China’s Hackers Are Following the Money and the Oil

A new ESET report covering October 2025 to March 2026 shows that China-aligned hacking groups are not choosing their targets randomly. Every intrusion links directly to something Beijing needs: oil supply visibility, reconstruction contracts, AI technology, or maritime intelligence.

When a Chinese hacking group broke into a Venezuelan government agency in January 2026, it was not a random attack. A U.S. military operation in the region had just created uncertainty around Venezuelan oil exports, and China buys roughly half of all Venezuelan crude oil. The timing tells the whole story. This is how China-aligned cyber operations work: the hacking follows the geopolitics, and the geopolitics follows the money.

ESET Research released its latest Advanced Persistent Threat (APT) Activity Report on May 28, 2026, covering the six months from October 2025 through March 2026. The report documents specific campaigns carried out by China-aligned hacking groups against targets in the Middle East, Central America, South America, and Asia. Taken together, the cases form a clear picture: Chinese cyber espionage operations are increasingly shaped by Beijing’s economic priorities, energy security concerns, and long-term strategic interests in critical technology.

Syria: Watching a Country That Is About to Be Rebuilt

In February 2026, a China-aligned hacking group called SteppeDriver successfully broke into Syrian government networks. ESET first publicly identified SteppeDriver in December 2024, making this one of the group’s early confirmed operations against a government target.

The reasoning behind the attack is not difficult to work out. Syria’s civil war caused an estimated hundreds of billions of dollars in infrastructure damage. Roads, power grids, telecommunications networks, factories, and housing all need to be rebuilt. Chinese companies have been repeatedly mentioned as likely participants in those reconstruction projects, and Beijing has clear economic incentives to position itself favorably. Getting early visibility into Syria’s government systems, its political direction, and the state of its infrastructure would give Chinese businesses and policymakers a significant advantage when bidding for contracts and structuring investment deals.

There is also a security angle. During the Syrian conflict, thousands of foreign fighters traveled to the country, including members of the Turkistan Islamic Party (TIP), a militant group composed primarily of Uyghur fighters. Chinese authorities have long viewed this organization as a serious threat, concerned that its members could return to China or fuel separatist sentiment in Xinjiang. Access to Syrian government records could provide intelligence on the whereabouts and activities of individuals considered threats to Chinese national security.

SteppeDriver’s intrusion into Syrian government networks in February 2026 reflects both economic opportunity and national security concerns. Syria represents one of the largest potential reconstruction projects in the world, and China has significant interests in both its political direction and its militant landscape.

Venezuela: Protecting the Oil Supply Line

The Venezuela operation is perhaps the most directly traceable case of cyber espionage following geopolitical events in real time. In January 2026, the China-aligned group FamousSparrow targeted a Venezuelan government agency responsible for maritime affairs. ESET assesses this intrusion was aimed at monitoring the resilience of Venezuelan oil shipments after a U.S. military operation in the region created significant uncertainty around the country’s export capabilities.

The importance of Venezuela to China’s energy supply chain cannot be overstated. China purchases approximately half of all Venezuelan crude oil exports. Any disruption to those shipments creates immediate problems for Chinese refineries and energy planners. Getting early intelligence on whether Venezuelan shipping operations would hold up, what routes were being used, and what logistical problems were emerging would give Beijing a significant advantage in planning its energy procurement strategy.

This kind of operation fits a well-established pattern. Chinese state-sponsored groups have previously targeted shipping companies, port authorities, logistics providers, and maritime regulators all over the world. The targets have included Southeast Asian port operators, companies involved in South China Sea trade routes, and government agencies overseeing maritime operations. The Venezuela case is simply the most recent and clearly documented example of a strategy that has been running for years.

Cambodia and Panama: Strategic Partners and Chokepoints

During the same reporting period, UNC5221, a China-aligned threat group known for targeting internet-facing infrastructure and supply-chain vulnerabilities, conducted operations against government organizations in both Cambodia and Panama.

Cambodia is one of China’s closest partners in the region, receiving substantial investment through the Belt and Road Initiative. Intelligence collected from Cambodian government systems would give Beijing visibility into how its infrastructure investments are progressing, how regional diplomatic relationships are developing, and what political decisions are being made that might affect Chinese projects in the country.

Panama is a different kind of target. The Panama Canal is one of the most important shipping routes in the world, connecting the Atlantic and Pacific oceans and handling a significant portion of global maritime trade. Access to Panamanian government networks connected to transportation and infrastructure would provide intelligence on shipping flows, cargo movements, and any regulatory or political developments that could affect global commerce. For a country as dependent on international trade as China, that kind of intelligence has obvious strategic value.

South Korea: Stealing the Technology China Wants to Build Itself

The third UNC5221 operation documented in this report was the intrusion into an AI and robotics company in South Korea. This case is significant because it reflects a different kind of strategic objective: not political intelligence or energy supply monitoring, but direct technology acquisition.

Artificial intelligence and robotics are explicitly listed as priority sectors in China’s “Made in China 2025” industrial policy, a government program designed to reduce China’s dependence on foreign technology and build domestic capabilities in advanced manufacturing. ESET assesses the South Korean intrusion sought intellectual property, meaning the goal was to obtain research data, engineering designs, proprietary software, or product development plans that could accelerate Chinese work in these fields.

This is consistent with years of documented Chinese cyber espionage targeting high-technology companies. Historical campaigns attributed to Chinese groups have focused on semiconductor manufacturers, aerospace companies, defense contractors, renewable energy firms, and telecommunications providers across North America, Europe, and Asia. Groups including APT10, APT41, Mustang Panda, and Hafnium have all been linked to technology-acquisition operations of this type. The South Korea case is the latest chapter in the same long-running effort to acquire strategic technical intelligence through cyber means rather than through legitimate research or commercial licensing.

The Bigger Picture: Cyber Operations as a Foreign Policy Tool

What ties all of these cases together is the connection between the hacking and Beijing’s broader strategic interests. China-aligned groups accounted for the largest portion of all recorded attack sources in ESET’s reporting period. That dominance is not random. It reflects a deliberate and systematic approach in which cyber operations serve as an intelligence collection mechanism that directly supports foreign policy, economic planning, and national security goals.

Jean-Ian Boutin, Director of Threat Research at ESET, described the Asian campaigns as focused primarily on governmental organizations, strategic industries, and advanced technology sectors. The Middle East cases add maritime and energy infrastructure to that list. Taken together, the targets map almost perfectly onto China’s published priorities: energy security, the Belt and Road Initiative, technological self-sufficiency, and Xinjiang-related security concerns.

The speed with which Chinese groups responded to events is also notable. FamousSparrow’s Venezuela operation came shortly after the U.S. military action there. SteppeDriver’s Syria campaign aligns with the opening of a post-conflict reconstruction period. These are not opportunistic attacks exploiting whatever vulnerability happened to be available. They are deliberate intelligence operations timed to gather information when it matters most.

References

This article summarizes and interprets findings from ESET’s published APT Activity Report. All factual claims about specific groups, targets, and dates are drawn from ESET’s research and corroborating coverage from Help Net Security and Infosecurity Magazine. Historical references to APT10, APT41, Mustang Panda, and Hafnium are sourced from prior ESET and industry reporting.