Researchers: China's state sponsored hackers have switched tactics over the last few years, focusing increasingly sophisticated attacks on its ethnic minorities
SAN FRANCISCO — China's state-sponsored hackers have drastically changed how they operate over the last three years … Tweets: @liyuan6 , @nytimes , @nicoleperlroth , and @paulmozur Tweets: Li Yuan / @liyuan6 : “The Chinese use their best tools against their own people first because that is who they're most afraid of,” said James A. Lewis. “Then they turn those tools on foreign targets.” https://www.nytimes.com/... via @nicoleperlroth @kateconger @paulmozur @nytimes : More sophisticated attacks by China's state-sponsored hackers are targeting Uighurs' phones — even iPhones and even abroad, security researchers say. They warn that foreigners could be next. https://www.nytimes.com/... Nicole Perlroth / @nicoleperlroth : NEW: China has completely rebuilt its cyber corps in 3 years, swapping out sloppy phishing emails for supply chain and mobile attacks. Its most advanced hacking tools are now being used to silence critics in China and abroad. https://www.nytimes.com/... with @kateconger @paulmozur @paulmozur : Beijing's hackers had a holy grail, a way into the iPhone. They turned it on Uighurs living overseas. Researchers say it reflects newfound prowess that's come from a centralization of hacking efforts by Xi in 2016 under the Ministry of State Security. https://www.nytimes.com/...
Context & Ripple Effects
This 2019 report documents a tactical pivot by Chinese state-sponsored hackers: away from routine phishing and toward supply-chain compromises and mobile exploits aimed at Uighurs' phones, including iPhones held by members of the diaspora abroad. Researchers tie the newfound capability to Xi Jinping's 2016 centralization of hacking under the Ministry of State Security and the rebuilding of the cyber corps.
The story matters because it inverts the usual espionage timeline: per James A. Lewis, Beijing tests its best tools on the population it fears most before turning them outward. Later coverage shows the pattern holding, with China's operations increasingly resembling Russia's and North Korea's.
First-order effects
- Uighur dissidents and diaspora members — even those outside China using iPhones — become direct targets of nation-grade mobile and supply-chain exploits, not just phishing.
- Apple and security researchers face immediate pressure to detect and patch exploit chains being field-tested against a specific ethnic community's devices.
Second-order effects
- US intelligence, already described as one step behind Beijing over the past decade, must now track domestic-repression operations as a leading indicator of future foreign-attack tradecraft.
- Device makers and app-store operators absorb reputational and engineering costs as state hackers treat consumer platforms like iPhones as attack surface for surveillance campaigns.
Third-order effects
- If Lewis's observed sequence holds — domestic targets first, foreign targets next — counterintelligence agencies can use repression campaigns against minorities as an early-warning system for broader state cyber operations.
- Centralization under the Ministry of State Security plus pipelines of patriotic self-taught talent points to a structural model where domestic suppression and foreign espionage share one apparatus and one toolkit.
The trend: State hacking is consolidating into a single centralized apparatus whose suppression tools are refined on domestic targets first and then exported against foreign ones.