Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix)

Key facts for Chinese nation-state activity trend

Detection coverage for Chinese nation-state activity trend

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5319 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: IIS Worker Process Spawning Shell or Recon Utility (Web Shell Execution)

Detects w3wp.exe spawning cmd.exe, PowerShell or reconnaissance binaries. This is the execution signature of web shells such as China Chopper and INMemory that Weaver Ant (China-nexus, referenced in the Trellix report tracked as TL-2026-5319) planted on externally facing IIS servers in telecom and transport/shipping environments. Maps to T1190, T1505.003 and T1059.001.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003, T1059.001
• Data sources: sysmon, sysmon:EventCode=1, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe" OR Image="*\\certutil.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\mshta.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\ipconfig.exe" OR Image="*\\systeminfo.exe" OR Image="*\\tasklist.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as command_lines values(ParentCommandLine) as iis_worker_cmdline by host User ParentImage
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%S")

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "certutil.exe", "cscript.exe", "wscript.exe", "mshta.exe", "bitsadmin.exe", "ipconfig.exe", "systeminfo.exe", "tasklist.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma

title: IIS Worker Process Spawning Shell or Recon Utility - Web Shell Execution
id: 5b0e3c1a-7d42-4f6b-9a18-2c4e8d7f1a01
status: experimental
description: Detects w3wp.exe spawning a command interpreter or reconnaissance utility, the typical execution pattern of web shells such as China Chopper and INMemory documented for Weaver Ant (TL-2026-5319).
references:
  - https://securityaffairs.com/175800/uncategorized/chinese-apt-weaver-ant-infiltrated-a-telco-for-over-four-years.html
  - https://www.trellix.com/blogs/research/the-speed-of-cyber-threats-is-changing-are-we-keeping-up/
  - https://attack.mitre.org/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.001
  - attack.s0020
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\certutil.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
      - '\ipconfig.exe'
      - '\systeminfo.exe'
      - '\tasklist.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate IIS applications that shell out to cmd.exe or PowerShell for scheduled maintenance
  - Vulnerability scanners exercising the web application
level: high

Known false positives:

• Legitimate IIS applications that shell out to cmd.exe or PowerShell for maintenance tasks
• Vulnerability scanners or pen-test activity against the web application

Tuning notes: Baseline known child processes per application pool for 14 days and exclude exact ParentCommandLine plus CommandLine pairs. Raise priority when the child runs as the app-pool identity and the host is internet-facing. Restrict to hosts tagged as IIS servers.

• 🔒 Web Shell Script File Written to IIS Web Root · unlock with TL Creds
• 🔒 AMSI and ETW Patching Indicators in PowerShell Telemetry · unlock with TL Creds
• 🔒 IIS Worker Process Proxying to Internal Hosts (Recursive HTTP Tunnel) · unlock with TL Creds
• 🔒 IIS Child Process with Base64/GZip Decode or Obfuscation Arguments · unlock with TL Creds
• 🔒 IIS Configuration File Credential Harvesting · unlock with TL Creds
• 🔒 SharpView / PowerView AD Reconnaissance Execution · unlock with TL Creds
• 🔒 PowerShell Engine Loaded Without powershell.exe ([indicator]) · unlock with TL Creds
• 🔒 Pass-the-Hash NTLM Logon Followed by Admin Share Access (SMB Lateral Movement) · unlock with TL Creds

Indicators of compromise for Chinese nation-state activity trend

As of 2026-11-05, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5319.

How Chinese nation-state activity trend works

Trellix's report 'The Speed of Cyber Threats is Changing, Are We Keeping Up?' (published 2026-11-04, covered by Infosecurity Magazine on 2026-11-05) analyses nation-state detections between April and September 2026. Chinese nation-state activity fell 41.4% over the period but remained substantially higher than Russian and Iranian activity. Trellix cautions that the decline may reflect changes in targeting, infrastructure or detection visibility rather than a reduction in activity.

Geographically, the United States accounted for 38% of nation-state detections and Turkey for 37.1%, with Germany at 4.4%. Transportation/shipping and telecommunications together made up over half of campaign volume. The ten most active groups produced 56% of all detections. Gamaredon (Russia-aligned) led with 9.03%, followed by APT36 (Pakistan-linked) at 7.84% and Mustang Panda (China-nexus) at 7.52%. Weaver Ant (Chinese-nexus) was also named. By payload class, backdoors accounted for 20.9% of detections and infostealers for 11.87%.

The source is a trend/statistics report and states no CVEs, IOCs, malware family names or campaign-specific TTPs. The ATT&CK mapping here is therefore limited to TTPs publicly documented for Weaver Ant (Sygnia forensic investigation, March 2025, via Security Affairs): China Chopper and INMemory web shells on externally facing servers, a recursive HTTP tunnel, ETW and AMSI patching, PowerShell execution via System.Management.Automation.dll, SMB/NTLM-hash lateral movement, credential extraction from IIS configuration files and SharpView-based Active Directory reconnaissance against an Asian telecom provider. Treat this record as strategic context for sector and geography prioritisation, not as an actionable campaign.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1550.002 Pass the Hash

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.001 PowerShell

Command and Control

T1071.001 Web Protocols; T1090 Proxy

Discovery

T1087.002 Domain Account

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Credential Access

T1552.001 Credentials In Files

defense-impairment

T1685 Disable or Modify Tools

Remediation for Chinese nation-state activity trend

Immediate actions

• Hunt for web shells on externally facing IIS/PHP servers, especially in telecommunications and transportation/shipping environments
• Review web server logs for anomalous POST requests and recursive HTTP proxying between internal web servers
• Alert on tampering with amsi.dll and ETW providers, and on PowerShell loaded via System.Management.Automation.dll without powershell.exe

Workarounds

• Remove plaintext credentials from IIS configuration files and rotate any exposed secrets
• Enforce NTLM restrictions to limit pass-the-hash

Longer-term hardening

• Deploy EDR with behavioral detection for in-memory PE loading and web-shell activity
• Segment externally facing servers from internal AD infrastructure and restrict SMB lateral movement
• Do not treat a decline in detections as reduced risk; validate telemetry coverage and detection visibility

Affected and fixed versions

• Various — Organizations in transportation/shipping and telecommunications sectors (US, Turkey, Germany)

Timeline of Chinese nation-state activity trend

• 2023-06-21 locked-ioc-9 publishes earlier report finding China-affiliated APT groups behind most nation-state threat activity
• 2024-06-11 locked-ioc-9 reports a spike in cyber activity from China and Russia, with Chinese groups the most prolific source of APT detections
• 2024-11-20 locked-ioc-9 November 2024 report notes locked-ioc-2 generating more than 12% of detected APT activity
• 2025-03-24 Sygnia forensic report (covered by Security Affairs) discloses locked-ioc-4's four-year intrusion into an Asian telecom provider using web shells and HTTP tunneling
• 2026-04-01 Start of locked-ioc-9's April-September 2026 nation-state detection window
• 2026-09-30 End of the observation window; Chinese nation-state activity down 41.4% since April
• 2026-11-04 locked-ioc-9 publishes 'The Speed of Cyber Threats is Changing, Are We Keeping Up?'
• 2026-11-05 Infosecurity Magazine reports the findings, noting the decline may reflect changes in targeting, infrastructure or detection visibility

Sources cited for Chinese nation-state activity trend

• Trellix: The Speed of Cyber Threats is Changing, Are We Keeping Up? trellix.com · Vendor report · 2026-11-04
• Trellix Uncovers Spike in Cyber Activity from China and Russia trellix.com · Vendor report · 2024-06-11
• Trellix Uncovers Diversification of Ransomware Ecosystem as Cybercriminal Use of AI Expands trellix.com · Vendor report · 2024-11-20
• Trellix Detects China-Affiliated APT Groups Behind Most Nation-State Threat Activity trellix.com · Vendor report · 2023-06-21
• Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026 (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-11-05
• Chinese APT Weaver Ant infiltrated a telco for over four years (Security Affairs) securityaffairs.com · News · 2025-03-24

More in apt

• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods
• APT29 Watering-Hole Campaign Against Mongolian Government Sites Using iOS WebKit and Chrome Android Exploits (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671)
• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
• Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)
• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors