China Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, China
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for China, checked 7 Nov 2026. China publishes no public cyber threat level; CVERC issues malware and ransomware warnings and the CAC publishes enforcement notices.
Source: CVERC
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
| China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Mobile apps CVERC found collecting personal information unlawfully | 84 | Notice of 26 October 2026 | CVERC |
| Chinese organisations hit by ransomware gangs | 164 | July 2025 to June 2026 | National Computer Virus Emergency Response Center, via Xinhua |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Silver Fox (Yinhu) | Unattributed | CVERC warned of new Silver Fox trojan variants aimed at HR staff in Chinese organisations to steal data for extortion or fraud. | CVERC | |
| Weaxor | Ransomware | CVERC said it found multiple Weaxor attacks on Chinese users targeting enterprise databases and office systems. | CVERC |
Laws and rules this year
Full stories
Official statements
- 6 Nov 2026The CAC and the financial regulator launched a campaign against online financial black and grey market information. CAC
- 22 Oct 2026CVERC warned that Weaxor ransomware remains active in China and has hit multiple Chinese users. CVERC
- 16 Jun 2026The Ministry of Public Security said Jilin police detained 27 suspects who built a Silver Fox Trojan variant, phished company finance staff and stole corporate data. Losses topped 7 million yuan. China Daily
- 21 May 2026CVERC warned of new Silver Fox remote-access trojan variants disguised as HR documents. CVERC
Incidents
4 of 4 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ⚠️ ClaimedMindray | 7 Aug 2026 | Health | Data leak | Claimed. Clop listed the medical device maker on its leak site and threatened to publish data. No company statement found. | DeXpose✓ 8 Nov | |
 🚫 DisputedHikvision | 21 Mar 2026 | Manufacturing | Ransomware | Response. Hikvision said it was investigating and had seen no evidence of ransomware or operational disruption. Claimed. ALP-001 said it stole 19.9 TB and would release it in 200 GB parts. | Cyber Daily✓ 8 Nov | |
 ⚠️ ClaimedSAIC Motor | 24 Feb 2026 | Manufacturing | Ransomware | Claimed. Beast listed the state-owned carmaker on its leak site and threatened a full leak. No company statement found. | DeXpose✓ 8 Nov | |
| ⚠️ ClaimedNational Supercomputing Center in Tianjin | 6 Feb 2026 | Government | Data leak | Claimed. FlamingChina said it took over 10 PB including defence related files and offered it for sale. CNN could not verify the claim, though experts judged samples genuine. | CNN (via KEYT)✓ 8 Nov |
FAQ
Does China have a national cyber threat level?
No published national cyber threat level was found for China (checked 7 Nov 2026). China publishes no public cyber threat level; CVERC issues malware and ransomware warnings and the CAC publishes enforcement notices.
Which organisations in China confirmed cyber incidents recently?
None confirmed since January 2026 in our sources.
Which China organisations appear on ransomware or leak sites?
4 claims, not confirmed by the organisations: Mindray, Hikvision, SAIC Motor and National Supercomputing Center in Tianjin.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.