China's Cyber Dragon: How a State-Sponsored Army is Rewriting Digital Warfare?

In the last twenty years, China has managed to turn a formerly scattered group of amateurs into a government-sponsored cyber army operating at the international level. A carefully constructed network of competitions, academic programs, military units, and private contractors, combined with judicial statism, has enabled Beijing to exploit hacking skills as an effective tool of state influence and leverage just as authorities and agencies remain outwardly silent and resistant to official moves to crack down on or shut down state-backed hackers.

Illustration by The Geostrata

CULTIVATING TALENT THROUGH CAPTURE-THE-FLAG COMPETITIONS

At the heart of China’s cyber talent pipeline are capture-the-flag (CTF) contests, which serve as key training grounds for young hackers. Started in earnest following a vision set out by Xi Jinping in 2014 to make China a “cyber powerhouse,” the competitions are meant to do two things: recruit the best hackers and turn them into state assets.

Events organised by the Ministry of Public Security, the Ministry of State Security, and the People’s Liberation Army (PLA) range in scale from grassroots jeopardy challenges to full-blown attack-defence war games. Among the best known of these are the Wangding Cup and the XCTF League, which draw tens of thousands of participants each year.

China has established a talent pipeline by merging tens of universities, corporations, and government agencies. Winners are offered direct access to the national cybersecurity database, secretive training programs, and secure paid employment at intelligence agencies.

In 2023, a white paper required 63 percent of the universities to acknowledge hacking challenges as fundamental training devices, 75 percent awarding monetary benefits and advanced laboratories to the top hackers. This state-sponsored ecosystem will not only polish technical expertise such as reverse engineering, exploit development, and cryptography but ingrain high-order thinking in line with national interests. MILITARY INTEGRATION: UNIT 61398 AND BEYOND It is usually this transition to cyber espionage that brings this organisation in Beijing to the infamous - PLA Unit 61398. APT1, also known as Comment Panda, had been operational since at least 2006 and targeted over 140 organisations in 20 industries, stealing hundreds of terabytes of intellectual property and sensitive data, as first identified by U.S. firm Mandiant in 2013.

Based in Pudong in Shanghai, this unit demonstrates the direct connection between the military hierarchy in China and the hacking core: hundreds, perhaps thousands, of engineers and linguists work under the auspices of the Third Department of the PLA.

In 2014, the United States Department of Justice indicted five officers of Unit 61398, who were charged with cybercrimes; this was the first official state diplomatic confrontation over state-sponsored (cyber) espionage.

Nonetheless, PLA cyber brigades have continued to multiply and evolve into finer sub-sections dealing in election interference, sabotage of vital infrastructure, and intellectual property crimes. LEGAL MANDATES: TURNING VULNERABILITIES INTO ARSENAL

China adopted the Regulation on the Management of Software Vulnerabilities in 2021, one of the most severe vulnerability-disclosure laws globally. Any organisation that carries on business in China is required under this mandate to report any new software vulnerability to the Ministry of Industry and Information Technology within 48 hours. Presented as a method of preventing unsanctioned leakage, its effects are such that zero- and high-impact vulnerabilities are under state centralisation.

This is very different from U.S. practice: the vendors of products are invited to report research findings but are not bound to do so, and agencies such as the National Security Agency retain some vulnerabilities on national security grounds. Within the legal framework of China, however, a mechanism of instant government access is practically in place, thereby transforming civilian research into offensive weaponry, likely going to the national police and intelligence services of China, usable in the context of surveillance and targeted activities.

PRIVATE SECTOR PARTNERS: HACKERS FOR HIRE

Beyond government agencies, Beijing has also relied on traditional security firms to strengthen its cyber operations. Six years of internal documents from I-Soon, a Chinese cybersecurity contractor working with state-linked clients, were leaked. They revealed eight years of operations providing hacking services to regional and local governments, telecommunications companies, and even local police departments.

The services varied in cost, with on the low end a handful of penetration testing services for less than $10,000, and on the high end, other services ranging up to thousands of dollars in account takeovers and disinformation.

Among its clients were the Ministry of State Security, local branches of the Ministry of Public Security, and law enforcement units of several cities, rivalling the range of local police outsourcing to non-state actors.

The cooperation between clandestine partnerships obscures the line between government and industry, allowing the Chinese Communist Party to keep a hand on emerging entrepreneurial ingenuity without containing accountability. They are also indicative of a wider tendency in which market-based incentive schemes have been developed to intensify state surveillance and foreign cyber activity.

THE NATIONAL CYBERSECURITY TALENT AND INNOVATION BASE

An outward measure of that ambition is in Wuhan, where the huge National Cybersecurity Centre (NCC) looms over the city. The NCC covers an area of 40 sq.km and includes seven research centres, two government laboratories, and a National Cybersecurity School that represents a whole-of-society strategy of talent development. Direct control of the Cyberspace Affairs Commission has guaranteed that its curriculum, research priorities, and internship placements reflect CCP priorities serving both civilian defence industries and offensive cyber forces.

With an estimated 1.4 million cybersecurity professionals missing in the country, the NCCs are set to bridge that divide, producing a new workforce well-versed in AI-augmented intrusion software, advanced threat hunting, and e-warfare.

INTEGRATING AI/ML WITH CYBER OPERATIONS

Anticipating the future of digital military contests, China is bringing artificial intelligence and machine-learning coursework into its cyber education far more than the United States.

Eight out of the eleven WCCS institutions in China also require AI/ML courses, which gives their graduates the knowledge necessary to design automated exploit search, predictive intrusion detection, and adaptive defensive architecture systems.

The combination of AI and cyber knowledge shortens the cycle in which Beijing can ramp up activities e.g., semi-autonomous botnets, real-time vulnerability scans, and social engineering via large-language models. In the possession of state actors, these capabilities would reach the point of shifting the balance of cyber deterrence and provide additional opportunities in influence operations.

INTERNATIONAL ENGAGEMENT AND SOFT POWER

Ironically, the hacking competitions are used by China as a diplomatic tool too. Competitions such as RealWorldCTF and GeekCon attract overseas participants, spurring scientific expertise, not to mention quietly building Beijing’s cyber street cred around the world. Through sponsoring international leagues, the organisers in China build goodwill among international hackers, who would in turn join Chinese teams or cooperate with Chinese companies, extending the scope of the Chinese cyber ecosystem.

IMPLICATIONS AND FUTURE TRAJECTORIES

The unified Chinese strategy from university classrooms to clandestine labs has resulted in an adaptive, state-sponsored hacking force of unprecedented proportions. The United States and its partners are already struggling with a shortage of talent and disclosure fractures; the cohesive pipeline that Beijing is developing has a decisive advantage.

Magnified China has enhanced its cyber capabilities by deploying a mix of speedy exploitation of vulnerabilities and agility. Reporting structures are such that newly discovered zero-day exploits can be passed on to intelligence agencies within 48 hours or less.

Combined law-enforcement and state security services networks are working with the local and state governments, publicly and privately, through a variety of agreements that enable such operations by subcontracting custom hacking campaigns to the law-enforcement agencies and the state security services, thereby enhancing the speed and effectiveness of operations.

Innovation in AI and global interactions enhances the Chinese cyberspace advantage in a natural way. An increasingly sophisticated group of professionals with overlapping knowledge of machine learning and cyber operations drives the evolution of autonomous threats. At the same time, international competitions organised in China strengthen its soft cyber power and create opportunities to identify and retain foreign talent, reinforcing the country’s position in the international cyber sphere.

Democracies need to rethink cyber talent strategies: harmonising vulnerability disclosure policies, developing AI-enhanced cybersecurity curricula, and enacting synergies between the public and private sectors without undermining transparency. Only an equal commitment of investment on a holistic level can the free world hope to sustain credible cyber deterrence.

China has not only recruited hackers to use as military and intelligence assets, it has created an engine: competitive, educational, legal, and industrial systems integrating into one unique device of digital might. This cyber monster is threatening traditional understandings of warfare by requiring equally unconventional solutions in policy, technological application, and international cooperation.

---

BY POSHIKA MUKKU

TEAM GEOSTRATA

info@thegeostrata.com