Preparing for the Storm: Analyzing China's Threat Actors

Preparing for the Storm: Analyzing China's Threat Actors by Trey Bilbrey China represents the most persistent cyber threat to Western organizations, with coordinated state-sponsored operations conducting intellectual property theft, counter-espionage, and critical infrastructure infiltration attacks. This presentation will give you a peek into their playbook and help you turn it into actionable intelligence for your defenders. We'll examine key threat actor groups and their behaviors, including APT40's rapid exploitation of newly disclosed vulnerabilities, APT41's criminal-espionage and cybercrime operations, Volt Typhoon's infiltration and persistence targeting critical infrastructure, and Salt Typhoon's counter-espionage and collection operations. We'll analyze recent breaches from each group and demonstrate how they serve Beijing's strategic economic and military objectives. Through this analysis, we'll highlight common tactics, including living-off-the-land techniques, patient long-term access, compromised edge devices, and supply chain exploitation. The implications extend beyond individual breaches. Systematic targeting of energy, water, communications, and transportation sectors represents preparation for potential large-scale geopolitical conflict, while ongoing intellectual property theft undermines economic competitiveness across manufacturing, pharmaceuticals, and technology. Attendees will gain practical defensive strategies covering observed TTPs, learn how to leverage public-private threat intelligence sharing, and access incident response resources to strengthen organizational resilience against this sophisticated adversary.