U.S. Seizes Cyber Tools from Chinese Groups

In August 2024, the U.S. Justice Department and FBI dismantled the online infrastructure behind two hacking platforms linked to a Chinese state-sponsored group. These platforms had been targeting U.S. government networks since at least 2018.

In October 2024, U.S. agencies seized hacking tools used by another group, which had previously been disrupted in 2024. This highlights the persistent nature of Chinese cyber operations despite past actions.

The U.S. government has acknowledged that while it can disrupt individual cyber operations, it cannot fully reverse the strategic advantages China has gained through years of cyber activity. This underscores the limitations of current deterrence strategies.

The U.S. approach to cyber deterrence has historically treated Chinese operations as isolated incidents. However, to effectively counter China’s broader cyber activities, the U.S. must address the incentives of a larger hacking ecosystem tied to the Chinese state.

Recent U.S. cyber strategy documents, including the 2026 Cyber Strategy, suggest a shift toward combining offensive and defensive measures with economic and legal countermeasures. Similar proposals from the Council on Foreign Relations and the Royal United Services Institute also advocate for integrating cyber operations with other state powers.

Despite these efforts, the U.S. has not yet managed to credibly deter the broader pattern of Chinese cyber activity. This is due in part to the fact that Chinese campaigns often serve multiple purposes, including espionage and conflict prepositioning, which are not easily constrained by narrow deterrence policies.

For example, in 2023, the Volt Typhoon campaign secured access to U.S. infrastructure in Guam, which could be critical for future operations. While some initial footholds were removed, the Justice Department warned that the infrastructure remains vulnerable. Security analysts later found that a linked group had steadily penetrated U.S. utilities through 2025.

Similarly, the Salt Typhoon campaign, which compromised U.S. telecommunications networks, was discovered to be surveilling congressional staffers’ communications over a year after the initial intrusion. It remains unclear whether the infrastructure has been fully removed or if the surveillance continues.

The 2015 agreement between the U.S. and China to limit cyber-enabled theft of intellectual property for commercial advantage saw a decline in reported Chinese intrusions. However, this decline may have been influenced by factors unrelated to the agreement, and Chinese cyber espionage has not been fully curtailed.

The U.S. now faces a more complex deterrence challenge, as Chinese cyber operations span a broader range of activities, including espionage and conflict planning. This makes it difficult to determine which actions warrant a response and how to structure deterrent measures effectively.

Moreover, Chinese cyber operations often rely on a network of external providers, making it hard to disrupt the entire ecosystem. Contractors frequently disappear and reemerge, and many are linked to Chinese state agencies, which can fund or replace them as needed.

While sanctions, export restrictions, and criminal investigations may deter some actors, they have limited impact on companies that rely heavily on state customers. Beijing can replace or protect such providers, making long-term deterrence difficult to achieve.

To meaningfully pressure Beijing, the U.S. would need to signal that specific cyber activities would incur substantial costs. This could involve measures in areas of strategic competition, such as semiconductor exports or access to U.S. markets.

However, such actions could provoke retaliation from China in areas where it holds leverage, such as restricting access to rare earth and critical mineral supplies. This could ultimately undermine U.S. national security efforts.

The U.S. may need to accept immediate economic costs in exchange for uncertain deterrent effects, but even sustained pressure may not prevent the accumulation of Chinese cyber capabilities. This leaves Washington with a difficult choice: whether the strategic value of deterring Chinese cyber activity justifies the associated costs.