Analysts push 'composite' attribution as Salt Typhoon's contractor roles stay undescribed

Security analysts in 2026 are moving away from single-label APT attribution towards mapping the web of contractors and agencies behind Chinese cyber operations. The approach is meant to enable more calibrated responses, from takedowns to sanctions. The Salt Typhoon campaign is cited as the most consequential case, yet as of early 2026 the tasking relationships and specific roles of the named firms remained publicly undescribed. Analysts also flag a broader 2026 trend of blurring lines between state espionage and financially motivated cybercrime.

Why it matters: If defenders and policymakers cannot name who does what inside a state campaign, calibrated responses like sanctions and takedowns are harder to aim.