Iran offers China a huge espionage opportunity. You can bet they’re using it

Iran’s current turmoil could be an intelligence windfall for China. As Tehran’s security leadership is decapitated and its cyber capabilities become an Israeli target, Beijing can extract operational lessons, deepen surveillance, and expand its regional influence.

Moments of crisis inside rival intelligence systems create rare opportunities for leverage. China has exploited these opportunities before, and will likely do so again.

The Iran-China intelligence relationship has always been opaque. But in 2009, a piece of malware jointly-authored by the US and Israel damaged thousands of nuclear centrifuges at Iran’s Natanz uranium enrichment plant. Humiliated by the precision of the cyber operation, Iranian authorities began compiling a list of informants on the inside.

What followed was one of the worst counterintelligence failures in CIA history. At the time, the CIA relied on an unsecured comms system, meant for short-term use in hostile environments in Iran and China. After the Natanz debacle, the Ministry of State Security (China’s foreign intelligence service) began pulling CIA informants and detaining them.

Many were executed. The CIA’s networks in Iran were blown at the same time. The MSS had penetrated its comms system and US authorities suspected that one intelligence service had tipped off the other. American intelligence suffered a generational setback. The collapse of both networks suggested that Beijing was not only observing Tehran’s crisis, but benefiting from it.

China’s counterintelligence capabilities today are even more formidable. Hacking campaigns such as Volt Typhoon, which compromised US naval logistics hubs, and the ongoing Salt Typhoon intrusions into American telecommunications firms and even Congressional staffers illustrate the scale of Beijing’s cyber reach.

These operations are not only about espionage. They are increasingly designed to shape political and military perceptions. And now, with Iran’s crisis, Beijing faces two strategic opportunities.

The first is in operational access and covert learning. A protracted conflict is degrading Iran’s conventional military capabilities, forcing it to rely more heavily on cyber operations. Before, Iran’s cyber capabilities were closely tied to the Ministry of Intelligence and the Iranian Revolutionary Guard Corps, whose senior leadership has now been killed.

China’s sprawling ecosystem of contracted hackers, often operating at arm’s length from the state, could collaborate with Iranian cyber actors. It could also exploit the confusion through “masked” attacks designed to obscure who is responsible. At the same time, Israel’s preparation for Operation Epic Fury – hacking Tehran’s CCTVs, bugging the phones of political elites, and infiltrating popular prayer apps – will be instructive for planners in Beijing for a Taiwan contingency, whether it takes place next month or next year.

The second is political and technological influence. After the October 7 attacks, Beijing appeared to have lost diplomatic clout in the Middle East. Now, Iran’s destabilisation offers China the opportunity to pull Tehran and other regional partners closer to its orbit. China can offer surveillance infrastructure, digital governance tools, and deeper intelligence cooperation without the military commitment that would antagonise Washington. By presenting itself as a mediator and trusted interlocutor, Beijing can expand its regional influence while preserving strategic flexibility.

This dual track reflects China’s broader approach to great power competition. Cyber power is not only about disruption, but about shaping perceptions of reliability and stability. In a destabilised Gulf in which the US has yet to supply a clear definition of victory – one with which Israel may not align – such perceptions matter even more, especially for European allies exposed to regional instability and technological influence.

China has long understood that its great rivalry with the US is really about trust. Competition between great powers often turns on moments of weakness in rival systems. Iran’s current vulnerability may prove to be one such moment, and Beijing is unlikely to let it pass.

Dr Ahana Datta Fasel is the author of the forthcoming ‘Full Stack Spies: Cyber Espionage in the Age of US-China Competition’. She previously was a UK Government cyber leader and the Financial Times’ cyber chief.