CrowdStrike: China-nexus actors drove 58% of state-sponsored intrusions against tech sector

CrowdStrike published its 2026 Technology Threat Landscape Report on June 9, finding China-nexus adversaries drove 58% of state-sponsored targeted intrusions against the technology sector — now the most-targeted industry globally — over the report's April 1, 2025 to March 31, 2026 window, with campaigns focused on stealing AI capabilities and intellectual property. Adam Meyers, CrowdStrike's head of counter adversary operations, said 'China runs cyber espionage as industrial policy to close the AI innovation gap,' telling Reuters that 'there is an AI arms race occurring between the U.S. and China, and China intends to achieve global dominance by 2030.' Key findings include: MURKY PANDA password-spraying affecting more than 340 U.S.-based entities; North Korea's FAMOUS CHOLLIMA accounting for 47% of state-sponsored interactive intrusions, largely via fraudulent IT-worker schemes funneling salaries to Pyongyang; STARDUST CHOLLIMA's compromise of the Axios npm package, downloaded roughly 100 million times per week; initial access brokers advertising access to 277 technology organizations, a nearly 30% increase; and 572 technology entities named on ransomware leak sites for extortion.

Financially motivated attacks comprised 65% of all interactive operations, and 350 GitHub repositories were compromised before the Glassworm botnet disruption. Reuters carried the findings on June 10.