A new CrowdStrike threat landscape report covering April 2025 through March 2026 reveals that China-linked threat actors are responsible for 58% of all state-sponsored cyberattacks targeting U.S. technology firms, with the primary objective of stealing artificial intelligence capabilities and intellectual property. The technology sector is now the most targeted industry globally by both state-sponsored and criminal organizations.
CrowdStrike identified several active Chinese threat groups — tracked under panda-themed names including MURKY PANDA, MUSTANG PANDA, OVERCAST PANDA, SUNRISE PANDA, and WARP PANDA — conducting aggressive espionage campaigns against U.S. tech companies. MURKY PANDA alone compromised over 340 U.S.-based entities through password-spraying attacks. The report also documents an 89% increase in attacks using AI-powered techniques during the reporting period.
Beyond Chinese operations, the report highlights North Korean actors actively infiltrating IT workforces across North America, Europe, and Asia to generate revenue for the regime. CrowdStrike notes that the surge in espionage aligns with China’s strategic goal of achieving AI self-sufficiency and dominance by 2030, particularly as U.S. chip export controls restrict access to advanced AI training hardware. The Chinese government dismissed the findings as “political slander.”
Source
From CrowdStrike’s 2026 Technology Threat Landscape Report. Additional coverage from Benzinga and Crypto Briefing.
Commentary
Fifty-eight percent is a staggering concentration of activity from a single nation-state actor. What makes this report particularly alarming is the convergence of two trends: China’s systematic targeting of AI intellectual property and the 89% surge in AI-powered attack techniques. We’re entering a feedback loop where stolen AI technology is being used to build better tools for stealing more AI technology. The 340 organizations compromised by MURKY PANDA alone suggests this isn’t targeted espionage — it’s industrial-scale harvesting. For any company working on AI, LLMs, or advanced semiconductors, the threat model should assume persistent Chinese state-sponsored intrusion attempts as a baseline. The North Korean IT workforce infiltration adds another dimension — these are supply chain attacks on the labor market itself.