China-linked Threats to Operational Technology

**Executive Summary:** This Threat Spotlight examines four China-nexus APT incidents (Volt Typhoon, APT27, APT31, BlackTech) over the last 12 months that impacted or targeted operational technology and related IT systems, detailing observed TTPs—such as RDP lateral movement, exploitation of public-facing appliances, PowerShell/WMI abuse, firmware/router backdoors, and multi-stage backdoors like ChargeWeapon—and offering prioritized detection and mitigation guidance while warning that Chinese APTs will likely continue focusing on OT for espionage and potential disruption.