A three beats waltz: The ecosystem behind Chinese state-sponsored cyber threats

This report surveys China’s offensive cyber ecosystem, detailing how MSS, PLA, and MPS—augmented by provincial autonomy—increasingly outsource operations to private firms and professionalized patriotic hackers under the Military-Civil Fusion strategy. It highlights the MSS-centric shift since 2021, the collection and weaponization of vulnerabilities, the hack-for-hire market (e.g., I-SOON), and the blurred lines between state and private actors contributing to China-nexus APT capabilities and tool development such as PlugX and ShadowPad.