China-based cyberattacks on US found declining

China-based cyberattacks targeting the US government and private organisations have declined over the past few years, according to a new report by a US cybersecurity firm.

FireEye said it has observed a "notable decline" in Chinese cyberattacks directed toward the US since 2014 in the wake of China's ongoing political and military reforms.

FireEye's report pointed out that China and the US's mutual agreement in 2015 not to "conduct or knowingly support cyber-enabled theft of intellectual property" likely played a central role in China scaling down its focus on the US.

The report said: "Since mid-2014, we have seen a notable decline in China-based groups' overall intrusion activity against entities in the US and 25 other countries. We suspect that this shift in operations reflects the influence of ongoing military reforms, widespread exposure of Chinese cyber operations, and actions taken by the US government."

"Rather than viewing the Xi-Obama agreement as a watershed moment, we conclude that the agreement was one point amongst dramatic changes that had been taking place for years."

According to FireEye, while there has been a noticeable decline in China-based cyberespionage activities, there have still been some attacks aimed at China's neighbouring countries as well as Europe and Japan.

"Despite the decline, China-based threat groups continue to operate. Through late 2015 and 2016, we saw suspected China-based groups compromise corporations' networks in the US, Europe, and Japan, while also targeting government, military, and commercial entities in the countries surrounding China," FireEye said.

The security firm analysed a total of 262 intrusions over a three-year period, of which 182 affected networks of US government and private entities, while 80 others were targeted at networks in countries across the globe, including the UK, Italy, Switzerland, Germany, the Netherlands, Denmark, Sweden, France, Norway, Canada, Japan, India, Taiwan, Hong Kong, China, Korea, Singapore, the Philippines, Brazil, Colombia, Egypt, Israel, Saudi Arabia, Australia and Tunisia.

The firm cautioned that China is not the only one which appears to be changing the course of it cyber activities. "We've observed multiple state-backed and other well-resourced groups develop and hone their operations against corporate and government networks. The landscape we confront today is far more complex and diverse, less dominated by Chinese activity, and increasingly populated by a range of other criminal and state actors," FireEye concluded.