US and allies dismantle PRC spy infrastructure active since 2021

The US Department of Justice and seven allied governments announced the disruption of a sophisticated cyber-espionage campaign linked to the People's Republic of China. This joint action dismantled a global infrastructure used to steal sensitive data from organizations and individuals worldwide since 2021.

What happened

According to The Register, the US government disrupted specific hacking tools utilized by Chinese state-sponsored actors. These tools were part of a broader infrastructure designed to infect devices and exfiltrate data on a global scale. The campaign operated continuously from 2021 until federal agents stepped in to dismantle the network.

Seven governments joined the United States in issuing warnings about the extent of the data theft. This coordinated diplomatic and technical response highlights the international nature of the threat. The agencies confirmed that the stolen data included sensitive information from various sectors across multiple countries.

The disruption targeted the operational capabilities of the group rather than just individual malware samples. By taking down the command-and-control infrastructure, authorities aimed to halt ongoing data exfiltration. The Register reported that the FBI’s intervention effectively broke the chain of infection for these specific tools.

Why it matters

This incident underscores the persistent threat posed by state-sponsored cyber-espionage groups. The fact that the campaign ran from 2021 until the recent disruption indicates a long-term, patient approach by the attackers. Organizations that were compromised during this window may still have exposed sensitive data.

For CISOs, the involvement of seven allied governments signals a heightened level of scrutiny on Chinese-linked threat actors. It suggests that future operations may face increased international coordination and legal pressure. This is not an isolated incident but part of a broader pattern of data theft targeting global entities.

The timeline reveals that many organizations may have been breached for years without detection. The silent nature of the infection allows attackers to harvest valuable intelligence over extended periods. This latency makes retrospective analysis and damage assessment particularly challenging for IT managers.

What to watch

• Monitor for any new indicators of compromise related to the dismantled infrastructure.
• Review logs from 2021 onward for signs of unauthorized access or data exfiltration.
• Watch for follow-up statements from the seven allied governments regarding additional details.
• Assess whether your organization falls within the sectors targeted by this specific campaign.

What to do and how to stay safe: FBI

• Audit your network logs for connections to known malicious infrastructure associated with this campaign.
• Verify that your endpoint detection and response systems are updated to recognize these specific tools.
• Conduct a thorough review of data access logs from 2021 to the present for anomalies.
• Ensure that your incident response plan includes procedures for state-sponsored threat actors.

Step-by-step guide: Phishing Explained: How Attackers Steal Trust and Data

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did this espionage campaign begin?

The campaign began in 2021 and continued until the FBI disrupted the infrastructure.

Which countries are involved in this warning?

The US and seven allied governments issued the joint warning about the data theft.

What did the hackers steal?

The actors stole sensitive data from devices worldwide using the compromised infrastructure.