New Zealand Names China Its Most Persistent and Capable State-Backed Cyber Threat
Updated: 52 minutes ago
Wellington, 24 September 2026
New Zealand's National Cyber Security Centre, or NCSC, published its annual assessment on Thursday and described China as the most persistent and capable state actor conducting cyber activity in the country. It said suspected foreign-state operations had targeted New Zealand government agencies, health and education organisations and information-technology managed-service providers during the past year, placing sensitive information at risk. NCSC annual report; Reuters
The NCSC linked suspected state-sponsored activity to actors from China, Russia, Iran and North Korea. It did not disclose how many incidents were assigned to each country or identify every affected organisation. Its characterisation of China is therefore an intelligence and cyber-security assessment by a New Zealand agency, not a public court's finding on liability for a particular intrusion. NCSC annual report
No direct public response by the Chinese government to the new report had been located by the time this article was completed. When the separate New Zealand Security Intelligence Service, or NZSIS, issued a broader assessment in August, China's embassy said claims of Chinese interference and threat were fabricated, portrayed ordinary exchanges as espionage or interference and risked damaging bilateral trust. That statement records Beijing's recent position on New Zealand intelligence allegations; it is not a point-by-point answer to Thursday's cyber report. Chinese Embassy in New Zealand; Reuters, 14 August
Eighty-six suspected state-linked cases do not mean eighty-six Chinese cases
The NCSC received 4,673 cyber-security reports between 1 July 2025 and 30 June 2026. It classified 369 as incidents of potential national significance. Of those, 86 indicated links to suspected state-sponsored actors, up from 82 the previous year; 162 indicated links to criminal or financially motivated actors, while 121 could not be attributed. NCSC annual report
Those figures require several distinctions. The 86 cases cover every suspected state source, and the report does not say that all came from China. It does not say that every operation successfully extracted information. Nor is a suspected link equivalent to responsibility established in criminal proceedings. Public administration, health and education were among the sectors most affected by potentially high-impact incidents, but that does not mean Beijing directed every intrusion into those sectors. NCSC key judgements; NCSC annual report
The report also recorded four highly significant incidents involving the exfiltration of personal information from health-service organisations, but expressly attributed those attacks to financially motivated cybercriminals. The four most severe incidents should consequently not be cited as evidence of Chinese activity. NCSC annual report
Persistence, proxies and digital supply chains
The report said state actors do not necessarily launch operations directly from official networks. They may buy or receive credentials stolen by criminal groups and may use criminal networks as proxies, obscuring state links and reducing the prospect of diplomatic retaliation or sanctions. Some actors also conduct long-term reconnaissance and pre-position access inside critical infrastructure, creating greater capacity for disruption or coercion if political conditions deteriorate. NCSC annual report
Information-technology managed-service providers are important because one supplier may administer the accounts, software and data interfaces of many customers. Penetrating that intermediary can allow an attacker to bypass an individual client's defences and reach several organisations. This helps explain why the report treats digital supply chains, alongside government, health and education bodies themselves, as a public-interest risk. NCSC annual report
Proxies, hijacked devices and third-party services make attribution more complex than identifying the country in which malicious traffic appears. The new report should be understood as the NCSC's analytical judgement after combining domestic investigations, information from overseas partners and patterns of behaviour. Because some underlying evidence remains classified, the public can check the published statistics and named examples but cannot independently reproduce the judgement in full.
From home routers to telecommunications networks
The NCSC used two international warnings to illustrate its assessment of China-linked actors. In April 2026, New Zealand and nine other countries warned of China-affiliated groups using compromised devices such as home routers at scale to create covert networks that conceal malicious activity. The report named Volt Typhoon and Flax Typhoon as groups that had used such networks against infrastructure. NCSC annual report; Reuters, 23 April
The second example was the multinational attribution of Salt Typhoon in August 2025. The NCSC said the Chinese state-sponsored group exploited known vulnerabilities to target telecommunications, transport and government networks around the world, harvesting data, telephone calls, credentials and network information. It said Salt Typhoon activity had been observed in New Zealand. An official NCSC alert issued at the time said information stolen from telecommunications and internet providers could ultimately enable Chinese intelligence services to identify and track targets' communications and movements. NCSC annual report; NCSC 2025 joint alert
These claims represent attributions by New Zealand and its intelligence partners, rather than findings by an independent forensic tribunal or court. Public material does not identify the New Zealand entities affected by Salt Typhoon. Nor does it establish that a named dissident, journalist or diaspora member was personally monitored through that operation in New Zealand. The capability created by the theft of communications data is a verifiable risk; whether it has been used in a particular case cannot be determined from the public record.
Public interest, suppression of dissent and Pacific risk
The NCSC said the objectives of state-sponsored cyber activity may include diplomatic or military advantage, economic interests or the suppression of dissent. It assessed espionage as the primary purpose of state activity observed in New Zealand; internationally, it said states had also used cyber tools for intimidation, intellectual-property theft, disruption of critical services and, in some cases, sabotage. Because the sectors named in the report include government, health, education and technology services, the risks extend beyond competition between intelligence agencies to patient and student records, the continuity of public services and individual privacy. NCSC annual report
In the South Pacific, the NCSC said it was aware of state-sponsored cyberespionage against governments and infrastructure, with possible consequences for citizens, businesses and civic institutions. That passage did not identify a responsible country. It would be unsafe to assign every Pacific case to China merely because the report described China as the leading state actor inside New Zealand. NCSC annual report
A separate NZSIS assessment issued in August described China as the most active state conducting foreign interference in New Zealand. It also said several foreign governments and their proxies restricted the democratic rights of diaspora communities through surveillance, harassment of relatives overseas, refusal of consular services and threats of blacklisting. The assessment did not attribute every transnational-repression example to China or say that the 86 cyber incidents counted by the NCSC were used for transnational repression. NZSIS Security Threat Environment 2026
The 2021 parliamentary compromise
New Zealand publicly attributed a more specific China-linked case in 2024. The Government Communications Security Bureau said networks belonging to the Parliamentary Service and the Parliamentary Counsel Office, which drafts legislation, were compromised in 2021. Its investigation linked the intrusion to APT40, a group associated with China's Ministry of State Security. Officials said the operation had been contained and that there had not been large-scale extraction of data from the systems. Associated Press; The Guardian
China rejected New Zealand's attribution at the time, said the allegation lacked a factual basis and made a formal diplomatic protest. Beijing has long said that it opposes cyberattacks in all forms and is itself a major victim. Those denials form part of the dispute. New Zealand said its conclusion followed technical investigation and comparison of intelligence with international partners. Associated Press; Reuters, 26 March 2024
The New Zealand NCSC’s assessment
The NCSC itself said it did not have a perfect understanding of New Zealand's cyber-security environment. Its statistics and case studies were drawn mainly from work handled during the latest financial year and should be considered illustrative, not a complete overview. Victims may not report, may report directly to banks or police, or may remain unaware that they have been compromised. Each possibility affects the dataset. NCSC annual report
Sources
Comments