Experts say China-linked groups have repeatedly hacked Russian companies and government agencies in search of military secrets since the war in Ukraine began
Since the war in Ukraine began, analysts have monitored a series of intrusions aimed at stealing information about weaponry and warfighting.
Context & Ripple Effects
Russia’s invasion of Ukraine ended an earlier reluctance to target Russian systems, with an unprecedented wave of attacks against Russian targets reported soon after the war began. The latest reporting adds a state-intelligence dimension: Russian military-related institutions are also targets for actors linked to a country often presented as a strategic partner.
It also fits a broader record of systematic intrusions attributed to Chinese state-linked groups and of Russian operators obscuring responsibility by using criminal tooling against Ukraine. Together, the coverage depicts cyber operations as a means of collecting war-relevant knowledge across nominal geopolitical alignments.
First-order effects
- Russian companies and government agencies holding weapons or warfighting information face a sustained espionage risk from the reported China-linked intrusions.
- China-linked operators could gain access to military-related technical and operational intelligence if the reported campaigns succeed, while Russian defenders must investigate and contain the breaches.
Second-order effects
- Russian security teams and military suppliers may need to treat Chinese-linked activity as a distinct threat even where political relations appear aligned, expanding monitoring and access controls around sensitive programs.
- The activity further complicates cyber attribution: as Russia-linked operators have used criminal tools to blur attribution in Ukraine, defenders increasingly face campaigns whose apparent source, tooling and strategic beneficiary may not neatly align.
Third-order effects
- If this pattern persists, cyber espionage will increasingly expose the limits of geopolitical partnerships: states can cooperate publicly while competing privately for defense technology and battlefield insight.
- The broader shift is toward intelligence collection as a persistent feature of conflict, with dual-use companies and government networks becoming strategic targets rather than merely collateral cyber-risk.
The trend: The war in Ukraine is accelerating cyber espionage as a channel for states to acquire military advantage, including from countries that are not formal adversaries of the target.