China's Military Cyber Operations: Has the Strategic Support Force Come of Age?

Strategic Support Force (SSF) created in 2015 represents a significant shift in China’s cyber operations, integrating civilian and military cyber elements under centralized CCP control

PRC cyber operations focus on establishing information dominance before physical conflict, targeting critical infrastructure in regions like South China Sea and near US military assets like Guam

Military-civil fusion enables coordination between civilian hackers, state security bureaus, and military units through “authorized forces” that can be absorbed into military command during wartime

Volt Typhoon campaign demonstrates evolution in tactics - using compromised IoT devices, living-off-the-land techniques, and multi-hop anonymity networks for persistent access to critical infrastructure

Command structure operates on three tiers:

• Strategic tier: Directly controlled by Central Military Commission
• Operational tier: Theater Commands and Technical Reconnaissance Bases (TRBs)
• Tactical tier: Provincial/local cyber units and civilian elements

Operations driven by “Malacca Dilemma” - China’s strategic vulnerability around key maritime chokepoints and need to project power in South China Sea

Significantly outnumbers US Cyber Command (estimated 10:1 ratio) but faces internal coordination challenges between civilian/military elements

Uses upstream supply chain of offensive tools, exploits and infrastructure through contracted “quartermasters” and criminal elements

Focus on below-threshold operations to avoid triggering military response while still achieving strategic objectives

Doctrine emphasizes offensive cyber operations and information warfare as key to establishing regional dominance without conventional military conflict