Chinese Firms Tied to State-Sponsored Hacking Group Silk Typhoon Patent Cyber Espionage Tools

A concerning new report reveals that Chinese companies with established links to the state-sponsored hacking group known as Silk Typhoon (also identified as Hafnium) have filed over a dozen patents for advanced cyber espionage tools. This discovery, building on recent U.S. Department of Justice indictments, casts a stark light on China’s sophisticated cyber contracting ecosystem and its offensive capabilities.

The patents, unearthed by cybersecurity researchers, cover a wide array of intrusion and forensics tools. These include capabilities for collecting encrypted data from endpoints, conducting forensic analysis on Apple devices, and even remote access to routers and smart home devices. The breadth of these patented technologies suggests a highly organized and well-resourced effort to develop a complete arsenal for state-backed cyber operations.

Among the implicated firms is Shanghai Firetech Information Science and Technology Company, Ltd., a company explicitly named in the July 2025 U.S. indictments of Xu Zewei and Zhang Yu. These individuals are accused of orchestrating the widespread 2021 Microsoft Exchange Server exploitation campaign on behalf of China’s Ministry of State Security (MSS). The investigation indicates that Shanghai Firetech worked directly under the Shanghai State Security Bureau (SSSB), highlighting a tiered system of offensive hacking outfits within China.

Experts note that this patenting activity offers unprecedented insight into the capabilities of state-sponsored threat actors. Traditionally, attribution focuses on linking campaigns and activities to named groups. However, this research demonstrates the importance of identifying the companies and individuals behind these attacks, understanding their capabilities, and how these capabilities bolster state-backed initiatives.

The tools outlined in these patents reportedly exceed the capabilities previously attributed to Silk Typhoon and Hafnium publicly, suggesting a broader scope of operations that may have been sold to other regional MSS offices. This revelation underscores the challenges faced by incident responders and law enforcement in attributing cyber intrusions accurately and completely.

The implications are significant for global cybersecurity. The patenting of such tools indicates not only a commitment to developing sophisticated cyber espionage capabilities but also a potential shift in how these capabilities are formalized and potentially commercialized within China. This development necessitates a heightened vigilance and a re-evaluation of current cybersecurity defenses across critical infrastructure and sensitive sectors worldwide.