--- Page 1 ---
DECLASSIFIED BY COUNSEL TO THE PRESIDENT WARRINGTON ON 10 July 2026,

WlRe

lg China: Cyber Activities Probably Prelude to Election Espionage

My China is probing the presidential campaign for
opportunities to tailor collection and gather insight on policy positions

on US-Chinese issues. US policy on China is a longstanding high
collection priority for Beijing, and Chinese cyber actors have conducted
such activity in every US presidential election campaign since at least 2008,
according to

Pats ee open-source reporting.

— Mi Since I 2018, Chinese cyber actors known in
the private sector as APT 3 | — jas

EEE ave targeted the personal e-mail accounts of

senior US leadership, including officials in the Executive Office of the al Chinese ayber actors are
President and high-ranking officials in multiple Executive Branch fergeting US presidential campaign
information, probably to gather
organizations, Congress, and the federal judiciary, SERS) intelligence that enables future
ae] operations.
— My Since 2017, a separate gy has worked with the
SR to enable more stealthy operations by
identifying the e-mail addresses of high-level US officials, then requesting I ter cee a erg
obtain or crack the passwords for targeted CCU. aii Cais ee Ter Se RE ELE TENE
Mlle As the 2020 election approaches, the IC has detected Chinese state-sponsored cyber
actors targeting the former Vice President's presidential campaign, probably to gather intelligence that
could enable future operations, the first instance this election cycle that we have seen them directly
targeting a US presidential campaign China has also conducted cyber espionage against other US election-
related entities, The IC assesses that China does

not currently intend to covertly interfere to try to sway the outcome of the election, although this activity could enable
such operations, if Beijing made a decision to do so.

— Mig As of 20 May, APT31 actors had sent Spear-phishing e-mails containing tracking links to the G-mail

accounts of staffers associated with a presidential CAM GG) |. (eae SSA aRR ETE] On 4 June, Google
announced that APT31 was targeting the campaign.

— [ig Google and the FBI both briefed campaign officials on the Chinese cyber operations shortly after
discovering the activity. Google officials have publicly stated that the spear-phishing attempts were
unsuccessful;

— Mi During the past year, Chinese cyber actors have collected US election-related
information from US voter databases, a polling data company, political and nonprofit organizations,

fundraisers, and advisory organizations for political CaM pags, eee)
(aa

Mil@mgg 4°731's method of sending tracking links suggests that the Chinese operators are mapping out
the target network for follow-on approaches, possibly including tasking campaign staffers’ e-mail accounts

in the Chinese military’s signals intelligence system for collection. Tracking links collect metadata such as

Classified 5y

Derived From: pes

Declassify On: qu

WiRe2020-05063 fers i ora ERI SE a

--- Page 2 ---
R HE China: Cyber Activities Probably Prelude...

Internet activity and system information that the operators can use to exploit the accounts and identify other targets
of interest.

— Sigg Knowledge of a campaign official's operating system and software would allow cyber actors to
determine whether they could quickly exploit known vulnerabilities or if they needed to develop malware to
gain undetected access to the victim’s machine.

— [ggg |f a target opened a spear-phishing e-mail with a tracking link—even without clicking on any links—it
would confirm an active account for the cyber actors, potentially narrowing the target set for future ay
operations.

For additional information:

Produced jointly under the auspices of the Chief of Analysi;, _-____— the Federal Bureau of
Investigation, and the National Security Agency.

OCUMENT DETAILS

CONTENTS

Produced By: CIA Product Type: World Intelligence Review Document Number: WiRe2020-05063
Publication Date: 01 Jul 2020

Contact: i (5°Cu'e), EER (open)

Maternal used in the WIRe may be subject to copyright laws. Further reproduction and dissemination by any means, for any purpose other than official business,
may be subject to copyright restrictions and is generally prohibited without the permission of the copynght holder.