A newly released report by cybersecurity firm CrowdStrike paints a stark picture of the escalating cyber espionage battle surrounding artificial intelligence. The 2026 Technology Threat Landscape Report, published on June 9, reveals that China-nexus adversaries are aggressively targeting technology organizations to steal AI capabilities and intellectual property that they cannot develop quickly enough through domestic programs alone.
The report identifies the technology sector as the most targeted industry globally, with China-linked groups driving more than 58% of all state-sponsored targeted intrusions against it. The findings add a new dimension to the US-China AI competition, suggesting that cyber espionage has become a systematic tool for closing the innovation gap, not just in military technology but in commercial AI development.
Industrial Policy Executed Through Cyber Operations
CrowdStrike’s Counter Adversary Operations team, which tracks over 280 named threat actors, identified several specific China-nexus groups as the primary drivers of technology sector intrusions. These include MURKY PANDA, MUSTANG PANDA, OVERCAST PANDA, SUNRISE PANDA, and WARP PANDA, a collection of sophisticated, persistent threat actors with distinct targeting profiles and operational methods.
“China runs cyberespionage as industrial policy to try to close the AI innovation gap, demonstrating that AI capabilities are the prize adversaries are after,” stated Adam Meyers, head of counter-adversary operations at CrowdStrike. This framing is significant: it positions Chinese cyber operations not as opportunistic hacking but as a deliberate, coordinated extension of national industrial strategy, designed to accelerate technological development by acquiring what cannot be built quickly enough through legitimate means.
The assessment reflects a pattern that CrowdStrike and other cybersecurity firms have been documenting for years, but the 2026 report suggests that the intensity and focus of these operations have increased as AI has become more central to both commercial competition and national security. The Pentagon’s decision to add Alibaba, Baidu, and BYD to its military company list reflects the same underlying logic: Washington increasingly views China’s entire technology stack as strategically contested.
Scale and Sophistication of the Attacks
The scale of these operations is significant. The report details a specific password-spraying campaign conducted by MURKY PANDA that alone impacted more than 340 US-based entities. Password spraying, the practice of trying a small number of commonly used passwords against a large number of accounts, is a relatively low-sophistication technique, but its effectiveness at scale makes it a persistent threat even for organizations with strong security practices.
More sophisticated operations involve spear-phishing campaigns targeting specific individuals with access to valuable AI research, supply chain compromises that insert malicious code into widely used software libraries, and long-term persistent access operations designed to quietly exfiltrate data over extended periods without triggering security alerts.
The focus on the technology sector is a direct result of where the most valuable AI assets are concentrated. As Meyers noted, “Technology organizations are building the most valuable and most targeted assets in the world. Every AI breakthrough creates a competitive advantage and new attack surface at the same time.” This observation captures a fundamental tension in the AI era: the same openness and connectivity that accelerates innovation also creates vulnerabilities that adversaries can exploit.
North Korea’s AI-Enhanced Infiltration Tactics
While China-nexus groups dominate state-sponsored espionage in the technology sector, the report also highlights a distinct and growing threat from North Korea. DPRK-nexus adversaries, particularly the group tracked as FAMOUS CHOLLIMA, are utilizing AI-enhanced personas to secure remote IT roles within technology firms. These operatives create convincing fake identities, complete with AI-generated profile photos, fabricated work histories, and polished communication skills, to pass hiring processes and gain legitimate access to company systems.
According to the report, DPRK-nexus actors accounted for 47% of state-sponsored interactive intrusions in the technology sector. This threat has been amplified by China’s AI chip smuggling crackdown, which has pushed some actors toward cyber means of acquiring capabilities they can no longer obtain through hardware channels. The revenue generated from these operations, through salary payments and the theft of cryptocurrency and intellectual property, funds the North Korean regime’s weapons programs. The use of AI to enhance the credibility of fake personas represents a significant evolution in this threat, making traditional identity verification processes less reliable.
eCrime Actors Weaponize AI at Scale
Beyond state-sponsored threats, the report documents a sharp increase in the use of AI by financially motivated cybercriminal groups. These actors are using AI-generated scripts to automate credential dumping, erase forensic evidence at unprecedented speeds, and craft more convincing phishing messages tailored to specific targets. The democratization of AI tools has lowered the technical barrier for conducting sophisticated attacks, expanding the pool of capable threat actors.
Implications for AI Security Strategy
The CrowdStrike report has direct implications for how technology companies and governments should think about AI security. The concentration of AI capabilities in a relatively small number of companies and research institutions creates high-value targets that attract the most sophisticated adversaries. Protecting these assets requires not just strong perimeter security but also comprehensive insider threat programs, supply chain security, and continuous monitoring to detect subtle, long-term intrusions.
For the broader US-China AI competition, the report suggests the race is being fought on multiple fronts simultaneously, not just in research labs and chip factories, but also in the digital infrastructure that connects them.