Leaked technical documents show China rehearsing cyberattacks on neighbors’ critical infrastructure

China appears to be using a secret training platform to rehearse cyberattacks against the critical infrastructure of its closest neighbors, according to a cache of leaked technical documents reviewed by Recorded Future News.

Beijing has long been accused of running extensive offensive cyber campaigns by Western officials and cybersecurity researchers, with those allegations usually based on intelligence assessments and technical forensics obtained following a hack. The leaked materials, which include source code, training information and software assets, provide rare documentary insight into the preparation that could support such attacks before they take place.

The internal files describe the training platform as part of a large integrated system called “Expedition Cloud” designed to allow attackers to practice hacking replicas of “the real network environments” of China’s “main operational opponents in the South China Sea and Indochina directions.”

The cache, which was first reported by specialist blog NetAskari, specifies recreating target computer networks used in the power, energy transmission and transportation sectors as well as in smart home infrastructure. It stresses evaluating the work of “reconnaissance groups” and “attack groups” in operations against these networks, with no specified role for defenders.

Rehearsing attacks on critical infrastructure offers China a potential advantage by allowing cyber operations to be planned and practiced in advance rather than improvised in real time. Experts said the system’s design also points toward greater use of artificial intelligence in cyber operations, a shift that could give China’s already large cyber forces additional advantage.

The existence of such a platform, focused on offensive rather than defensive operations, raises questions about repeated claims by Chinese officials that their government does not conduct cyberattacks.

Chinese foreign ministry spokesperson Guo Jiakun recently disputed a British accusation that Chinese companies were facilitating attacks on critical infrastructure, stating Beijing “stands against hacking and fights such activities in accordance with the law.”

The documents reviewed by Recorded Future News instead suggest the existence of a state-sponsored effort to prepare to conduct such attacks. The press bureau at China’s Embassy in London did not respond to a series of questions regarding the cache.

The Leak

The material was shared with Recorded Future News after being discovered exposed on an unsecured File Transfer Protocol (FTP) server. This server appears to have collected material from a personal device used by one of Expedition Cloud’s developers that had been infected by malware.

The cache details the engineering and system architecture of the platform and the cyber range where operators can practice hacking. It contains evidence of incremental patches, realistic debugging work and developer work reports. Alongside the Expedition Cloud materials on the exposed FTP server were numerous personal files belonging to the developer and his wife, as well as several types of malware infecting their shared computer.

Independent experts consulted by Recorded Future News have expressed high confidence in the authenticity of the files based on the volume, complexity and variety of technical documentation covering the Expedition Cloud project.

The platform was developed by a company called CyberPeace (赛宁网安), which celebrates extensive links to the country’s government and military on its website. CyberPeace did not respond to a request for comment, sent in both English and Chinese, when contacted about this article.

The documents do not identify which state authority commissioned the company to build Expedition Cloud. There are numerous independent agencies — from units of the People’s Liberation Army (PLA) to regional bureaus of the Ministries of Public Security and State Security — who could have been initially responsible, said several independent experts consulted by Recorded Future News. The experts also suggested that CyberPeace could have sold the platform to multiple customers.

The specialist researchers told Recorded Future News they regarded the find as extraordinary, and said there was no possible alternative to the Chinese state’s involvement. “This was created to meet the needs of a state customer. We don’t see the purchase order, but we see what they built,” said Dakota Cary, a specialist on China for cybersecurity company SentinelOne.

Cary said the cache provided “an incredibly rare insight” and was the first time foreign analysts had seen language from China explicitly describing the targeting of foreign networks.

“It’s definitely something we’ve not had insights to before. This is a first, it’s not just developing a cyber range for the state or the security apparatus to train on, this is mimicking critical infrastructure,” said Eugenio Benincasa, a China specialist and a senior researcher at ETH Zurich’s Cyberdefense Project.

Mei Danowski, a cyberthreat intelligence professional and the co-founder of Natto Thoughts, described the documents as “really valuable,” noting they provided an unprecedented amount of detail about China’s use of cyber ranges.

“The Chinese Communist Party wants to be seen as promoting peace and not as an aggressor,” added Cary. “Their public statements reflect that. Their observable actions do not.”

Reconnaissance and Attack

Understanding how the system divides and evaluates cyber operations within the copies of adversary networks is key to understanding why the documents have drawn scrutiny.

The platform splits the training exercises for cyberattacks between two teams with distinct roles, using templates mimicking target networks so the same scenarios can be recreated and tested repeatedly under controlled conditions.

Initially a reconnaissance group is sent to map the digital environment, like scouts surveying terrain ahead of an advancing force. This team identifies what systems are present on the network, which services or interfaces are exposed, and where potential access paths may exist for the second team.

An attack group, designated as the primary operational actor, then uses that intelligence to carry out a planned operation within the network. This team decides where to enter, which routes to follow, and how to move through the environment in an effort to achieve the exercise’s objective.

The leaked documents do not spell out specific mission objectives or identify custom hacking tools in operational detail, instead referencing “weapon images” which appear to be preconfigured virtual machines used as standardized attacker workstations inside the range. The vagueness aligns with the focus of the documents, which emphasise the design of the platform and treat any hacking tools as interchangeable inputs controlled by the end customer.

Experts told Recorded Future News that the system is designed with unusually strict operational security — including hard separation between its internal control systems and the simulated external environment, which is treated as “untrusted” and vulnerable to leaks — suggesting the cyber range is being used for classified purposes.

Key to the platform’s design is how it allows analysts to review each step taken during an attack, meaning they can compare different teams or repeated runs and evaluate the most effective methods. The result is a system that turns cyber operations into something that can be studied, measured and refined over time — allowing lessons to be extracted systematically rather than anecdotally.

During any given exercise, the platform records every action taken by the participating teams. Network traffic, system activity and operator decisions are logged in detail, allowing the entire operation to be reconstructed and replayed. The exercise outputs are prized, with the logs held as the primary assets produced during a rehearsal rather than any new skills gained by the operators.

“It’s an incredible application of network engineering to offense. Very few countries — maybe fewer than seven — have this capability built into their operational concepts. China is clearly among the best,” said Cary.

Classification and Automation

Allar Vallaots, the chief operating officer at CR14 — the Estonian cyber range used in NATO’s Locked Shield’s exercise — said the strict network segmentation was significant: “This is basically indicating that they are using something that is classified, or some operational tools. If you want to build a classified or sensitive cyber range, then you will build it this way. And this, of course, means that they are rehearsing here more than training.”

Cary, who has extensively researched China’s use of cyber ranges, said the platform brought to mind a paper published by a Chinese academic called Li Jianhua in the Journal of Information Security Research back in 2018.

“In that paper, Li talks about the need to recreate targeted networks. He talks about having physical and network segmentation within cyber ranges so that sensitive information from the range can be completely destroyed to avoid risk of disclosure. He talks about using these networks for practice of attack and defence. And it lays out, in really important terms, the usefulness that cyber ranges can provide to facilitate training but also rehearse for operations.”

Cary said the implications were significant for organizations who have their networks accessed by Chinese hackers: “With an appropriate amount of network reconnaissance, the goal — at least from what Li said in 2018 — is to recreate those environments and then practice your operations against those things. And that reduces your time on target.

“If stage one is initial access and network reconnaissance, you can come back some time period later, and have your operators already practiced on moving quickly through those networks. They know what is there, or what devices they have access to,” explained Cary.

Vallaots and Cary agreed there were additional risks attached to the value China might get from tracing attack paths and recording such an enormous amount of data about the most effective operations. Cary said “the end goal is basically to facilitate the automation of offensive campaigns against networks.”

Vallaots, who had also reviewed the Li paper, said: “If you can measure all the different parameters within an attack, then you train the attacks … you can take out the human error. AI can find paths, bottlenecks, other ideas, much faster than a human.

“It’s like game theory in a Chess-playing computer. It tries different scenarios, finds the most optimal attack vector, and then it can even do the attack without human intervention,” he said.

The development of chess computers was rapid. In 1997, IBM Deep Blue, a purpose-built machine that cost about $5 million to develop, proved it was possible for a computer to defeat the world’s best human player. Just over a decade later, it was widely accepted that no human could compete on equal terms with any modern chess engine.

Computers have since surpassed humans in several more complex games, including poker, which involves deception, incomplete information and strategic reasoning under uncertainty — conditions that align more closely with real-world decision-making than chess alone.

But even these games remain closed worlds with fixed rules and clearly defined outcomes. Cyber operations, by contrast, take place in open-ended systems with vastly more variables spanning software, networks and human behavior.

Experts told Recorded Future News that, viewed through a game-theory lens, recent advances in artificial intelligence are seen as tools for accelerating decision-making and exploiting advantage in such open-ended environments. They note that this dynamic applies not only to offense, but to defense as well, even if those defensive applications are not visible in the Expedition Cloud documents.

Research on these applications is a major focus of cybersecurity investment both in China and the West. For now the developments are generally believed to be providing productivity gains rather than delivering a fundamental reshaping of the battlefield. But the longer-term trajectory — as suggested by the Expedition Cloud documents — points toward far greater automation on both sides, said Vallaots: “Whoever possesses the better AI wins, because if an AI system attacks you, no human can defend it.”