Chinese Cyberespionage Targets France’s Critical Infrastructure

July 3, 2025

In late 2024, a stealthy Chinese cyber campaign quietly infiltrated the French government's digital perimeter, leveraging a trio of Ivanti CSA zero-days to breach systems across multiple strategic sectors — government, telecoms, media, finance, and transport. It wasn’t just another APT sighting. What emerged instead was a broader picture of China’s evolving cyber playbook: not only highly technical and persistent, but increasingly modular, commercialized, and deniable. At the center of the operation is a group codenamed Houken, closely aligned with UNC5174 (Uteus), known for selling access, exploiting infrastructure, and blending state-aligned goals with financially motivated intrusions. This isn't a singular operation — it's part of a larger ecosystem of intrusion-as-a-service run by Chinese-speaking actors who specialize in exploiting edge vulnerabilities and distributing high-value network access across multiple interested parties. What follows is a deep dive into the tactics, tools, targets, and geopolitical signals embedded in this operation — and what it reveals about the strategic direction of China's cyber posture in Europe.