PRC Cyber And Critical Infrastructure Defensive Source Packet
PRC cyber is now a dedicated defensive source lane rather than a broad "future cyber packet" queue item. ODNI 2026 provides the current public IC strategic frame: China is described as th...
UNCLASSIFIED//OPEN SOURCE
Source Packet ID: WI-SOURCEPACKET-CHINA-CYBER-CI-2026-0001
Prepared UTC: 2026-06-14T19:56:06Z
Information cutoff UTC: 2026-06-14T19:56:06Z
Source base: ODNI 2026 Annual Threat Assessment; Department of Defense 2025 Annual Report to Congress: Military and Security Developments Involving the People's Republic of China; CISA cybersecurity advisory source family, including PRC state-sponsored cyber advisory routing; NSA cybersecurity advisory source family; FBI cyber and counterintelligence source families; Department of Justice January 31, 2024 Volt Typhoon / KV Botnet disruption press release and linked CISA advisory routing; State Council English / SCIO China's Law-Based Cyberspace Governance in the New Era issuer source; existing WARLOCK-INDEX global cyber and critical infrastructure baseline, China/PLA source baseline, DoD/DIA China extraction map, PRC issuer-language packet, PRC MND and PLA official-media dated capture packet, DoD-to-PRC issuer-language claim crosswalk, PLA services and arms packet, Taiwan pressure packet, South China Sea packet, official U.S. register, U.S. intelligence and law-enforcement register, foreign-government register, China actor profile, China/PLA tracker, coverage map, and global assimilation matrix.
Analytic confidence: High for ODNI 2026 cyber threat framing, DoD 2025 PLA cyber section identity, DOJ January 31, 2024 disruption source identity, State Council cyberspace-governance issuer-source identity, and existing WARLOCK-INDEX cyber baseline routing. Moderate for specific CISA, NSA, FBI, and allied advisory page-level extraction because some advisory URLs are captured through source-family routing and DOJ cross-links rather than full direct page content in this environment. Lower for actor tasking, intent, access persistence, sector-specific disruption severity, crisis timing, and private-sector victim completeness because public cyber sources are partial, defensive, dynamic, attribution-sensitive, and often deliberately non-exhaustive.
Purpose: Establish a safe reusable PRC cyber and critical-infrastructure source packet so future WARLOCK-INDEX products can separate public U.S. assessment, defensive cyber advisory material, DOJ/FBI disruption source events, PRC issuer cyber-governance claims, allied cyber-agency cross-checks, infrastructure-sector exposure, and derived analytic judgment without reproducing cyber methods or operational details.
Scope: Public strategic source organization for PRC state-sponsored cyber activity, PLA cyber modernization, critical-infrastructure risk, pre-positioning language, espionage, communications/energy/transportation/ water-sector risk categories, SOHO-router and botnet disruption source routing, advisory source-family routing, PRC cyberspace-governance issuer claims, allied/Five Eyes advisory cross-check lanes, Taiwan/Indo-Pacific crisis relevance, and homeland/defense-industrial cyber exposure.
Boundary: Strategic defensive source-provenance support only. This packet does not provide cyber operations guidance, exploit steps, vulnerability weaponization, scanning procedures, malware logic, command syntax, credential theft workflows, evasion methods, indicator tables for misuse, victim-specific guidance, infrastructure targeting, collection tasking, incident-response playbooks, intrusion replication, or tactical guidance.
Bottom Line
PRC cyber is now a dedicated defensive source lane rather than a broad "future cyber packet" queue item. ODNI 2026 provides the current public IC strategic frame: China is described as the most active and persistent cyber threat to U.S. government, private-sector, and critical-infrastructure networks, while multiple state and nonstate actors can pre-position or carry out disruptive activity against critical infrastructure. DoD 2025 provides the military-power frame: PLA cyber activity is tied to crisis and conflict relevance, defense and civilian critical-infrastructure disruption, and allied interoperability concerns.
CISA, NSA, FBI, and allied advisories are defensive public sources. They are useful for actor naming, sector exposure, source-family routing, mitigation themes, and official warning chronology. WARLOCK-INDEX should not reproduce technical procedures, exploit paths, malware operation, or indicator tables. DOJ disruption releases, including the January 31, 2024 Volt Typhoon / KV Botnet release, are law-enforcement source events: useful for what the U.S. government publicly says it disrupted and why, not complete visibility into actor access or intent.
PRC cyberspace-governance sources should be treated as issuer claims. The State Council / SCIO cyberspace-governance white-paper lane is useful for how Beijing publicly describes law, sovereignty, governance, and regulation in cyberspace. It is not independent evidence about PRC cyber operations, restraint, legality, or attribution.
Packet Use Rules
- Separate public U.S. assessment, defensive advisory material, law- enforcement disruption source events, PRC issuer claims, allied cyber agency material, private-sector reporting, and WARLOCK-INDEX judgment.
- Use ODNI 2026 for strategic cyber threat framing and DoD 2025 for PLA military-power and crisis-relevance framing.
- Use CISA, NSA, FBI, and allied advisories at defensive strategic level: actor, sector, warning chronology, source family, and mitigation theme.
- Do not reproduce exploit steps, command syntax, malware procedures, detection signatures, IOCs, vulnerable-product lists, scanning logic, or evasion detail.
- Use DOJ/FBI disruption releases as law-enforcement source events, not as complete actor maps, victim lists, or technical remediation playbooks.
- Treat PRC State Council, CAC, MND, MFA, China Military Online, and Xinhua cyber material as issuer perspective and claim material.
- Keep critical-infrastructure sectors strategic and non-technical: communications, energy, transportation, water, health, finance, defense industrial base, cloud/data centers, space services, and state/local government continuity.
- Cross-read U.S. sources with allied cyber agencies before strengthening Five Eyes, NATO, Japan, Australia, Canada, United Kingdom, or EU claims.
Source Ledger
| Source family | Publisher | Source class | Current status | Primary value | Limits |
|---|---|---|---|---|---|
| ODNI 2026 Annual Threat Assessment | Office of the Director of National Intelligence | A | Public PDF accessible | Current public IC frame for China as a persistent cyber threat, critical-infrastructure risk, and pre-positioning/disruptive potential | Summary-level public IC product; no classified inference or technical detail |
| DoD 2025 PRC military-power report | U.S. Department of Defense | A | Public PDF accessible | PLA cyber modernization, crisis/conflict relevance, defense and civilian infrastructure risk, and Cyberspace Force source routing | Public U.S. defense assessment; no operational extraction |
| CISA cybersecurity advisories | Cybersecurity and Infrastructure Security Agency | A defensive cyber | Source family active in USILE register; page-level PRC advisories need dated direct refresh | Defensive advisory source family for PRC state-sponsored activity, critical-infrastructure risk, actor naming, and mitigation themes | Do not reproduce exploit paths, IOCs, scanning logic, or technical procedures |
| NSA cybersecurity advisories | National Security Agency | A defensive cyber | Source family active in USILE register | Joint advisory and cyber defense guidance lane, especially with CISA, FBI, and allied agencies | Defensive strategic extraction only |
| FBI cyber and counterintelligence pages | Federal Bureau of Investigation | A | Source family active in USILE register | FBI public cyber, foreign intelligence, cybercrime, and reporting source routing | No investigative direction, private-person dossiers, or technical methods |
| DOJ Volt Typhoon / KV Botnet disruption release | U.S. Department of Justice | A law-enforcement source event | Accessible 2026-06-14; archived DOJ page updated 2025-02-06 | Court-authorized disruption source event, botnet routing, U.S. critical-infrastructure concern, and links to CISA defensive advisories | Law-enforcement source event; no botnet operation, remediation playbook, or victim identification |
| PRC cyberspace-governance white paper | State Council English site / SCIO / Xinhua | A issuer perspective | Accessible 2026-06-14 as attachment-routing page | PRC issuer language for cyberspace governance, law, regulation, and sovereignty claims | Not a cyber-threat source or independent attribution source |
| Global cyber and critical infrastructure baseline | WARLOCK-INDEX | Internal derived plus official anchors | Active | Existing source-safe actor/domain/infrastructure frame | Derived product; superseded by later dated source packets where applicable |
| Allied cyber-agency source family | NCSC/GCHQ, ASD/ACSC, Cyber Centre/CSE, NCSC-NZ, Japan NISC/NCO, NATO/EU agencies where captured | A/B depending on source | Registered across allied packets; China-specific page capture remains follow-on | Cross-check lane for PRC advisory coordination and regional critical-infrastructure relevance | Needs country/source-specific refresh before claim-level use |
Source Separation Matrix
| Claim family | First source lane | Required cross-check | WARLOCK-INDEX treatment |
|---|---|---|---|
| China as persistent cyber threat | ODNI 2026; DoD 2025 | CISA/NSA/FBI advisories; allied cyber agencies | Public U.S. assessment lane, not all-source completeness |
| PLA cyber modernization | DoD 2025; PLA services/arms packet | PRC issuer taxonomy, ODNI, CISA/NSA/FBI, allied sources | Strategic military-power source lane only |
| Critical-infrastructure pre-positioning | ODNI 2026; DOJ disruption release; CISA advisory source family | FBI/NSA/allied advisories, sector-source packets | Defensive warning/source-treatment lane; no technical procedure |
| SOHO-router and botnet disruption | DOJ January 31, 2024 release | CISA advisory links, FBI source family, private-sector reports if source-classed | Law-enforcement source event; no botnet technical replication |
| Telecommunications and communications risk | ODNI/DoD/CISA source family | FBI/DOJ, sector agencies, allied advisories | Strategic infrastructure-exposure lane; no provider-specific vulnerability mapping |
| Energy, transportation, water, and defense-industrial risk | ODNI/DoD/CISA source family | Sector risk-management agencies, allied advisories, DIB baseline | Sector exposure taxonomy; no target/vulnerability mapping |
| PRC cyber sovereignty/governance claim | State Council cyberspace-governance white paper; future CAC/MFA sources | ODNI, DoD, CISA/NSA/FBI, allied statements, legal sources | PRC issuer claim lane; no validation of legality or restraint |
| Taiwan or Indo-Pacific crisis cyber relevance | DoD 2025; Taiwan pressure packet; cyber baseline | CISA/NSA/FBI, Taiwan/allied sources, Indo-Pacific packets | Strategic coupling lane only; no contingency planning |
| Defensive mitigation themes | CISA/NSA/FBI advisory source families | Allied advisories, sector agencies, baseline | High-level themes only; no playbooks, signatures, or commands |
Defensive Extraction Rules
- Extract advisory title, publisher, publication date, access date, joint agencies, actor label, sector category, and strategic warning theme.
- Summarize mitigation only at category level: patching, asset visibility, logging, identity hygiene, segmentation, secure-by-design procurement, end-of-life device replacement, and reporting pathways.
- Do not copy commands, queries, hashes, IPs, domains, file paths, vulnerability IDs, YARA/Sigma/Snort-like content, or malware behavior sequences into WARLOCK-INDEX.
- Do not identify victims, facilities, providers, routes, network diagrams, device inventories, or operational dependencies unless already public and essential at strategic level.
- Preserve attribution language exactly by source family: "PRC state-sponsored," "China-linked," "PLA," "MSS," "Volt Typhoon," "Flax Typhoon," "Salt Typhoon," "actor," "botnet," or "activity" should not be silently normalized.
- Treat private-sector threat reports as support material only after a separate source-classing pass.
Infrastructure-Sector Routing
| Sector lane | Cyber-source role | Companion source | Boundary |
|---|---|---|---|
| Communications and telecommunications | Strategic exposure and crisis-coupling source lane | ODNI, DoD, CISA/NSA/FBI, sector agencies, allied advisories | No provider vulnerability maps, lawful intercept detail, or network diagrams |
| Energy | Infrastructure-disruption exposure and homeland-defense context | ODNI, CISA, DOE where later captured, cyber baseline | No facility mapping, control-system detail, or outage guidance |
| Transportation and logistics | Military mobility, port/rail/aviation/logistics exposure category | ODNI, CISA, DOT/TSA where later captured, DIB baseline | No route planning, chokepoint exploitation, or system diagrams |
| Water and wastewater | Local public-health and continuity exposure category | ODNI, CISA, EPA where later captured | No process-control instructions or plant-specific detail |
| Defense industrial base | Supplier, engineering, production, software, and continuity exposure | DIB baseline, DoD, CISA, FBI, allied industrial sources | No supplier target mapping or technical vulnerability extraction |
| Cloud, identity, and data centers | Cross-sector platform dependency lane | ODNI, CISA, NIST, sector advisories where later captured | No provider-specific attack path or configuration detail |
| Space services | Satellite communications and ground-support dependency lane | ODNI, space baseline, CISA, Space Force where later captured | No orbital, ground-station, or interference methods |
Follow-On Queue
| Packet | Purpose | Primary source families |
|---|---|---|
| PRC Cyber Advisory Page-Level Refresh | Capture exact CISA, NSA, FBI, DOJ, and allied PRC advisory pages with dates and access notes | CISA, NSA, FBI, DOJ, NCSC/GCHQ, ASD/ACSC, Cyber Centre/CSE |
| Salt Typhoon And Telecommunications Defensive Source Note | Separate public telecom-sector risk, lawful-intercept reporting, and official source caveats without technical or provider-specific detail | CISA, FBI, FCC/sector agencies, DOJ, allied advisories |
| PRC Cyber Governance Issuer-Language Refresh | Capture PRC State Council/CAC/MFA cyber-governance source pages, Chinese originals, and translation notes | State Council, CAC, MFA, Xinhua |
| Critical Infrastructure Sector Source Crosswalk | Pair PRC cyber advisory source families with sector risk-management agencies and existing infrastructure baselines | CISA, SRMAs, ODNI, DoD, DIB baseline |
| Allied PRC Cyber Cross-Check Packet | Add country-level allied cyber-agency source captures for PRC activity and critical-infrastructure warnings | UK, Canada, Australia, New Zealand, Japan, NATO/EU agencies |
Information Gaps
- Direct page-level extraction for specific CISA/NSA/FBI PRC advisories still needs a dedicated advisory refresh pass, especially where pages expose technical detail that must be summarized safely rather than copied.
- Public sources do not reveal classified tasking, all victim identities, actor access persistence, crisis timing, or disruption thresholds.
- PRC issuer pages require Chinese-original capture and translation-status notes before legal/governance language is treated as stable.
- Allied cyber agencies need a China-specific cross-check packet rather than being scattered across country defense packets.
- Sector risk-management agencies need separate source-family capture before communications, energy, water, transportation, health, finance, cloud, and DIB claims are strengthened.
Cross References
- Global Cyber And Critical Infrastructure Strategic Baseline
- China/PLA Official Military And Security Source Baseline Packet
- DoD/DIA China Military Power Extraction Map
- PRC Official Doctrine And Issuer-Language Source Packet
- PRC MND And PLA Official-Media Dated Capture Packet
- DoD 2025 To PRC Issuer-Language Claim Crosswalk
- PLA Services And Arms Source Packet
- Taiwan Pressure And Cross-Strait Coercion Source Packet
- South China Sea Coercion And Legal-Source Packet
- China/PLA Source Collection Tracker
- Official U.S. Intelligence And Law Enforcement Source Register
- Official U.S. Source Register
- Foreign Government Reference Source Register
- China Actor Profile
- Global Actor-Domain Assimilation Matrix
Source Base
- Office of the Director of National Intelligence, Annual Threat Assessment of the U.S. Intelligence Community 2026:
https://www.dni.gov/files/ODNI/documents/assessments/ATA-2026-Unclassified-Report.pdf - U.S. Department of Defense, 2025 Annual Report to Congress: Military and Security Developments Involving the People's Republic of China:
https://media.defense.gov/2025/Dec/23/2003849070/-1/-1/1/ANNUAL-REPORT-TO-CONGRESS-MILITARY-AND-SECURITY-DEVELOPMENTS-INVOLVING-THE-PEOPLES-REPUBLIC-OF-CHINA-2025.PDF - Cybersecurity and Infrastructure Security Agency, cybersecurity advisories source family:
https://www.cisa.gov/news-events/cybersecurity-advisories - Cybersecurity and Infrastructure Security Agency, PRC state-sponsored critical infrastructure advisory route:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a - Cybersecurity and Infrastructure Security Agency, PRC living-off-the-land advisory route:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - National Security Agency, cybersecurity advisories and guidance source family:
https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/ - Federal Bureau of Investigation, cyber source family:
https://www.fbi.gov/investigate/cyber - U.S. Department of Justice, U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure:
https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical - State Council English site, Full text: China's Law-Based Cyberspace Governance in the New Era:
https://english.www.gov.cn/archive/whitepaper/202303/16/content_WS6489542ec6d0868f4e8dcd56.html