Mongolia Security Report — June 03, 2026

Security analysis based on open-source intelligence and web research. Period: May 27 — June 03, 2026.

Executive Summary

During the period of May 27 to June 03, 2026, Mongolia actively engaged in significant military exercises and diplomatic initiatives, reinforcing its "third neighbor" foreign policy. A notable development was the "Steppe Partner 2026" joint army training with China in Inner Mongolia, marking a deepening of military cooperation with its southern neighbor. Concurrently, Mongolia participated in the multinational "EFES-2026" exercises in Turkey, showcasing its commitment to broader international defense engagement. Cybersecurity remained a critical concern, with reports detailing a China-linked advanced persistent threat group targeting Mongolian government entities. Diplomatically, Mongolia strengthened ties with the European Union through high-level meetings and prepared for upcoming high-profile visits, including that of Chinese President Xi Jinping, while also fostering economic dialogue with Russia.

Key Security Developments

• Military Activities and Exercises with China
  Mongolian troops arrived in China's Inner Mongolia Autonomous Region on May 27, 2026, for the "Steppe Partner 2026" joint army training, which officially kicked off on May 30, 2026. This marks the second iteration of the "Steppe Partner" series and the first time it is being held within China's territory. The exercise, focusing on joint strikes against illegal armed groups, aims to deepen friendship, mutual trust, and enhance practical cooperation and capabilities in upholding regional peace and stability. Over 600 officers and soldiers from both countries are participating.

• Participation in Multinational Exercises in Turkey
  Mongolian servicemen participated in the "EFES-2026" joint military exercises with live fire, held at the Doganbey training ground in Seferihisar, Turkey, from April 20 to May 21, 2026. These exercises involved over 10,000 participants from 50 countries, including the USA and Azerbaijan, and demonstrated modern equipment and aviation, as well as the use of new technologies like AI-supported analytical applications. The Commander of the Mongolian Ground Forces, Major General Tsogtjargal Chimeddorj, met with the Commander of the Turkish Ground Forces to discuss cooperation.

• Strengthening Diplomatic Ties with the European Union
  Ambassadors and representatives from 21 EU Member States conducted high-level meetings in Ulaanbaatar on May 25 and 26, 2026, following a Europe Day celebration in Darkhan city on May 23, 2026. Discussions focused on democratic governance, green transition, sustainable development, and economic partnership, aiming to deepen and broaden the EU-Mongolia relationship. The Speaker of the Mongolian Parliament, H.E. Mr. Byambatsogt Sandag, expressed interest in learning from EU experience in transparent lawmaking and cooperating on legislative responses to disinformation.

• Cybersecurity Threat: China-linked APT Group "GopherWhisper"
  A previously undocumented China-aligned advanced persistent threat (APT) group, named "GopherWhisper" by ESET researchers, has been targeting Mongolian government entities. The group, active since at least November 2023, was discovered in January 2025 after a new backdoor, "LaxGopher," was found on a Mongolian government institution's network. The attackers used legitimate communication platforms like Discord, Slack, and Microsoft 365 Outlook for command-and-control and data exfiltration, infecting approximately a dozen systems.

• Economic and Diplomatic Engagement with Russia
  Mongolia's Ambassador to the Russian Federation, Dulamsürengiin Davaa, emphasized the importance of expanding practical engagement between the business communities of the two countries at the St. Petersburg International Economic Forum (SPIEF), scheduled from June 3 to June 6, 2026. This follows the signing of a program for developing cooperation between Russia and Mongolia for 2026-2030 in December 2025, which includes over 120 joint events.

• Upcoming High-Level Chinese Visit
  Chinese President Xi Jinping is expected to pay a state visit to Mongolia in 2026. This visit would be his first since 2014 and is anticipated to build upon diplomatic milestones marked in 2024, including the 75th anniversary of diplomatic ties.

• Internal Anti-Corruption Investigations
  A joint investigative task force, including the Independent Authority Against Corruption, National Police Agency, and General Intelligence Agency of Mongolia, is probing several major infrastructure projects in Ulaanbaatar. This includes the city's 24 mega projects, the Tuul Expressway Project, the First Ring Road Project, and the Selbe Subcenter Project, with investigators collecting significant data and testimony.

• Mongolia's Role in Global Environmental Governance
  Mongolia is preparing to host the 17th Conference of the Parties (COP17) to the United Nations Convention to Combat Desertification (UNCCD) in Ulaanbaatar from August 17 to 28, 2026. The UNCCD has launched an open call for youth participation, highlighting Mongolia's leadership in addressing land degradation and climate change.

• Cybersecurity Framework and Challenges
  While Mongolia has established a legal and regulatory foundation for cybersecurity, including a 2021 law and national CSIRTs, translating this framework into practice remains a challenge. Compliance rates are low, and audit quality varies, indicating a need for more skilled cybersecurity professionals. Mongolia is reliant on both Russia and China for its internet capabilities, making it vulnerable to non-state cyber actors.

Geopolitical Impact and Regional Dynamics

Mongolia's security posture during this period reflects its continued commitment to a "third neighbor" foreign policy, aiming to balance relations with its powerful neighbors, China and Russia, while expanding partnerships with other countries like the United States, the European Union, and Turkey. The "Steppe Partner 2026" joint military exercise with China underscores a pragmatic approach to security cooperation with Beijing, focusing on shared concerns like illegal armed groups. This engagement, particularly being hosted in China for the first time, signals a deepening of military trust and interoperability with the People's Liberation Army.

Simultaneously, Mongolia's participation in Turkey's "EFES-2026" exercises demonstrates its desire to maintain and enhance defense ties beyond its immediate neighborhood, aligning with its "third neighbor" strategy to diversify security partners and capabilities. The high-level EU delegation visits to Ulaanbaatar and Darkhan further illustrate Mongolia's efforts to strengthen economic and democratic governance ties with the European bloc, seeking support for sustainable development and legislative cooperation. These diplomatic overtures with the EU and the US (a key "third neighbor") are crucial for Mongolia to mitigate over-reliance on any single power, especially given its landlocked position between two geopolitical giants.

The reported China-linked cyber espionage targeting Mongolian government entities, however, highlights a persistent security challenge and potential vulnerability in its relationship with Beijing, even amidst military cooperation. This underscores the complex nature of Mongolia's geopolitical balancing act, where economic and security interdependence can coexist with covert threats. Mongolia's efforts to expand transport and resource connectivity with Kazakhstan, aiming for access to the Trans-Caspian Corridor and markets in Europe and the Middle East, further illustrate its strategic drive to reduce dependence on its immediate neighbors and enhance regional stability through diversified trade routes.

Military and Defense Analysis

Mongolia's military activities during this period indicate a dual approach to defense: strengthening bilateral cooperation with its immediate powerful neighbors and engaging in multilateral exercises with "third neighbors." The "Steppe Partner 2026" joint army training with China, focusing on counter-terrorism and joint strike operations against illegal armed groups, suggests an emphasis on internal security threats and regional stability in collaboration with the PLA. The participation of armored troops from the Chinese PLA 79th Group Army implies a focus on conventional military capabilities and interoperability in ground operations. This exercise, being held in China, could offer Mongolian forces exposure to Chinese military doctrines and equipment.

Concurrently, Mongolia's involvement in Turkey's "EFES-2026" exercises, a large-scale multinational event, highlights its commitment to international peacekeeping and modern defense practices. The exercises' focus on digital management, data analysis, artificial intelligence, and cybersecurity indicates Mongolia's interest in modernizing its forces with advanced technologies and operational concepts. The meeting between the Mongolian and Turkish Ground Forces commanders suggests a desire to deepen defense cooperation and potentially explore defense acquisitions or technology transfers from Turkey, a NATO member. While specific defense spending trends or major new acquisitions were not detailed in the available news, the engagement in diverse international exercises points towards a strategy of capability development through exposure to various military standards and technologies, rather than solely relying on its traditional partners.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, Mongolia will continue its diplomatic outreach, particularly with the EU and Russia. The St. Petersburg International Economic Forum (June 3-6, 2026) will likely see further discussions on economic cooperation with Russia, potentially leading to concrete project advancements. The "Steppe Partner 2026" joint exercise with China will conclude in early June, and its outcomes, including enhanced interoperability and trust, will be closely watched. Preparations for the UNCCD COP17 in Ulaanbaatar in August 2026 will intensify, placing Mongolia in a prominent role on the international environmental stage. The ongoing internal anti-corruption investigations in Ulaanbaatar are expected to continue, potentially leading to further arrests or policy changes related to infrastructure projects.

Critical flashpoints and risk areas: The primary risk area remains cybersecurity, given the recent reports of China-linked APT groups targeting Mongolian government entities. The low compliance rates and varying audit quality in Mongolia's cybersecurity framework suggest a persistent vulnerability that could be exploited for espionage or disruption. Geopolitically, while Mongolia's "third neighbor" policy aims for balance, the increasing military and economic engagement with China and Russia, juxtaposed with Western partnerships, requires careful navigation to avoid being caught in major power rivalries. Internal political stability, though generally assessed as low-threat for political violence, could be influenced by the outcomes of the corruption investigations.

Indicators to monitor: Key indicators to monitor include any further reports on cyberattacks against Mongolian infrastructure or government systems, which would signal an escalation of cyber threats. The nature and frequency of high-level diplomatic exchanges, particularly with China (e.g., President Xi's visit), Russia, and Western partners, will indicate the success of Mongolia's balancing act. Progress on economic diversification initiatives, especially those aimed at reducing reliance on its immediate neighbors and expanding trade routes (e.g., with Kazakhstan), will be crucial for long-term stability. Furthermore, the transparency and effectiveness of the ongoing anti-corruption probes will be important for internal governance and public trust.

Strategic recommendations: Mongolia should prioritize strengthening its cybersecurity defenses through increased investment in skilled professionals, improved compliance mechanisms, and international cooperation with trusted partners to counter sophisticated APT threats. Diversifying internet infrastructure beyond reliance on China and Russia could also enhance cyber resilience. Diplomatically, Mongolia should continue to actively pursue its "third neighbor" policy, leveraging its strategic location to foster mutually beneficial relationships with a wide array of partners, including the US, EU, Japan, and South Korea, to ensure its sovereignty and economic independence. Economically, accelerating efforts to diversify its export markets and critical raw material supply chains, as well as developing robust transport corridors, will be vital to reduce geopolitical vulnerabilities. Internally, sustained efforts to combat corruption and enhance good governance will bolster national resilience and attract foreign investment.

Sources

• mod.gov.cn
• youtube.com
• chinadiplomacy.org.cn
• mod.gov.cn
• mod.gov.cn
• open.kg
• europa.eu
• agenceurope.eu
• europa.eu
• therecord.media
• darkreading.com
• thehackernews.com
• forum-spb.ru
• interfax.com
• government.ru
• gogo.mn
• substack.com
• zms.mn
• opportunitiesforyouth.org
• cybersecurityadvisors.network
• osac.gov
• brookings.edu
• ohchr.org
• epc.eu
• arctusanalytics.com
• ips-journal.eu
• wikipedia.org