Three Buddy Problem Rethinking APT Attribution: Dakota Cary on Chinese Contractors and Espionage-as-a-Service
5 snips
Aug 1, 2025 Dakota Cary, a China-focused consultant at SentinelOne and a fellow at the Atlantic Council, dives deep into the dark waters of China's cyber ecosystem. He sheds light on APT contractors and their links to espionage-as-a-service. The discussion reveals the intricate ties between hackers and the state security apparatus, complicating attribution efforts. Cary reflects on the need for a cultural shift in U.S. intelligence to tackle these evolving threats while also examining the geopolitical fallout of recent cyber intrusions targeting places like Singapore.
AI Snips
Chapters
Books
Transcript
Episode notes
China's Entrepreneurial Cyber Model
- China's cyber threat actors operate in a complex, entrepreneurial model with private contractors bidding for intelligence tasks.
- This ecosystem blurs lines of attribution as capabilities spread across multiple groups under state direction.
Fluidity in Chinese APT Ecosystem
- Chinese cyber actors frequently shift employment, tools, and targets within a fluid ecosystem.
- This dynamic complicates APT attribution as groups and malware evolve rapidly over time.
Unprecedented MSS Contractor Tasking
- The direct tasking of contractors by China's Shanghai SSB is an unprecedented revelation in indictments.
- MSS operates with entrepreneurial decentralization, lacking centralized control, which shapes diverse intelligence collection methods.
