# Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix)

> Trellix reports Chinese nation-state threat activity declined 41.4% from April to September 2026 but stayed substantially higher than Russian and Iranian activity. Over three-quarters of nation-state detections targeted the US (38%) and Turkey (37.1%), with transportation/shipping and telecommunications making up over half of campaign volume.

- **Published:** 2026-11-05T11:51:16Z
- **Last reviewed:** 2026-11-05T11:51:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5319
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5319.png
- **ID:** TL-2026-5319
- **Severity:** MEDIUM
- **Category:** APT
- **Status:** TRACKING
- **Actor:** Gamaredon (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

Trellix's report 'The Speed of Cyber Threats is Changing, Are We Keeping Up?' (published 2026-11-04, covered by Infosecurity Magazine on 2026-11-05) analyses nation-state detections between April and September 2026. Chinese nation-state activity fell 41.4% over the period but remained substantially higher than Russian and Iranian activity. Trellix cautions that the decline may reflect changes in targeting, infrastructure or detection visibility rather than a reduction in activity.

Geographically, the United States accounted for 38% of nation-state detections and Turkey for 37.1%, with Germany at 4.4%. Transportation/shipping and telecommunications together made up over half of campaign volume. The ten most active groups produced 56% of all detections. Gamaredon (Russia-aligned) led with 9.03%, followed by APT36 (Pakistan-linked) at 7.84% and Mustang Panda (China-nexus) at 7.52%. Weaver Ant (Chinese-nexus) was also named. By payload class, backdoors accounted for 20.9% of detections and infostealers for 11.87%.

The source is a trend/statistics report and states no CVEs, IOCs, malware family names or campaign-specific TTPs. The ATT&CK mapping here is therefore limited to TTPs publicly documented for Weaver Ant (Sygnia forensic investigation, March 2025, via Security Affairs): China Chopper and INMemory web shells on externally facing servers, a recursive HTTP tunnel, ETW and AMSI patching, PowerShell execution via System.Management.Automation.dll, SMB/NTLM-hash lateral movement, credential extraction from IIS configuration files and SharpView-based Active Directory reconnaissance against an Asian telecom provider. Treat this record as strategic context for sector and geography prioritisation, not as an actionable campaign.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1059.001 PowerShell
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1552.001 Credentials In Files
- T1087.002 Domain Account
- T1550.002 Pass the Hash
- T1021.002 SMB/Windows Admin Shares
- T1071.001 Web Protocols
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**IIS Worker Process Spawning Shell or Recon Utility (Web Shell Execution)** (`TL-2026-5319-SPL-001`)

Detects w3wp.exe spawning cmd.exe, PowerShell or reconnaissance binaries. This is the execution signature of web shells such as China Chopper and INMemory that Weaver Ant (China-nexus, referenced in the Trellix report tracked as TL-2026-5319) planted on externally facing IIS servers in telecom and transport/shipping environments. Maps to T1190, T1505.003 and T1059.001.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003, T1059.001
- **Data sources:** sysmon, sysmon:EventCode=1, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe" OR Image="*\\certutil.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\mshta.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\ipconfig.exe" OR Image="*\\systeminfo.exe" OR Image="*\\tasklist.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as command_lines values(ParentCommandLine) as iis_worker_cmdline by host User ParentImage
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%S")
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "certutil.exe", "cscript.exe", "wscript.exe", "mshta.exe", "bitsadmin.exe", "ipconfig.exe", "systeminfo.exe", "tasklist.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: IIS Worker Process Spawning Shell or Recon Utility - Web Shell Execution
id: 5b0e3c1a-7d42-4f6b-9a18-2c4e8d7f1a01
status: experimental
description: Detects w3wp.exe spawning a command interpreter or reconnaissance utility, the typical execution pattern of web shells such as China Chopper and INMemory documented for Weaver Ant (TL-2026-5319).
references:
  - https://securityaffairs.com/175800/uncategorized/chinese-apt-weaver-ant-infiltrated-a-telco-for-over-four-years.html
  - https://www.trellix.com/blogs/research/the-speed-of-cyber-threats-is-changing-are-we-keeping-up/
  - https://attack.mitre.org/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.001
  - attack.s0020
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\certutil.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
      - '\ipconfig.exe'
      - '\systeminfo.exe'
      - '\tasklist.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate IIS applications that shell out to cmd.exe or PowerShell for scheduled maintenance
  - Vulnerability scanners exercising the web application
level: high

```

**Known false positives:**

- Legitimate IIS applications that shell out to cmd.exe or PowerShell for maintenance tasks
- Vulnerability scanners or pen-test activity against the web application

**Tuning notes:** Baseline known child processes per application pool for 14 days and exclude exact ParentCommandLine plus CommandLine pairs. Raise priority when the child runs as the app-pool identity and the host is internet-facing. Restrict to hosts tagged as IIS servers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Web Shell Script File Written to IIS Web Root (locked: unlock with TL Creds)
- AMSI and ETW Patching Indicators in PowerShell Telemetry (locked: unlock with TL Creds)
- IIS Worker Process Proxying to Internal Hosts (Recursive HTTP Tunnel) (locked: unlock with TL Creds)
- IIS Child Process with Base64/GZip Decode or Obfuscation Arguments (locked: unlock with TL Creds)
- IIS Configuration File Credential Harvesting (locked: unlock with TL Creds)
- SharpView / PowerView AD Reconnaissance Execution (locked: unlock with TL Creds)
- PowerShell Engine Loaded Without powershell.exe ([indicator]) (locked: unlock with TL Creds)
- Pass-the-Hash NTLM Logon Followed by Admin Share Access (SMB Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026 (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/chinese-nation-activity-falls/)
- [Trellix: The Speed of Cyber Threats is Changing, Are We Keeping Up?](https://www.trellix.com/blogs/research/the-speed-of-cyber-threats-is-changing-are-we-keeping-up/)
- [Chinese APT Weaver Ant infiltrated a telco for over four years (Security Affairs)](https://securityaffairs.com/175800/uncategorized/chinese-apt-weaver-ant-infiltrated-a-telco-for-over-four-years.html)
- [Trellix Uncovers Spike in Cyber Activity from China and Russia](https://www.trellix.com/news/press-releases/trellix-uncovers-spike-in-cyber-activity-from-china-and-russia/)
- [Trellix Uncovers Diversification of Ransomware Ecosystem as Cybercriminal Use of AI Expands](https://www.trellix.com/news/press-releases/trellix-uncovers-diversification-of-ransomware-ecosystem-as-cybercriminal-use-of-ai-expands/)
- [Trellix Detects China-Affiliated APT Groups Behind Most Nation-State Threat Activity](https://www.trellix.com/news/press-releases/trellix-detects-china-affiliated-apt-groups-behind-most-nation-state-threat-activity/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5319