China Hackers: New Espionage Actor Identified by CrowdStrike

WASHINGTON,December 5,2025 17:52:00

China-linked Hacking Group ‘WARP PANDA‘ targets Networks

A newly identified espionage actor,linked to China,has been quietly infiltrating computer systems since late 2023,according to security researchers.

• CrowdStrike researchers identified a China-nexus espionage actor dubbed ‘WARP PANDA.’
• The group began initial network intrusions as early as late 2023.
• WARP PANDA has expanded its operations over time, targeting an unknown number of victims.

Cybersecurity firm CrowdStrike has uncovered a sophisticated hacking operation attributed to a China-linked actor, which thay’ve named WARP PANDA. The group initially infiltrated victim networks as early as late 2023, and has as broadened its reach. This discovery highlights the persistent and evolving threat landscape posed by state-sponsored cyber espionage.

Early Infiltration and Expanding Operations

The investigation revealed that WARP PANDA’s activities began with initial compromises in late 2023. The group’s tactics, techniques, and procedures (ttps) suggest a focus on long-term intelligence gathering. Researchers noted the actor’s ability to maintain access and expand operations over time, indicating a well-resourced and resolute effort.

Did you know? China-nexus actors often operate with a long-term strategic view, prioritizing sustained access over immediate data exfiltration. This allows for prolonged intelligence gathering.

What is a China-nexus actor? These are threat groups believed to be affiliated with, or operating with the support of the Chinese government, often engaged in espionage activities.

While the specific targets and objectives of WARP PANDA remain under investigation, the group’s behavior aligns with typical espionage motivations, such as stealing intellectual property or gathering sensitive information. The discovery underscores the need for organizations to remain vigilant and implement robust cybersecurity measures to protect against advanced persistent threats.

Understanding the Threat

The emergence of WARP PANDA adds another layer to the complex web of cyber espionage activities originating from China. Security experts have long warned about the increasing sophistication and frequency of these attacks, which pose a meaningful risk to businesses, governments, and critical infrastructure.

What makes WARP PANDA unique? The group’s early infiltration timeline and subsequent expansion of operations suggest a deliberate and methodical approach to espionage, setting it apart from some other actors.

Pro tip Regularly update software and operating systems. Patching known vulnerabilities is a crucial step in preventing initial network compromises by groups like WARP PANDA.

Why is WARP PANDA significant? CrowdStrike researchers believe the group’s methodical approach and early start date-late 2023-indicate a deliberate, long-term espionage campaign. Who is behind WARP PANDA? While direct attribution is tough, CrowdStrike assesses with moderate confidence that WARP PANDA is a China-nexus actor, likely operating with the support of the Chinese government. What are their objectives? The group’s TTPs suggest a focus on intelligence gathering,potentially targeting intellectual property,trade secrets,or sensitive government information. How did it end? As of December 5, 2025, the operation is ongoing. CrowdStrike is actively tracking WARP PANDA’s activities and working with affected organizations to mitigate the threat. No public reports indicate the group has been disrupted or neutralized.