Chinese Nation-State Cyber Activity Falls 41.4 Percent in Second Half of 2026, Trellix Reports

Analysis
Trellix's 41.4% drop gauges what its sensors saw, not what Beijing did, and defenders should not cut China-focused monitoring on that basis. The report itself admits the decline may reflect shifts in targeting, infrastructure or detection visibility, and the 2025 Weaver Ant case, undetected for over four years in an Asian telecommunications network, shows how large the unseen share can be. The June-to-July uptick alongside expanded coast guard operations around Taiwan suggests cyber activity tracking maritime pressure, though the report offers no causal evidence. The drop may instead be real, with Chinese services shifting resources toward military and battlefield-technology collection and away from the commercial and telecommunications targets Trellix's sensors cover best. Confidence is low: this is a single vendor dataset with undisclosed methodology, secondary outlets only repeat it, and no independent telemetry confirms the trend.