China Security Report — March 05, 2026

Security analysis based on open-source intelligence and web research. Period: February 26 — March 05, 2026.

Executive Summary

During the period of February 26 to March 05, 2026, China's security posture was characterized by heightened activity in the South China Sea and around Taiwan, alongside significant developments in cybersecurity and diplomatic engagements. Beijing continued its "gray-zone" tactics in disputed maritime areas, including the use of military drones with deceptive transponder signals and routine naval patrols, drawing strong reactions from regional neighbors and the United States. Concurrently, China implemented stricter cybersecurity regulations with the formal activation of its amended Cybersecurity Law, while also facing accusations of state-sponsored hacking campaigns targeting global critical infrastructure. Diplomatically, China engaged with Germany's Chancellor Friedrich Merz to deepen bilateral ties, even as US-China relations remained complex, with an anticipated Trump-Xi summit on the horizon. These developments underscore China's assertive regional presence, its focus on internal digital security, and its efforts to navigate a challenging international landscape.

Key Security Developments

• Military Drone Deception in South China Sea
  A large Chinese military drone has regularly flown over the South China Sea in recent months, transmitting false transponder signals to appear as other aircraft, including a Belarusian cargo plane and a British Typhoon jet. These operations, logged at least 23 times since August under the call sign YILO4200, are seen by military attaches and security analysts as a significant escalation in China's "gray-zone" tactics, potentially testing decoy capabilities for a Taiwan invasion scenario.

• Increased Naval Presence and Patrols in South China Sea
  China's military conducted a routine patrol in the South China Sea from February 23 to 26, accusing the Philippines of "disrupting" regional peace and stability through joint patrols with external countries. This action occurred amidst intensified confrontation and militarization in the region throughout 2025, with China expanding coast guard deployments and island-building efforts.

• Joint Military Exercises by US, Philippines, and Japan
  The navies of the Philippines, the United States, and Japan concluded four-day joint exercises in the South China Sea from February 20 to 26, aimed at strengthening their trilateral defense partnership and interoperability. These drills, which included the Philippine frigate BRP "Antonio Luna," a Japanese P-3C Orion, and the USS "Dewey" destroyer, were part of Manila's strategy to protect its sovereign rights against China's territorial claims.

• Chinese Military Activity Near Taiwan and Potential De-escalation
  Taiwan's Ministry of National Defense tracked Chinese naval vessels around the island, with five ships reported between March 1 and March 2, and 30 aircraft and six naval vessels between February 25 and 26. However, Chinese air force activity around Taiwan has sharply fallen in recent weeks, with no flights reported in the past week, a 46.5% drop compared to a year ago. This reduction is speculated by Taiwanese officials to be an effort by Chinese President Xi Jinping to create a more favorable atmosphere ahead of an anticipated meeting with US President Donald Trump at the end of March.

• Formal Implementation of Amended Cybersecurity Law
  China's amended Cybersecurity Law (CSL) formally entered into force on January 1, 2026, with significant updates on accountability, penalties, and administrative enforcement. The revisions clarify legal liabilities for network operators and critical information infrastructure operators, increasing minimum fines and expanding government power to enforce against extra-territorial activities jeopardizing China's cybersecurity.

• New Cyber-Defense Plan for Industrial Networks
  China's Ministry of Industry and Information Technology (MIIT) released a new strategy to improve data security within the nation's industrial sector. The plan aims to contain "major risks" to industrial threats by the end of 2026 through protective measures applied to over 45,000 companies.

• China-Linked Hackers Target Global Critical Infrastructure
  Hackers working for the Chinese government reportedly breached more than 50 telecommunications companies and government agencies in 42 countries, exploiting cloud platforms to conceal their activities. Separately, an Asian government's espionage campaign, with some activity linked to China Mobile Communications Group, breached at least 70 government agencies and critical infrastructure organizations in 37 countries, likely targeting information on rare earth minerals, trade deals, and economic partnerships.

• China's Strong Stance Against US Cyber Activities
  Chinese foreign ministry spokesperson Mao Ning stated on March 2 that China would ensure its cybersecurity with all necessary measures, in response to reports of the US Department of War discussing partnerships with AI companies for automated reconnaissance of China's power grids and sensitive networks. Mao Ning accused the United States of being the leading source of instability in cyberspace and of conducting cyberattacks against China's key infrastructure.

• German Chancellor Friedrich Merz's Visit to China
  German Chancellor Friedrich Merz visited China from February 25 to 26, his first official trip since taking office, accompanied by thirty top executives. During meetings with President Xi Jinping and Premier Li Qiang, both sides agreed to deepen their all-round strategic partnership, promote dialogue and cooperation, and uphold multilateralism and free trade. Merz notably avoided referring to China as a "systemic rival," a term that had previously caused friction.

• Espionage Allegations and Arrests in Europe
  In Greece, a 54-year-old air force colonel, Christos Flessas, was arrested on February 5 on suspicion of providing classified information to China, reportedly confessing after a tip-off from the CIA. Greek authorities found a "special machine with software" supplied by China to photograph classified documents. In France, four individuals, including two Chinese nationals, were arrested for possession of sensitive military data, suspected of intercepting military communications.

• China's Response to CIA Recruitment Campaign
  China reacted angrily in February to a public campaign launched by the CIA to recruit spies from within the ranks of the Chinese military, vowing to take "all necessary measures" to protect its national security. The Chinese Foreign Ministry spokesperson, Lin Jian, described the CIA's recruitment video as a "blatant political provocation" and an explicit admission of attempts to steal state secrets.

• Chinese Satellite Intelligence Support Amidst US-Israel-Iran Conflict
  Chinese entities have reportedly provided critical Intelligence, Surveillance, and Reconnaissance (ISR) capabilities amidst the US-Israel war on Iran, which commenced on February 28, 2026. Shanghai-based geospatial intelligence firm MizarVision has disseminated high-resolution satellite imagery exposing US force deployments and naval assets, with some facilities and assets subsequently targeted by Iran. This highlights China's strategic alignment with Tehran against Western interests and its leveraging of an expansive satellite constellation.

Geopolitical Impact and Regional Dynamics

China's recent security developments have significantly shaped regional stability and its relations with major global powers. The South China Sea remains a critical flashpoint, with China's assertive "gray-zone" tactics, including deceptive drone flights and expanded coast guard presence, directly challenging the sovereignty claims of littoral states like the Philippines. The joint naval exercises by the Philippines, US, and Japan underscore a growing regional alignment aimed at countering China's influence and upholding freedom of navigation. This dynamic risks accidental escalation, particularly as China continues to reject the 2016 international arbitration ruling on its claims.

Relations with the United States are characterized by a complex mix of competition and cautious engagement. While the anticipated Trump-Xi summit in late March suggests a potential for dialogue, underlying tensions persist, particularly regarding Taiwan and cybersecurity. The reported decrease in Chinese military flights around Taiwan could be a deliberate move to de-escalate ahead of this summit, indicating Beijing's strategic flexibility. However, the US continues to view China as a significant military and security threat, and the intelligence conflict, including China's strong reaction to CIA recruitment efforts, highlights deep mistrust.

EU-China relations are in a phase of "cautious engagement" rather than a full reset, marked by both economic interdependence and persistent frictions. German Chancellor Merz's visit, while emphasizing cooperation and avoiding the "systemic rival" label, also saw discussions on "difficult issues" like China's industrial overcapacity impacting Europe. The arrests of alleged Chinese spies in Greece and France further complicate trust-building with European nations, highlighting concerns over intelligence activities. China's increasing use of satellite intelligence to track US forces in the Middle East, particularly in the context of the US-Israel-Iran conflict, demonstrates its growing global reach and its strategic alignment with non-Western powers, potentially altering broader strategic landscapes.

Military and Defense Analysis

China's military and defense posture during this period reflects a continued emphasis on modernization and capability development, particularly in areas related to information warfare and maritime control. The deployment of military drones utilizing false transponder signals in the South China Sea exemplifies an evolving "gray-zone" tactic, designed to test deception capabilities and complicate adversary responses without direct confrontation. This indicates a sophisticated approach to asserting territorial claims and preparing for potential contingencies, especially concerning Taiwan. The People's Liberation Army (PLA) continues to sharpen its readiness, as evidenced by these activities and the ongoing presence of naval vessels and aircraft around Taiwan, even with a recent temporary reduction in visible air force activity.

Defense spending trends, while not explicitly detailed for this specific week, are implicitly supported by the continuous development and deployment of advanced systems. China's expanding satellite constellation, with over half of its 1,060+ satellites being intelligence sensors, demonstrates a significant investment in Intelligence, Surveillance, and Reconnaissance (ISR) capabilities. This orbital supremacy allows for real-time tracking of foreign military assets, as seen in the monitoring of US forces during the US-Israel-Iran conflict, providing Beijing with asymmetric advantages and extending its influence beyond its immediate region. Furthermore, the focus on strengthening cybersecurity for industrial networks and the formalization of the amended Cybersecurity Law highlight a comprehensive approach to national security that integrates digital defense with traditional military capabilities, aiming to protect critical infrastructure from both state-sponsored and other cyber threats.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, the South China Sea will likely remain a hotbed of activity. China is expected to continue its "gray-zone" operations, including deceptive drone flights and assertive coast guard patrols, pushing the boundaries of international law while avoiding direct military conflict. Regional allies, particularly the Philippines, US, and Japan, will likely maintain their joint exercises and freedom of navigation operations, leading to continued diplomatic exchanges and potential close encounters. The upcoming Trump-Xi summit at the end of March will be a critical event, potentially influencing the tempo of Chinese military activities around Taiwan. A temporary de-escalation around Taiwan might be observed leading up to the summit, but the underlying strategic rivalry will persist.

Critical flashpoints and risk areas: The Taiwan Strait remains the most significant flashpoint. While a full-scale invasion is not immediately forecast, any miscalculation during Chinese military drills or "gray-zone" incursions could rapidly escalate. The South China Sea also presents a high risk of accidental collisions or confrontations between Chinese vessels and those of other claimant states or their allies. Cybersecurity is another critical risk area, with ongoing state-sponsored hacking campaigns and the potential for retaliatory cyberattacks between China and Western nations. The arrests of alleged Chinese spies in Europe highlight persistent intelligence competition, which could lead to further diplomatic friction and counter-intelligence measures.

Indicators to monitor: Key indicators to monitor include the frequency and nature of Chinese military and coast guard activities in the South China Sea and around Taiwan, particularly any resumption of high-intensity air force incursions after the anticipated Trump-Xi summit. Statements and outcomes from the Trump-Xi meeting will be crucial for understanding the trajectory of US-China relations and their impact on regional security. Developments in China's cybersecurity enforcement, especially regarding the implementation of the amended CSL and any new reports of state-sponsored cyberattacks, will indicate the effectiveness of its digital defense and offensive capabilities. Additionally, monitoring China's diplomatic engagements with European nations and its involvement in global geopolitical events, such as the US-Israel-Iran conflict, will shed light on its evolving strategic alignments and influence.

Strategic recommendations: For international actors, maintaining a unified and consistent stance on freedom of navigation and international law in the South China Sea is paramount to deter further Chinese assertiveness. Strengthening multilateral defense cooperation with regional partners, as demonstrated by the US-Philippines-Japan exercises, is crucial for enhancing deterrence and interoperability. In the cybersecurity domain, international collaboration on threat intelligence sharing and defensive measures against state-sponsored hacking is essential. Diplomatically, while engaging with China on areas of mutual interest, it is important to address concerns regarding human rights, trade imbalances, and intellectual property theft with clear and firm messaging. Finally, continued investment in counter-intelligence capabilities and public awareness campaigns is necessary to mitigate the risks of espionage.

Sources

• japantimes.co.jp
• kwsn.com
• twobirds.com
• cybersecuritydive.com
• de-line.net
• gtlaw.com
• cfr.org
• china.org.cn
• straitstimes.com
• eastasiaforum.org
• unn.ua
• youtube.com
• taiwannews.com.tw
• darkreading.com
• cybersecuritydive.com
• people.cn
• fmprc.gov.cn
• cppcc.gov.cn
• moderndiplomacy.eu
• debuglies.com
• flightglobal.com
• china-briefing.com
• youtube.com
• china-briefing.com
• cnas.org
• thesocialonmain.com.au