In collaboration with the International Consortium of Investigative Journalists (ICIJ), we identified what we conclude to be two distinct actors aligned with the People’s Republic of China. Our findings provide insight into the Chinese government’s practice of digital transnational repression and its shift to a system of state-sponsored attacks carried out by private contractors.