collective security and other things, human development, not so much human rights. It's a lot of language. And, you know, when the rubber meets the road, we always get questions about, well, is China actually doing anything here? If you kind of take a step back and you look, especially in in a recent document that they issued, they connect these ideas pretty directly to not just China, China's ambitions, but the Chinese Communist Party's ambitions. And so what that means in practical terms when they talk about a multipolar world, you know, I don't necessarily see that as an outright fabrication, but that new sort of system that they're hoping to foster, I think, would almost certainly place a premium on preserving the CCP's freedom of action, its security interest, and then also, of course, China's goals for, you know, what it needs to sustain a sort of leading position in the world or have sort of an outsized influence among the global conversation in this multipolarity. And so, you know, the strategy that they're pursuing for this, as you can see actually from the fifteenth five year document, fifteen five year plan, is, greater, what they call united cooperation among developing countries. And then in June, they actually published a white paper on international reforms that was really an explicit call to action among the global South to, quote, improve global governance as championed by the CCP. So there's a lot of action happening here, and it's something definitely to watch. Another area, that I think is quite important is intelligence collection. So here, the MSS's leadership is really signaling that it will become increasingly proactive. Specifically, for, I think, this audience, they are looking to strengthen, their ability or China's ability to detect threats to their overseas interests. So that's business deals, you know, threat terrorist threats to infrastructure investment, regulatory threats to, you know, Chinese business or, economic opportunities. And then the other thing that they're really trying to do is counter, quote, unquote, blockade, counterblockade struggle is what they're trying to wage, and the focus there is directly directly combating efforts to curtail China's technological development. So, again, zooming out, not only does this suggest, you know, increasing traditional espionage, also increasing, economic espionage, increasing influence activities, but it also likely indicates that China will continue to, deepen its engagement with other countries and communities through the MSS, the public security system led by the Ministry of Public Security, and the United Front system. One final area, and I know I've maybe gone a little bit over time here, but I think this is important. One final area, I think of deepening intensification is China's use of what I'm gonna call legal and regulatory struggle. So, over the last number of years, especially since about 2018, China's leadership has invested heavily in establishing an ability to mitigate, sanctions, export controls, and other forms of foreign coercion. And now, they've really, I think, pivoted into really starting to use these things. So, in June, so last month, China used its, 2021 anti foreign sanctions law for the first time to block, at least at least on paper, compliance with US sanctions related to Iran. In April, also this year, China passed regulations for countering improper long arm jurisdiction. And then in May, so just a month later, use those same regulations to order noncompliance with European investigations into a Chinese company. And what I think this kind of illustrates is an acceleration from passage of these laws or regulations into implementation. And these two examples are also just kind of a flurry, or just, like, part of a flurry of activity over the last year and especially the first six months of this year with the CCP, you know, seeking to limit the ability of AI talent to leave China, restricting overseas investment activity, and a number of other, actions aimed sort of broadly at China, aimed globally, and then in some cases aimed at specific countries like Japan. So, again, I think this is a space, where we're likely to see more action, and it's gonna lead to greater uncertainty as far as the business environment goes. Great. Thank you for that, Devin. So essentially, it sounds like, you know, we're seeing China position itself to be sort of more involved internationally and get ahead of risk to manage them on its own terms. Do you see, cyber capabilities being used towards similar purposes, Feva? Absolutely. You know, China, like other countries, has long used intelligence collection, including through cyber means both to proactively manage threats and to gain that situational awareness and decision advantage. This is true across the economic sphere, you know, as my examples earlier showed, gathering intelligence on other countries or specific companies' approaches, for example, to trade negotiations. And it is also true across the political and international sphere, particularly in relation to geopolitical flashpoints and emerging developments. This kind of cyber, you know, enabled espionage is best understood as wanting to provide Chinese decision makers with the most accurate understanding of the context and the thinking of other sides that they may engage with or contend with to put those decision makers in the best possible position to take action to achieve those strategic goals. So just to give you some examples, over the last year, we have continued seeing Chinese drug groups seeking to gather intelligence ahead of and during fast paced geopolitical developments. One example is Red November, which is a Chinese state sponsored threat group. In December 2025, it attempted to target the European Parliament and several different government entities in Italy. These included Italy's Ministry of Economics and Finance, the Foreign Cooperation and Development Agency of Italy, the Agrarian Research and Economics Council. And the targeting attempt came at a quite a tense time in terms of international trade. In December 2025, China was imposing tariffs on EU dairy products, possibly in retaliation for previous EU tariffs on electric vehicles. And then also on 01/09/2026, there was going to be a vote in the European Parliament on the European Mercosur trade deal with Latin America, which could have increased competition for China in those markets. And at the time, Italy specifically was seen as a key holdout on the vote. So it is a realistic possibility that Red November might have sought to find out what the EU was thinking, of countering those Chinese dairy tariffs with, if at all, and what Italy was thinking about the Mercosur deal and that key vault. Another example is the Embassy of Cuba in Washington, DC, which has been quite the magnet of threats over the last few months. We have observed multiple Chinese fraud groups attempting to compromise its servers, particularly its single inbox between, you know, Q4 twenty twenty five and the first half of twenty twenty six. And this is obviously in the context of escalating rhetoric by The United States, which has then evolved into a now six month oil blockade, of Cuba. So we saw in November trying to compromise their mailbox and to exfiltrate communications prior to February 2026, although we could not confirm from our visibility whether they were successful in doing so. But separately, we observed that developing group that we're calling tag one eight five, which is separate, successfully using Shadowpad to compromise that same target sometime prior to April 2026 and into May. So that's the kind of, like, finger on the pulse and wanting to monitor a situation. Probably, Chinese drug groups were also trying to see from the other side, and so what The US was thinking about Cuba, what Cuba was thinking about the current blockade situation. And another example I want to bring up is as Watini. In late twenty twenty five and early twenty twenty six, we saw Red November really focusing on targeting government ministries and a few key, like, state owned entities in the country. And the context of this is that China was de facto slowing zero tariff negotiations with the Southern African Customs Union because Eswatini, which is part of the union, maintains diplomatic ties with Taiwan. And so this cyber activity could have been an attempt at understanding whether a was going to potentially relent under the economic pressure or, you know, to what extent it might have, been swayed away from the Taiwan ties that it maintains. It's very interesting. Thank you, Suveva. And I think that last example really leads nicely into the final area Devin had, mentioned, which was advancing toward unification with Taiwan. Can you tell us, Devin, what the latest is in terms of risks in and around the Taiwan Strait? Sure. I mean, I think it's no no secret, that China's leadership has become increasingly insistent, especially over the last five years that progress toward unification is achieved. At at a minimum, that likely means, you know, reversing perceived actions toward independence, undermining the Taiwanese government's government's ability to oppose China's objectives of binding Taiwan to itself and then also further isolating Taiwan internationally. And so we see, you know, continuing activities toward all of these areas, including economic programs that appeal to the subnational level in Taiwan, exchanges with leading political opposition groups, and the imposition last month of a, quote, unquote, near seas governance model near Taiwan. And that that incident, was actually quite, striking, I guess you could say, because Chinese government, ships reportedly questioned foreign vessels about their crews and their voyages. And that's notable because it's it kind of moves us from drills to actual enforcement operations, or at least a little bit closer, one step closer to that. And so it's been something we've been looking for for a long time, and now we, unfortunately, see that. China's diplomatic corps is also reportedly increasingly warning, you know, US local government entities and private businesses about their interactions with Taiwan. There are reports of China's diplomatic corps also attempting to, you know, reinterpret European laws for European lawmakers to dissuade any engagement, again, with Taipei. And so across the board, you know, we try to continue to see deepening and incremental escalation. However, the risk of a an armed conflict or a high end military conflict, whether that's an invasion or a military blockade or some other similar scenario, in my view, is the risk of that is likely low through the end of twenty twenty seven and into early twenty twenty eight. Much of the People's Liberation Army or PLA, leadership is still vacant following sweeping purges even though they are now starting to kind of rebuild. Xi Jinping is, for his part, likely focused on ensuring a smooth transition into a fourth term as general secretary, at the next CCP National Congress that will be held in late twenty twenty seven. China's domestic, economic and technology challenges are also likely weighing on a decision of whether or not now is the right time for a war, or whether a war is necessary. And and and critically here, right, none of those factors would necessarily preclude, armed conflict under certain, you know, acute threats or certain scenarios. But I I don't think that China's leadership is likely to perceive a, particularly urgent reason to go to war right now. And so I I think those factors are still relevant. And in fact, in Taiwan, I think China's leadership continues likely continues to see or assess opportunities for advancing the CCP's objectives through coercion, inducements, influence activities, propaganda, especially exploiting a lot of the division we see in in Taiwan's political environment right now. I think, you know, the next time that we should be reevaluating armed conflict risk around Taiwan is around Taiwan's presidential elections that will be held in early twenty twenty eight. But in the meantime, you know, short term, law enforcement led quarantine similar to this near seas governance model that we, just witnessed, a disruptive cyber action against Taiwan's critical infrastructure, which we haven't actually seen that in a number of years at this point, But I think both of those options are still on the table, as far as risks in the near term. Great. Thanks, Devin. You know, it's really a trillion dollar question, so I really appreciate you taking the time to address that specifically in terms of, you know, the potential for military conflict, focus on Taiwan. Svoboda, I'd like to to, pivot to you. So what are you seeing in Taiwan's cyberspace? Oh, okay. Awesome. Managed to. successfully mute myself. There are three main aspects that we see in terms of, like, cyber targeting of Taiwan. And the first is obviously, you know, targeting of government entities to remain in the know of any political developments, but also national level planning, local authorities too, military, as well. Second, economic espionage related to advanced technology, semiconductors, chips, even, you know, technology parks, R and D. Taiwan is such a key part of the global semiconductor and high-tech manufacturing supply chain. And then thirdly, there is that targeting of critical national infrastructure, both physical infrastructure, you know, thinking roads, airports, potentially also tying into their potential military use in order to gather information, but also technology infrastructure, including telecommunications, including for both espionage and potential prepositioning. So if I were to say some of the threat groups that we see as being active in Taiwan, the most, Although, of course, there are others. That would be both Red Gulf and Red Juliet, which we have mentioned before. Both of these groups remain highly active. They have both previously targeted the private sector, academia, and government entities, including Taiwan. A different example is RedDelta, which aligns with the group that is known in open source as TA416, bronze president. RedDelta is a remit of intelligence collection, which covers both Europe, but also interestingly Asia, so from Mongolia to Vietnam to Taiwan. This is a group that is particularly interested in government departments, and de facto it functions as a finger on the pulse of key geopolitical developments, international relations, certain states' particular policies towards China or Taiwan. And so we saw them targeting Taiwan, including during the twenty twenty four presidential election for espionage. And Red Elk is still very active, so we can likely expect them to be active in the run towards and in the context of the twenty twenty eight election too, tying in with what Devin was saying. Tag fifty one, Black Tech, has focused on Taiwan and Japan for over a decade. They're a veteran at this. They're increasingly targeting edge devices. So VPNs, virtualization infrastructure, routers, BlackTech really heavily targets those deploying, you know, Linux specific backdoors. This is a group that heavily targets the one's technology and semiconductor sector as well as government and science parks. And Blackstock is also known for infiltrating companies overseas offices or sub subsidiaries and then making its way into the target company's core network from that. So that would be a great threat hunting hypothesis for this drug group if I was to go looking for them. And then Red November, again, which we mentioned previously, has also been targeting Taiwan. This has involved both private sector victims in the IT space as well as government entities. There was one particularly interesting case where we observed Red November targeting a specific county in Taiwan that is home to both a high-tech research park and Tuakeet Taiwanese Air Force Base. And this happened to take place the exact week that the PLA conducted a surprise military exercise against Taiwan. So we don't know if Red November is linked to the PLA as, actually, this is a threat group that has a really, really wide and really diversified targeting portfolio, and they pivot quickly in order to really align themselves with emerging situations and geopolitical developments to have the most up to date information. But we can absolutely see them coming back to target Taiwan in the near term and in the future as well. Great. Thank you, Suveva. Devin, Suveva had mentioned sort of cyber economic espionage or targeted economic espionage. And earlier you talked about foreign talent. And so it kind of raises the issue of non cyber forms of, economic espionage. And is that still a concern? Yeah. Def definitely. So, I mean, beyond, like, cyber espionage, which is, you know, what a lot of people still focus on and and rightly so, we still see and I think can likely expect to see a range of, approaches to gain advantages in various technologies well into the future, including, efforts to circumvent export controls. And if I had to, like, kind of narrow down to one particular threat vector, I would say, you know, insider threats are likely sort of a key concern here. China's, governments, entities, universities, labs, companies, they all continue various recruiting activities. And in fact, this may be on, an accelerating path. So earlier this month in, different speeds by Xi Jinping, I know I've referenced a couple of them at this point. But just this month, you know, he referenced this idea of a window of opportunity in global talent flows and specifically emphasized actively recruiting foreign experts and expertise, to China. Now, you know, this can still take, place in a number of different forms, such as short and long term, research opportunities that are subsidized by the Chinese government, and also, in some cases, simply high salary employment officers for pre permanent relocation to China. In Taiwan, we can see cases of Chinese companies setting up front entities to poach local talent despite restrictions in certain, fields like semiconductors. And then in other instances, once again, we still see, employees. They just see opportunities in China through various channels. They move there. They wanna set up their own companies. And, unfortunately, in some cases, they do take intellectual property or trade secrets with them, to enable that activity, and it's a fairly permissive environment for that. I guess the only other thing I might add, just again, since AI looms large in today's sort of, thinking, right, We are seeing large scale distillation from leading US models, efforts to, smuggle export control advanced semiconductors to China, and activities simply renting activities from Chinese entities simply renting compute time on foreign servers with kind of the most advanced chips. All of these are ongoing risks, kind of unique to the AI sector. And bringing this back to kind of the fifteenth five year plan and China's ambitions, right, China's leadership very much does want to reduce dependence on foreign technology like this. But as we speak here today, it remains highly relevant, especially to users with high end or demanding requirements like in the military. Great. Thank you, Devon. Appreciate that. And so, Devon, Svava, very much appreciate your insightful analysis. I wanna pivot here to our colleague Kathleen, to showcase how the Recorded Future platform can help customers understand the threat landscape and defend against cyber attackers. We're gonna use an example focused on Red November's targeting of Taiwan. And over to you, Kathleen. Great. Thank you so much. I'll say the famous words of, can you all see my screen? And I believe we can. So as mentioned, with all of the great analysis that both Fema and Devon went through, it's really important to also showcase how Recorded Future helps our customers track not just Red November, Red Juliet, all these different China and Asia state actors, which will be the focus for this five ish minute walk through today. But how this is all prioritized based on our customers' own unique threat profile from their executives to their brand names to the infrastructure that they have. So how are we actually identifying malicious traffic from victim IPs to infrastructure that Sveta and her team are tracking as we associate with China nation state actors? So we'll go through that workflow here today. So maybe one of my questions is I wanna know if China nation state threat actors who have the higher intent and opportunity to target an organization like myself, again, based on what is unique to my organization from a footprint perspective, from Red Mike who's come up a few different times to Red Juliet. Where for Red November, Red November poses a higher risk to my organization because of a variety of different evidence targeting vulnerabilities that I've used, targeting specific infrastructure that I am tracking as associated with my own company. But, importantly, not only just telling you, yes, Red November poses a slightly larger risk to your organization or threat, But what are those hunting packages to actually run some of those hunts yourself? It's really the collation of the network intelligence which we're we're going through along with the insights group research from Svebas, from Devon who is also all being provided into the platform that helps make these connections even easier. So for example, one of the more recent reporting, you know, as we're talking about different China nation state threat actors targeting various government entities, whether that's in Latin America. So I talked about some of the Cuba examples. Two of some more recent evidence that the team has tracked looking at victims in different African governments, including Namibia and Zambia, where in addition to having the full insect research lead available, also providing everything from the diamond model. This is important because as you all are looking at maybe similar activity that you're seeing in your environment, you're clustering, you're trying to understand and track. Well, does this activity align with, let's say, no nation state group MO, especially for China? Having the diamond model of intrusion analysis that the incident group is always tagging their research to is a really good, good to have just from the analysis perspective. And as well, providing any of the behind the scenes queries that are powering the ability for our customers or any analysts using the platform to be able to run similar types of queries. So one of these specific queries is looking at and overlapping our malicious traffic analysis. So, again, what is the midpoint data we're seeing between the victims and these malicious c two infrastructure that the team is monitoring for? In this case, looking for an associated malware with Red November, Pentagona. I think I said that correctly. So I've mentioned to me before, it actually is an Italian word. It means sewer rat. So fun fact and language. Fact for any of you language nerds out there. But in this case, I can be very specific, and I'm actually just looking for any source IPs from Zambia that are communicating with this Maurer family. But the political piece is really important. Devin's done a great job outlining the different political aims that the Chinese Communist Party has as well as other economic drivers, the same as FEMBA. So being able to understand, well, are there different political events that are occurring that could maybe explain some of these cyber activity that we're seeing? Now I should know, as a former intelligence analyst, I know correlation does not mean causation, but the patterns are interesting when you do see a, for example, a joint cooperative agreement signed between Zambia and China, and then fairly soon after a large spike in NetFlow analysis that we're seeing between Zambian government IP addresses along with Red November. So, again, being able to provide this level of detail helps threat hunters, helps customers be able to understand and track some of those different threats. But we spent a lot of time talking about the specific threat to Taiwan because China nation state groups also like to target or at least focus on countries who are right in their backyard in Southeast Asia and being able to target and track threats to edge devices. So understanding if I have those edge devices on my network that a China HD group may have a higher likelihood of targeting those. And this is where very similar we can do similar types of analysis looking at network intelligence overlapping with the political events in Taiwan. So, again, very similar seeing spikes in outbound activity to different confirmed red November c two infrastructure. And, again, how does that overlap with some of the different political events that we're seeing? As always, for any of these queries, I can save these queries. I can save them along with the in search group notes. So if I want to look back at some of those really good research pieces, I can always resort back to those, and I can always use Record Future AI to sum everything up as well. That was a really quick overview. As mentioned, just wanted to walk through just how some of our record feature customers can use in sync group research within the platform, use our advanced query builder to perform more advanced analysis, and also help with that threat hunting and threat detection perspective. So with that, I'll throw it back over to Devin, who I believe is gonna talk a little bit more about Taiwan before some q Thanks. Thanks, Kathleen. Yeah. I actually I just kinda wanted to draw out something with, Red November and and, Seva particularly made mention of it as well before we pivoted. And that is this idea here. of cyber activity during periods of heightened, PLA coercion around Taiwan. Taiwan's National Security Bureau has communicated a couple of times at this point that there is a, quote, degree of correlation between cyber activity that can be attributed to, China aligned or, you know, China based threat actors generally and the PLA's conduct of joint combat readiness patrols. So, again, like, to reiterate, we do not know if Red November is in any way affiliated with the PLA. But this is likely a trend worth, watching and trying to dig into if you're someone who has a lot of visibility into, you know, NetFlow and things like that. That's something we're working on here as well. There's not a lot of inform public information as far as I'm aware on how the PLA is training to integrate cyber with joint operations, but that is likely happening. So I think it's a very interesting and important area to watch. Great. Thank you, Devin. Appreciate that. And thank you, Kathleen as well. Okay. So before wrapping up, for questions, let's, sort of go through any recommendations you may have for our listeners in terms of mitigating, potential risks to their interests. And we'll start with Devin. Sure. I might offer, I guess, two quick suggestions. The first is kind of aimed at, that talent competition with China companies, you know, foreign companies, universities, and other organizations, or those adjacent to, as Seva has has strictly highlighted, important technological fields still need to be putting effort into strengthening their approaches for mitigating insider risks, such as by monitoring, you know, employee email and phone contact between personnel and potential recruitment vectors, and by conducting, you know, proactive training to alert employees to the potential of outreach by Chinese intelligence fronts on platforms like LinkedIn or other other avenues. Another thing that I don't think it's mentioned so much but is is important is that, you know, a lot of times, China is trying to attract talent with the promise of, you know, perks, so better salary, better funding for your research, opportunity in general. So considering you know, continuing to consider the quality of life that your high end talent enjoys is also gonna be an important part of the strategy, I think. The second thing I would offer is that, efforts to monitor sort of changing compliance landscapes in China likely need to be increased and also expanded. So by expanded, I particularly mean that, you know, reading the letter of the law or given regulation is not really enough. Compliance and risk teams kind of need to be able to better, interpret or understand the political intent, behind those regulations to predict possible risks and outcomes. And I think the case of Manus, that Chinese AI company which moved to Singapore and then was acquired by Meta, really highlights this. So Meta reportedly, you know, followed all of the appropriate on paper procedures for acquiring this company, but it is now being forced to undo that transaction even though Meta or Manus, was already entirely or almost entirely operating outside of China. And I I think that that is likely a political outcome rather than a letter of the law outcome. That's really amazing. And if I can just jump in from the cyber side in terms of recommendations, Isaac on what everything said in terms of, like, the recruitment, pipeline aspect. From a cyber perspective, as frustrating as it sounds, I think organizations, really want to focus on getting the basics right. It sounds particularly unattractive, but things like really great password and account hygiene, privileged access management and permissions, ensuring, that you have really locked down which accounts can access what documents and systems within your organization, A solid asset registry that records all your assets under patch status, what assets are not in use, and can actually be decommissioned in order to, you know, reduce your attack surface. It's really not about being perfect, but it's about making it much harder for a threat group to get into your organization in the first place. And, you know, patching is really important for this as well. I'm really keenly aware of how difficult it can be for defenders to keep up with new vulnerabilities, you know, being discovered all the time, including now with AI. But ultimately, it comes down to really knowing your network and prioritizing the vulnerabilities that can have the largest impact depending on your architecture. Anything that is unauthenticated remote execution is a nonstarter. Anything that's related to VPN configurations and identities that can be reused later for access is also, you know, critical to patch. Anything related to your email inbox or file storage, which is where a lot of your, you know, key files will reside. Chinese threat groups, in particular, really focus on targeting edge devices. And so anything that is Internet facing at a baseline should be fully patched with the utmost speed. But sometimes even that is not possible, and so go for good enough, for starters, patch what is going to be the most damaging vulnerabilities in terms of the most privileged and direct access that they enable to your network. Great. Thank you both. Those are all great steps, Pfeff, that organizations can take at a tactical level. How can they go further than this? How can they better position themselves to defend or stop threat actor intrusions, beyond just kind of defending the perimeter? I would love to, like, have a whole, like, other hour on this, but at the bottom line, the strategy that I always advocate for is the fence in-depth Because, you know, we might not be able to stop zero days. We won't even know that they're coming necessarily. We can't anticipate necessarily new techniques that are coming up. However, you wanna get to a place where you have detection opportunities at different levels of the key chain. You have to have logging and monitoring capabilities in place to do that. And once those are set okay. Sure. Maybe you don't detect the or the exploitation, but maybe you detect that a new user has been added to the VPN that wasn't there before. Maybe you detect that a new file has been created and that ends up being a web shell. Maybe detect Mimi cuts running on a host, a backdoor command and control beaconing in your, you know, network monitoring. All that layer defense approach makes it so much more difficult for threat groups to operate and to be successful, and it also reduces the pressure for defenders to be absolutely perfect at everything all the time. So I am a big advocate of defense in-depth even though there's no silver bullet that really helps you find them if they do manage to get into your network and boot them out. Great. Thank you, Sviato. Okay. So with that, we'll go ahead and turn to audience questions. And I I wanna just note first, that we really appreciate all the great questions that people have have, added in the chat. If we're not able to address them on the call, we'll do our best to answer them in a follow-up blog post on the Recorded Future website. Okay? And so with that, let's go ahead and dig in. Devin, first one's for you. There's a question about sort of how the, Chinese population views, long term goals versus the Chinese Communist Party? And is there any internal struggle between those two sort of factions that could possibly impact regime change? Yeah. So, I mean, the first caveat here is it's difficult to know. Right? China does a lot of work to manage, access to sort of grassroots opinions on things. If you're not in the country, I will say that if you are in the country and you can have those conversations, certainly, it's opportunity to learn a lot more. But from, you know, where I sit, unfortunately, it can be a quite a difficult question to answer. My sense you know, all of that aside, my sense is that there is more alignment than discord, but certainly some areas, of, you know, differing opinion. So on things like China advancing toward the center of the world stage, again, to kind of use their language, right, returning to a place of prominence in the world, feeling national pride in that, I think that that is likely, quite widespread. Right? People look at China's economic development over the last thirty years and all of the new technologies that they have, and they they feel pride in that. They feel good. But then, you know, on other issues, more specific issues, there are probably some disagreement. So in particular, right now, China is trying to execute this transition from an old economic model based in low end manufacturing and infrastructure investment and these other things to one that really emphasizes advanced technologies and innovation. Long term, that is the right strategy probably, but, there's a lot of economic hardship, I think, that's coming with that. And it's there's you know, obviously, it feeds into the larger international environment, things, you know, with the price of gas and tariff wars and and all of this comes to a head so that, you know, the ordinary person in China, in many cases, is probably thinking, you know, things don't feel so great economically for me, you know, my family. Some of the, you know, data points that we can see toward that, include, stagnant, if not actually declining in some areas of, household consumption. A lot of China's, workforce is currently in a gig economy model, which is likely not great in terms of trying to achieve some long term ambition that an individual might have. So there there are frictions there. For things like Taiwan, I think most Chinese people likely do, agree with the idea of unifying with Taiwan at some point in time. But, you know, popular support for an armed conflict is only you know, again, it's very difficult to know from the surveys we have, but, generally, the surveys show that only around 50% of the population actually supports, armed force and usually only in certain scenarios or under certain conditions. Like, if you assume that The US is not gonna get involved or Taiwan tries to declare sort of independence. On the whole then, you know, I don't see a popular push toward some kind of regime change as likely in the near future. I'm just not sure most people are really at at a stage where they're thinking that way. And then also, of course, China does a lot of work to prevent people from actually being able to, organize toward that goal. Great. Thank you, Devin, very much for that, thoughtful answer. So I'm gonna go to Sveva with the next one. We had a question about, the hybridization of China nexus espionage and cybercrime activity. The question, questioner noted, several recent China attributed campaigns, that publicly and privately have exhibited a blend of espionage and financially motivated activity, and then sort of overlap with infrastructure and tooling and trade craft. What factors do you think are driving this hybrid threat activity? That is such a great question. I want a whole other webinar just on that. I think there are two key areas that we see, and I would love to discuss this further in case anyone else has other visibility. The first strand is where ransomware gets deployed as a smokescreen to potentially, as a decoy in order or to erase traces, including forensically of, you know, exfiltration or espionage activity or so to just make it look as if it was a ransomware attack. We know that there have been some cases, particularly in Taiwan, and I think there was the case of bronze starlight deploying ransomware on systems after having conducted likely exfiltration of sensitive documents that would mark more espionage intent than, say, a group trying to perform extortion, especially because this is not followed on any, like, leak sites, you know, the way that, for example, Iranian threat groups pretend to be ransomware or hacktivist fronts. On the second front, we do know that in the Chinese, cyber ecosystem, there are contractors that are private sector companies or individuals that perform services or provide capabilities or even steal data and then resell it to PLA, MSS, and PS. And so I think it is quite possible. And in fact, we have had examples of this, including with APT 41, where those private contractors have incredibly bad OPSEC and don't really segment their espionage activity or their national objectives related activity From there, I'm going to hack video game currency and make a boatload of money for myself. So I think those are the two main aspects that we see. It would be interesting, and it will be interesting to see whether there's going to be any appetite from China to blend those more. But as it is, the private sector in China is already very tightly embedded, including in the contact in the contractor space with government entities. Again, need a whole other webinar for that. Thank you for the question. Great. Thank you, Sveva. All right. We have time for one last question. And again, those that we have not been able to address live, we'll do our best to answer in a follow-up blog post. So this question, is, I guess, we'll we'll go to Devin on that. And it's about the eventual outcome of the Russian invasion of Ukraine and have, whether or not have any impact on China's Connecticut tent towards Taiwan. And is there any possibility that, Beijing is waiting for the outcome of the twenty eight presidential elections? Unclear if the question refers to The US, elections or the Taiwanese. I I think it well, I interpret it as referring to the '20 early twenty twenty Taiwanese presidential elections. I I guess, you know, and I think that's where I might focus. I have, in my personal view, I have never seen the Ukraine and Taiwan conflict possibility, as particularly connected. You know, I didn't agree with the assessments very early on that China would try to take advantage of chaos in Ukraine to move on Taiwan back in 2022. And I still don't see these two issues as, particularly connected, although, you know, of course, as, for instance, The US military attention, it kinda moves around and focuses and has implications for their ability to prepare in the, Asia Pacific. Sure. There are there is some linkage there. But in terms of China's decision, when or when not to act against Taiwan, I'm not sure that that there's that connective tissue. If I'm interpreting this question correctly and that it's focused on the twenty twenty eight Taiwanese presidential elections, I think that that will be, an inflection point, not necessarily that, you know, Taiwan will see the victor and then say, okay, yes, now it's time to go, assuming that the victor is from the Democratic Progressive Party signaling, you know, yet another presidential victory for them, over the long term. But that outcome, I do think, would start to push China into a territory where, yeah, their patience once again starts to wear wear thin, and the risk, once again, sort of escalates. And it's just another factor toward, okay, when do we really need to, make make a make a faithful decision that would have global impact? So, again, not, you know, definite that if the DPP wins in 2028, that's going to happen. But I think that would increase the risk. Now if the, KMT or the Kuomintang, if they win, you know, I think China might sort of mellow out and say, okay. Let's see what we can do with this administration to push forward along another path because, you know, I I believe that the risk of war is real, but it is, you know, almost certainly not China's first choice, and that is part of the reason we have not seen it today, despite the PLAs and, you know, advancing capabilities and and other areas of coercion. Great. Thank you, Devin. We'll let that be the last word for today. Thank you to both of our panelists for their very insightful and illuminating discussion on China's approach to strategic competition. And thank you to our audience members who participated and asked great questions. Have a great day, everybody. Thanks. Thank you.