SentinelOne recently revealed that it was the target of a failed cyber espionage operation carried out by China-linked threat actors. This case is a rare example where a cybersecurity firm itself became the focus of a nation-state campaign.
According to a detailed disclosure from the company’s research team, attackers attempted to penetrate SentinelOne’s internal defenses and supply chain through early-stage reconnaissance and the compromise of a third-party logistics vendor. While the attack was ultimately unsuccessful, investigators say it is the latest in a growing pattern of advanced targeting by state-backed groups against cybersecurity companies that secure global networks.
The incident has been attributed to two interconnected espionage groups known as PurpleHaze and ShadowPad. Both are part of a larger ecosystem of China-based operations that share infrastructure and tooling, and have previously been linked to campaigns against governments, telecoms, and critical industries. SentinelOne’s findings suggest that these threat actors are adapting quickly and extending their reach into increasingly sensitive sectors.
The Reconnaissance Operation
SentinelOne first detected signs of unusual activity in October 2024, when internal telemetry flagged reconnaissance behavior targeting its systems and personnel. The activity was traced to a compromised third-party logistics provider, which had been used to collect information about SentinelOne’s infrastructure. This early-stage surveillance aligned with tactics commonly used by advanced persistent threat (APT) groups seeking access to high-value environments.
In response, SentinelOne launched an internal investigation and initiated countermeasures to isolate and neutralize any potential risks. The company also notified the compromised vendor and worked with other external partners to validate the origin and scope of the intrusion attempt. SentinelOne’s fast and precise response not only helped contain the situation and uncover valuable intelligence about the threat actors’ methods, but it also ensured that no breach occurred.
Infiltrating via IT Vendors
Then, in early 2025, SentinelOne uncovered a second wave of activity linked to the same groups. This phase focused on a compromised IT vendor within its extended supply chain, which attackers attempted to exploit as a bridge into the company’s internal environment. While the attempt did not succeed, it offered a new view into the adversaries’ strategy: bypassing hardened targets by first infiltrating trusted third parties.
The use of vendors as entry points is evidence of a persistent tactic in modern cyber espionage. By exploiting the weaker security controls of external partners, state-aligned groups can quietly gather intelligence, establish footholds, and then pivot toward their primary targets.
The incident shows how security firms – despite maintaining their own defenses – remain exposed through their larger ecosystem. SentinelOne’s case reinforces the critical importance of visibility and risk management across the full digital supply chain.
“What SentinelOne is seeing is classic China-nexus activity,” said Craig Jones, Vice President of Security Operations at Ontinue, a managed detection and response (MDR) provider. “This includes highly targeted operations, stealthy implants on edge devices, and a relentless focus on long-term access to high-value infrastructure. These tactics aren’t new – they’re a continuation of a well-honed strategy.”
Broader Implications and Global Victimology
As SentinelOne expanded its investigation, it eventually identified more than 70 entities that had been targeted in related campaigns. The affected organizations included many different industries, including national governments, major media outlets, telecommunications firms, and critical infrastructure providers. The victim profile suggests a deliberate strategy to infiltrate entities with access to sensitive data, operational influence, or public communication channels.
These attacks were not geographically isolated, with victims located across North America, Europe, and Asia. Analysts view this as part of a long-term effort by China-linked groups to position themselves within strategic sectors on a global scale. Rather than launching disruptive attacks, these actors appear to be focused on persistent access, surveillance, and data exfiltration – tactics consistent with long-game intelligence collection rather than short-term disruption.
Identifying the Attackers
SentinelOne attributed the campaign to Chinese threat actors known as APT15 and UNC5174, two groups with extensive histories in cyber espionage. These actors are known for taking advantage of custom malware, stolen credentials, and infrastructure reuse to gain access and maintain persistence.
APT15 has previously targeted defense contractors and diplomatic missions, while UNC5174 is linked to activity involving ShadowPad, a modular backdoor tool commonly seen in Chinese state-sponsored operations. The tactics used in the SentinelOne case – reconnaissance through compromised vendors, stealthy lateral movement, and overlapping infrastructure – are consistent with methods used by both groups in past campaigns across multiple regions and sectors.
Security Firms as Prime Targets
The attempted intrusion into SentinelOne reflects a growing trend: cybersecurity firms are becoming high-value targets for advanced persistent threats. These organizations possess unique visibility into threat landscapes, customer networks, and detection tools, making them attractive to adversaries seeking to bypass conventional defenses. Gaining insight into a security firm’s telemetry or toolset can enable attackers to better evade detection across future campaigns.
“China’s consistent use of advanced tradecraft and strategic targeting of security vendors like SentinelOne is not surprising,” said Heath Renfrow, CISO and co-founder at Fenix24. “It is an extension of their broader cyber-espionage doctrine, where compromising trusted nodes provides disproportionate leverage in downstream operations.”
The incident also raises key challenges for the industry, including how to secure sensitive partnerships, limit internal exposure, and maintain resilience against sophisticated supply chain attacks designed to avoid detection by even the most advanced monitoring systems.
Moving Forward: Cyber Resilience in the Face of Nation-State Threats
This incident reinforces the importance of resilience in an environment where nation-state actors are willing to invest time and resources to compromise strategic targets. Proactive monitoring, vendor scrutiny, and layered defense are now essential baseline practices. Security teams should also assess dependencies, conduct regular red-team exercises, and share intelligence with trusted partners across sectors.
“What’s needed is vigilance, strong defenses, and information sharing, just like this advisory,” said Casey Ellis, founder at Bugcrowd. Collaboration across private industry, government, and academia can help identify emerging tactics and reduce the window of opportunity for persistent threats. As cyber espionage continues to evolve, resilience will depend not only on technology but on agility, shared awareness, and collective preparation.
