WASHINGTON D.C. / BEIJING: Chinese media have been chattering about the result of the November 5 US presidential election, what comes next in US-China relations, and how to manoeuvre in uncertain times. Common themes emerge: “we (China) have seen this before”; there is “nothing to be afraid of”; and “we are ready to take the challenge.” To put this sentiment in perspective, it is worthwhile to look back five years to gain a better understanding of the Chinese government’s attitude toward a second term Trump presidency and the potential cyber implications in 2025.
During the US-China trade war in June 2019, Fan Yongpeng, a professor at Fudan University, claimed China had three “trump cards” to win: political autonomy, a robust industry and technology ecosystem, and a large-scale economy, while his colleague Zhang Weiwei expressed optimism about future US-China relations, suggesting the US would eventually accept China’s rise. Praised by the Chinese Communist Party’s People’s Daily for his confidence in the China Model, Zhang reiterated this stance in March 2024, dismissing the US political system as “genetically flawed” amid Donald Trump’s political comeback and asserting that China had already won the trade and technology wars, predicting America’s continued decline and affirming China’s growing confidence in overcoming US challenges.
In some ways China appears to have an even stronger grip on the three trump cards that Professor Fan cited in 2019. China’s top leader Xi Jinping has secured his seemingly forever-term in power with a tight grip on China’s political and economic life and public discourse. China can be said to have political autonomy in global affairs because China claims that the country and its Communist Party leadership “does not have to listen to any big brothers”. China has joined with Russia in proclaiming progress toward a “new world order” that is less dependent on the US dollar and Western financial institutions. China has continued promoting self-reliance and the building of its own industry and technology ecosystem.
Chinese scholars’ patriotic bluster may not paint a complete picture of reality. For example, China’s domestic computer chips still show a “gap in capability from the most advanced varieties made in Taiwan, using technology from the United States, Europe and Japan”.
In the context of China’s determination to overcome whatever challenges the country will face from the new US administration, looking into the cyber front, we have seen that cyber operations from China have evolved since 2015. A significant turning point was the revelation in May 2023 that Chinese state threat group Volt Typhoon had targeted US critical infrastructure. Subsequently the US government officially reported on Volt Typhoon following the US Department of Justice (US DoJ)’s takedown of a botnet allegedly used by Volt Typhoon in January 2024. US officials pointed out that China’s “historical focus on stealing state secrets and espionage,” meaning cyber espionage for political and economic interests, has evolved into a more ominous intention to prepare for destructive attacks.
Cyber operations are often stealthy, allowing threat actors to remain undetected within systems for extended periods. Publicity around Volt Typhoon has increased awareness and detection of hidden Chinese cyber activities, with Bloomberg reporting in November 2024 that Volt Typhoon targeted Singtel, allegedly as a test run for future attacks on US telecommunications companies. Although Singtel confirmed detecting malware in June, it did not verify the Volt Typhoon attribution. A subsequent report from SecurityScorecard revealed that Volt Typhoon has resurfaced with greater sophistication, expanding its global network through compromised routers, rebuilding its KV botnet, and using New Caledonia as a covert hub for cyber espionage, potentially enabling undetectable attacks on US targets.
Despite the lack of details to bolster the Volt Typhoon attribution, the US and the so-called Five Eyes countries (US, UK, Canada, Australia, and New Zealand) have confirmed in a February 2024 Joint Cybersecurity Advisory that “Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in Communications, Energy, Transportation Systems, and Water and Wastewater Systems Sectors—in the continental and non-continental United States and its territories, including Guam.” However, the Singtel and other breaches happened later in 2024, after the exposure of Volt Typhoon activities and the publication of the Joint Cybersecurity Advisory.
It seems that Volt Typhoon has not stopped its threat activities at all. It has been joined by other state threat groups: Flax Typhoon, which developed a botnet potentially usable “as a proxy to conceal their identities while deploying distributed denial of service (DDoS) attacks or compromising targeted U.S. networks”; Salt Typhoon, which compromised US Internet service providers to obtain access to US law enforcement wiretap services and the US presidential and vice-presidential candidates; and an unnamed campaign to tap the cell phone of Trump lawyer Todd Blanche. These Typhoons have all undertaken espionage activities that could facilitate future disruptive or destructive attacks or to influence the future president’s decision-making.
If China’s leaders believe the English saying that “things may have to get worse before they get better,” it looks like at least from the China side that “things” – a second-term Trump administration and the US-China relations – are still on the path to get worse, and potential escalation of Chinese cyber threat activity is very likely in the near future.
Views: 40
