China signals cyberattack responsibility in rare admission to US officials

China privately admitted cyberattacks on U.S. infrastructure, escalating tensions.

In a rare and veiled admission, Chinese officials privately acknowledged responsibility for a series of cyber intrusions into US critical infrastructure during a closed-door meeting in Geneva last December, according to individuals familiar with the discussion. The revelation marked a stark departure from China’s usual denials and underscored escalating tensions between the world’s two largest powers—particularly over Taiwan, the Wall Street Journal reported.

Tacit warning tied to Taiwan support

During the meeting with the outgoing Biden administration, Wang Lei, a senior cyber official from China’s Ministry of Foreign Affairs, indicated that the hacks—targeting ports, water systems, and airports—were linked to Washington’s increasing military and diplomatic support for Taiwan. Though not a direct confession, US officials interpreted the remarks as a strategic signal that China views cyberattacks as a form of deterrence against US involvement in a future Taiwan conflict.

“It was a tacit admission and a warning,” said one former US official present at the meeting, which involved representatives from the State Department, National Security Council, Pentagon, and US intelligence agencies. The delegation was led by Nate Fick, then US ambassador-at-large for cyberspace and digital policy.

Volt Typhoon and a threat of war

The meeting centred around Beijing’s Volt Typhoon campaign, which US officials publicly attributed last year to China’s attempt to burrow into civilian networks, pre-positioning malware that could cripple infrastructure in the event of war. The Chinese side’s response appeared intended to reinforce that the US should expect cyber retaliation if it deepens support for Taiwan, an island Beijing claims as its territory.

In response, US delegates warned that attacks on civilian infrastructure could be viewed as an act of war. They also raised doubts about whether President Xi Jinping and top Chinese leaders were fully informed of the hackers’ scope of operations, further complicating the lines of accountability.

Salt Typhoon revelations amplify fallout

Although the meeting also referenced China’s separate Salt Typhoon operation—which breached major US telecom networks like AT&T and Verizon, allowing Beijing to monitor unencrypted communications of senior American political figures—the focus remained on Volt Typhoon due to its potential to cause widespread disruption in a future conflict.

Salt Typhoon’s reach extended into the 2024 presidential campaigns of Donald Trump and Kamala Harris, and is considered one of the most significant intelligence failures in modern US history. However, officials noted that espionage of that nature, while serious, is more aligned with longstanding practices by nation-states—including the US.

Cyber capabilities as geopolitical leverage

Dakota Cary, a China specialist with SentinelOne, said such a signal from Beijing would likely only be made under instruction from the top levels of Xi’s government. The admission, he said, is a strategic message: “China wants US officials to know that, yes, they do have this capability, and they are willing to use it.”

Mounting pressure amid internal cybersecurity strain

The Geneva meeting came at a precarious time for Washington. The Trump administration has since announced sweeping job cuts across federal cybersecurity roles and dismissed the director of the National Security Agency and his deputy. Intelligence officials warn these moves risk undermining the US's defensive posture against increasingly aggressive Chinese cyber operations.

In a statement, the State Department declined to comment on the meeting but said the US has “made clear to Beijing it will take actions in response to Chinese malicious cyber activity,” describing such attacks as “some of the gravest and most persistent threats to US national security.”