Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026

Trellix reported a 41.4% decline in detected Chinese nation-state cyber activity between April and September 2026 but warned the drop likely reflects changes in targeting or detection visibility rather than a reduced threat; China-aligned activity remained substantially higher than that from Russia and Iran. The report identifies the US and Turkey as the primary targets, notes transportation/shipping and telecom as heavily targeted sectors, names prevalent groups (Gamaredon, APT36, Mustang Panda) and tools (backdoors, infostealers), and highlights long-duration, stealthy espionage cases that underline ongoing risk.