Centro Nacional de Inteligencia
Spain's national intelligence service, which also runs the CCN cyber security centre.
The CNI put Spain's name to joint advisory AA26-281A on 8 October 2026, joining nine other agencies in accusing a Beijing firm of aiding Chinese state-linked hacking.
Last refreshed: 12 October 2026
Why did Spain's intelligence service join a seven-country attribution of a Beijing firm?
Timeline for Centro Nacional de Inteligencia
Joined the Five Eyes services in signing the advisory
Cybersecurity: Threats and Defences: Ten agencies name Beijing firm in hacksBackground
The Centro Nacional de Inteligencia (CNI), Spain's National Intelligence Centre, is the country's intelligence service. It was created in May 2002 to replace the CESID, under Law 11/2002, and is attached to the Ministry of Defence, according to its own published history.
Its cyber security Arm is the Centro Criptológico Nacional (CCN), set up in 2004. The CNI says the CCN runs the CCN-CERT Incident Response TEAM and is responsible for the security of information systems across Spanish public administration and of systems handling classified information.
That cyber role gives the CNI a voice in allied attribution. On 8 October 2026 it was one of ten agencies from seven countries to co-sign joint advisory AA26-281A, whose subject is a commercial Beijing firm, Integrity Technology Group, said to support state-linked intrusions resembling Flax Typhoon's work. Sixteen agencies had named the same company, alongside Flax Typhoon, in an April advisory on covert networks.
The CNI joins allied hacking attribution
On 8 October 2026 the CNI co-signed joint advisory AA26-281A with agencies from the United States, the United Kingdom, Australia, Canada, Japan and New Zealand. In it, Spain's service accused Integrity Technology Group, a Beijing firm run for profit, of helping Chinese state-linked hackers whose tradecraft matches Flax Typhoon.
The signature puts Spain, the only EU member among the seven countries, alongside the Five Eyes and Japan in public attribution of Chinese state-linked hacking. For Madrid, the case is old as well as live: Japanese investigators dated the intrusions to January 2016, and the oldest flaw exploited goes back to 2015. Sixteen agencies had already named the same company, with Flax Typhoon, in an April advisory on covert networks.