---
title: Chinese Hackers Target SentinelOne in Broader Espionage Campaign
description: Chinese hackers targeted SentinelOne in a failed espionage attempt, highlighting the ongoing threat to critical infrastructure and supply chains.
---

[SecureWorld News ](https://www.secureworld.io/industry-news)

# [Chinese Hackers Target SentinelOne in Broader Espionage Campaign](https://www.secureworld.io/industry-news/chinese-hackers-target-sentinelone)

 Written by [Drew Todd](https://www.secureworld.io/industry-news/author/drew-todd) | Mon | Jun 9, 2025 | 9:53 PM Z

Chinese government-backed hackers attempted, and failed, to breach cybersecurity firm SentinelOne in what experts call a textbook example of long-term espionage tradecraft aimed at high-value targets. The intrusion attempts were detailed in a new report from [SentinelOne's research arm, SentinelLABS](https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/), which also uncovered broader campaigns affecting dozens of organizations across the globe.

According to the firm, the threat actors are part of a larger China-nexus operation tracked as PurpleHaze and ShadowPad, with activity observed between July 2024 and March 2025. While SentinelOne itself was not compromised, one of its IT vendors was targeted in a separate intrusion, emphasizing the growing risk of supply chain exploitation.

"The objective of these efforts appears to be long-term persistent access to high-value targets," the report notes, "particularly entities in sectors that align with strategic Chinese interests including defense, logistics, and media."

SentinelOne attributed the activity to state-sponsored threat actors with links to groups previously identified as APT15 and UNC5174.

"The attackers invested considerable effort in infrastructure acquisition and operational security. They operated at a slow cadence, used novel malware loaders, and attempted to minimize noise—all hallmarks of a patient, well-resourced threat actor."

## **Aiming for the defenders**

The report's most striking revelation may not be the failure of the attackers, but rather the fact that they targeted a cybersecurity company. SentinelOne's visibility into its systems allowed it to detect reconnaissance efforts and prevent lateral movement from its compromised vendor.

"What SentinelOne is seeing now is classic China-nexus activity," said Craig Jones, VP of Security Operations at Ontinue. "We saw the same playbook during the Pacific Rim attacks—stealthy implants, edge device compromises, and a focus on long-term access to high-value infrastructure. This isn't new—it's a continuation of a well-honed strategy."

This incident follows a pattern: targeting vendors and security firms can offer attackers disproportionate access to downstream clients and national infrastructure. SentinelOne said that other targets of the broader campaign include a South Asian government entity, a European media organization, and more than 70 critical infrastructure organizations.

### **A call for coordinated defense**

Security leaders say these kinds of intrusions emphasize the importance of vigilance, layered defenses, and real-time intelligence sharing.

"SentinelOne has long been on the leading edge of tracking China-nexus actors," said Casey Ellis, Founder of Bugcrowd. "What's needed is vigilance and information sharing—both general awareness and technical-level indicators."

Heath Renfrow, CISO and Co-founder at Fenix24, argues that the U.S. government must go further than current measures like executive orders and indictments. He advocates for a mandatory vendor audit framework, operational coordination centers, and clear offensive deterrence policies that include economic consequences for adversarial states.

"China's strategy is patient and long-term," Renfrow said. "Our response must be equally sustained, strategic, and unapologetically proactive."

Follow *SecureWorld News* for more stories related to cybersecurity.

[View full post](https://www.secureworld.io/industry-news/chinese-hackers-target-sentinelone)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Drew Todd"
  },
  "dateModified" : "2025-06-09T21:53:35.357Z",
  "datePublished" : "2025-06-09T21:53:35Z",
  "headline" : "Chinese Hackers Target SentinelOne in Broader Espionage Campaign",
  "image" : {
    "@type" : "ImageObject",
    "height" : 334,
    "url" : "https://2221756.fs1.hubspotusercontent-na1.net/hubfs/2221756/China_hacker_code_flag_shutterstock_669157375.jpg",
    "width" : 500
  },
  "mainEntityOfPage" : "https://www.secureworld.io/industry-news/chinese-hackers-target-sentinelone",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2221756/Logos/SWE/SWE_logo_full-long_forWHITEbackgrounds.jpg",
      "width" : 304.46954
    },
    "name" : "SecureWorld News"
  }
}
```