CHINA-LINKED CYBERATTACKS TARGETING THE UNITED STATES WHAT HAS BEEN CONFIRMED
November 14, 2026 Cybersecurity Report
Recent investigations by the FBI, Department of Justice, and private cybersecurity researchers have documented cyber operations targeting American government agencies, critical infrastructure, defense-related organizations, and private businesses.
These findings involve separate operations dating back several years. There has been no confirmed Chinese military attack on the United States associated with these reports on November 13, 2026.
NOVEMBER 12, 2026 NEW AI-POWERED CYBERATTACK FINDINGS
Palo Alto Networks' Unit 42 published an investigation identifying a cyberattack campaign conducted between August and September 2026.
According to the investigation:
Chinese-speaking attackers conducted 25 cyber operations against at least 19 organizations.
Unauthorized access or data retrieval was confirmed at 10 organizations.
Attackers used an open-source artificial intelligence framework called Cairn, combined with Chinese AI models developed by Zhipu and DeepSeek.
The technology allowed attackers to automate vulnerability discovery, network intrusion attempts, credential collection, and other activities.
The investigation documented access to more than one million membership records belonging to a U.S. teachers' union, approximately 31,000 contact records, and staff password hashes.
Other findings included exposure of approximately 500 records associated with a defense-policy organization, including accounts with U.S. military and government email domains.
Approximately 150,000 internal documents belonging to an industrial automation manufacturer were also accessed.
Investigators documented unauthorized administrator accounts, persistent access mechanisms, and modification of an industry standards voting document.
Unit 42 assessed with moderate confidence that the activity was connected to Chinese intelligence-collection interests. The report did not conclusively establish that the Chinese government directed the operation.
AUGUST 26, 2026 FBI DISRUPTS CHINESE STATE-SPONSORED HACKING NETWORK
The Department of Justice and FBI announced the seizure of domains supporting two hacking platforms called QScan and QTRouter.
According to federal court documents, the systems were developed and operated by a Chinese state-sponsored group known as QTFY, associated with Nanjing Xinjiuwei Network Technology Company.
Identified targets included:
NASA
Federal Reserve
Department of Energy
Department of Justice
Department of Health and Human Services
National Institutes of Health
United States Senate
Federal authorities reported that the hacking network compromised internet-connected devices around the world and used those devices to conceal the origin of cyber operations.
According to the Justice Department, the hacking services were provided to customers including China's Ministry of State Security and People's Liberation Army.
The domain seizures disabled essential functions of the two platforms.
OCTOBER 8, 2026 ADDITIONAL CHINESE HACKING INFRASTRUCTURE SEIZED
The Department of Justice and FBI announced another operation targeting cyber tools associated with the China-linked group known as Flax Typhoon.
Authorities seized seven domains connected to tools called Microscan and FishHub.
According to federal investigators, these tools were used to identify vulnerabilities, conduct targeted phishing operations, install malicious software, and obtain unauthorized access to computer systems.
Targets included a South Carolina power company, foreign airports, infrastructure companies, and educational institutions.
PREVIOUS WARNINGS ABOUT U.S. CRITICAL INFRASTRUCTURE
The FBI, National Security Agency, and Cybersecurity and Infrastructure Security Agency have previously warned that Chinese state-sponsored hackers have gained unauthorized access to critical American infrastructure networks.
The identified sectors include communications, electricity, transportation, water, and wastewater systems.
The U.S. government has assessed that the group known as Volt Typhoon was positioning itself inside these networks to potentially disrupt essential services during a future geopolitical crisis or military conflict.
Other China-linked cyber groups identified in security reporting include Salt Typhoon and APT41.
These warnings concern documented network intrusions and the potential for future disruption. They do not establish that a nationwide shutdown has occurred.
NOVEMBER 13, 2026 NATIONWIDE AVIATION DISRUPTION
The Federal Aviation Administration ordered a nationwide ground stop following serious failures affecting air traffic control communications and data systems.
Federal officials attributed the disruption to problems involving aging communications equipment and overloaded network hardware.
The Department of Homeland Security reported that investigators had found no evidence of a cyberattack or foreign involvement. Investigations continued.
No verified evidence connects the aviation disruption to the China-linked hacking operations described above.
STATUS AS OF NOVEMBER 14, 2026
The confirmed record includes multiple China-linked cyber intrusion campaigns, successful unauthorized access to organizational systems, exposure of sensitive information, and federal operations disabling hacking infrastructure.
The most recent major AI-focused investigation was published November 12, 2026, but the attacks it documented occurred during August and September.
There is no verified evidence in these reports establishing that China launched a new, coordinated nationwide cyberattack against the United States on November 13. (Key term none that have been verified)
The Nobody Show
