China's Access to US DoD Systems: Cybersecurity Concerns Rise

Edward Zhou
Edward Zhou

CEO & Founder

 
July 17, 2025 3 min read

Microsoft Employs Engineers in China to Manage US DoD Systems

Engineers in China have been maintaining US Department of Defense (DoD) computer systems under a contract with Microsoft. This arrangement includes the use of US staff known as “digital escorts” to supervise the Chinese workers. However, these escorts often lack the necessary skills to monitor the work effectively. ProPublica reported, “We’re trusting that what they’re doing isn’t malicious, but we really can’t tell.” This model has been in place for nearly a decade without public disclosure.

The Pentagon
Image courtesy of Computerworld

The program allows access to sensitive data under the supervision of U.S. personnel, but the effectiveness of this oversight is questioned. The U.S. Office of the Director of National Intelligence has identified China as the “broadest, most active, and persistent cyber espionage threat to U.S. Government and private-sector networks.” Microsoft has stated that they comply with security requirements such as FedRAMP and DoD Security Requirements Guide.

For more information, refer to the following sources:
ProPublica article on Microsoft escorts
CSO article on cyber threats

The Pentagon's Vulnerability to Chinese Access

The DoD has been allowing Microsoft engineers from China access to its critical systems, a decision that raises significant security concerns. This access is not a result of a cyber breach but a deliberate outsourcing arrangement. An investigation by ProPublica revealed that these engineers had access to sensitive military operation data while being supervised by inadequately qualified digital escorts.

CISO Series Cover
Image courtesy of CISO Series

Concerns are growing over the potential for these foreign engineers to introduce vulnerabilities into DoD systems. The arrangement has been described as a loophole in security measures that allows for indirect access to sensitive data by foreign nationals. The program highlights systemic weaknesses in federal IT procurement, which could lead to serious security breaches.

You can read more about this issue here:
ProPublica investigation
CSO article on DoD vulnerabilities

Implications for National Security

The ongoing access granted to Chinese engineers poses a significant threat to national security. Reports indicate that these engineers may have been able to introduce vulnerabilities posing risks to U.S. military operations. The Justice Department has previously indicted several Chinese hackers for stealing sensitive data from defense contractors, indicating a broader trend of espionage targeting U.S. interests.

China has also been linked to espionage efforts that focus on critical infrastructure, potentially embedding vulnerabilities into systems that could be exploited later. The Salt Typhoon and Volt Typhoon campaigns are examples of such threats targeting U.S. telecommunications and infrastructure sectors.

For further details, consult:
Justice Department indictments
Breaking Defense on cyber espionage

Recommendations for Strengthening Cyber Defenses

To address these vulnerabilities, it is essential for Washington to strengthen its cyber defenses. This includes investing in a capable cybersecurity workforce that can effectively manage and protect sensitive federal information. Additionally, there should be enhanced transparency and accountability in federal contracting with stringent vetting requirements for foreign contractors.

Congress should consider closing loopholes that enable indirect access to sensitive systems, ensuring that employees from adversarial countries cannot work on high-impact data without meeting strict security standards.

For more insights on improving cybersecurity measures, check:
FDD analysis on securing ICT supply chains
National Interest on military technology theft

Explore our services and learn how we can assist you in strengthening your cybersecurity measures. Contact us at undefined for more information.

Edward Zhou
Edward Zhou

CEO & Founder

 

CEO & Founder of Gopher Security, leading the development of Post-Quantum cybersecurity technologies and solutions..

Related Articles

Ransomware Attacks Target Russian Vodka and Healthcare Sectors

The Novabev Group, parent company of the Beluga vodka brand, experienced a ransomware attack on July 14, 2025, causing significant disruptions. The attack affected WineLab, the company's liquor store chain, leading to a three-day closure of over 2,000 locations in Russia. The company reported that the attack crippled its IT infrastructure, particularly point-of-sale systems and online services. Novabev Group stated, "The company maintains a principled position of rejecting any interaction with cybercriminals and refuses to fulfill their demands."

By Alan V Gutnov July 19, 2025 3 min read
Read full article

Retail Sector Faces Surge in Ransomware Attacks: A 2025 Analysis

Publicly disclosed ransomware attacks on the retail sector globally surged by 58% in Q2 2025 compared to Q1, with UK-based firms being particularly targeted, according to a report by BlackFog. This spike in attacks follows high-profile breaches affecting retailers like Marks & Spencer (M&S), The Co-op, and Harrods, attributed to the threat actor known as Scattered Spider.

By Alan V Gutnov July 19, 2025 2 min read
Read full article

AI-Driven Lcryx Ransomware Emerges in Cryptomining Botnet

A cryptomining botnet active since 2019 has incorporated a likely AI-generated ransomware known as Lcryx into its operations. Recent analysis by the FortiCNAPP team at FortiGuard Labs identified the first documented incident linking H2miner and Lcryx ransomware. This investigation focused on a cluster of virtual private servers (VPS) utilized for mining Monero.

By Edward Zhou July 19, 2025 3 min read
Read full article

Preventing ClickFix Attacks: Safeguarding Against Human Error

ClickFix is an emerging social engineering technique utilized by threat actors to exploit human error. This technique involves misleading users into executing malicious commands under the guise of providing "quick fixes" for common computer issues. Threat actors use familiar platforms and deceptive prompts to encourage victims to paste and run harmful scripts.

By Alan V Gutnov July 19, 2025 3 min read
Read full article