Understanding Chinese-nexus Cyber Tradecraft Through Behavioral Analysis

This document is a research report that analyzes Chinese-nexus cyber activity through behavioral data collected over three years. The research indicates a shift in cyber risk perception, suggesting that cyber operations are increasingly conducted for long-term strategic positioning rather than as isolated incidents. The report details findings from Darktrace's analysis, which identified numerous medium- to high-confidence intrusions linked to Chinese-nexus operators, particularly affecting critical national infrastructure sectors. Key insights reveal that a significant percentage of these intrusions targeted organizations in major Western economies, emphasizing the need for business leaders to treat cyber risk as a structural business risk akin to financial risk. The report outlines two distinct operational models observed: 'smash-and-grab' operations that prioritize speed and 'low and slow' operations that focus on persistent access. These findings highlight the importance of governing digital dependencies with the same rigor as other business risks to maintain competitive advantage in a complex digital landscape.