China’s Grey Zone Playbook: Salt Typhoon, EO 14420 & Iran’s BeiDou Pivot

Key Judgments

• CONFIRMED: Executive Order 14420, signed August 26, 2026, declares a national emergency and gives the US Department of Energy authority to bar foreign-sourced bulk-power equipment – transformers, inverters, energy storage systems, and industrial control systems (ICS/PLCs/RTUs) – from named foreign adversaries, explicitly including China.
• ASSESSED: EO 14420 is the clearest US government policy confirmation to date of a threat pattern CommandEleven’s platform has tracked in advance of formal executive action. Our ASEAN cyber-espionage series and South China Sea surveillance assessment – published on this platform in the weeks preceding the order – documented the same actors, the same infrastructure-targeting logic, and in several cases the same specific intrusion techniques the order now cites as justification for federal action.
• CONFIRMED: Iran has migrated from GPS to China’s BeiDou-3 satellite navigation system for missile and drone guidance since the 2025–2026 conflict, with reported operational gains including sub-5-meter circular error probable and long-range short-message re-tasking of airborne platforms.
• ASSESSED, not CONFIRMED: whether BeiDou use by Iran reflects active Chinese coordination or targeting assistance, versus passive infrastructure access. Modern navigation receivers can draw on multiple satellite constellations; usage alone is not proof of direct assistance. This distinction is analytically important and is maintained throughout this dossier.
• SPECULATIVE, single-source: CommandEleven has received signaling, via a single MSS-linked channel, suggesting President Xi Jinping may pursue a move on Taiwan before leaving office, tied to legacy considerations. This is explicitly excluded from the Key Judgments above the line and is addressed separately with full sourcing caveats.

China as the Series’ Dual-Role Actor

Of the four nations profiled across this series, China is the only one whose grey-zone posture spans both of the series’ two most consequential framework terms at once. Where Russia (Part III) leans into Deniability/Proxy Warfare, Iran (Part IV) into the same term via a different mechanism, and North Korea (Part V) into Kinetic Gate, China occupies Cyber-Kinetic Convergence – through sustained infrastructure intrusion – and Kinetic Gate/Deniability – simultaneously, through calibrated technology transfer that lets a proxy conflict serve as a live proving ground for Chinese systems without direct Chinese involvement.

That dual posture is what makes this chapter unusually rich for analysts and policymakers alike: the infrastructure-intrusion material connects directly to domestic US critical-infrastructure policy, while the BeiDou material connects directly to the ongoing US-Iran war covered elsewhere in this series (Part III, Part IV). Few single actors let a reader move between a domestic executive order and an active regional war using the same underlying intelligence picture.

Cyber-Kinetic Convergence: Critical Infrastructure Intrusion and EO 14420

On August 26, 2026, President Trump signed Executive Order 14420, declaring a national emergency with respect to the US bulk-power system. The order:

• Gives the Department of Energy authority to prohibit the acquisition, importation, transfer, or installation of foreign-produced bulk-power equipment – transformers, inverters, energy storage systems, and industrial control systems including remote terminal units (RTUs), programmable logic controllers (PLCs), and associated firmware and remote-access capability – where the transaction involves a designated foreign adversary and poses an unacceptable security risk.
• Names China explicitly among the designated adversary nations, alongside Russia, Iran, and North Korea.
• Covers transactions initiated after August 26, 2026; the Department of Energy has 120 days to publish implementing rules.
• Is explicitly grounded in prior CISA reporting: more than 100 water and wastewater systems compromised via PLCs in the past year, and a separate CISA warning specifically naming Iran-affiliated activity targeting internet-connected operational technology.

The CommandEleven Predictive Analysis

This order did not emerge from nowhere, and CommandEleven’s own published record shows the platform was tracking the underlying threat pattern well ahead of the policy response:

• Chinese Cyber Attacks Against Western Critical Infrastructure – a more direct match to EO 14420’s own framing than any single ASEAN piece; this should be the lead citation for this section given its explicit Western-infrastructure focus
• ASEAN Cyber Espionage Landscape: Cyber-Kinetic Convergence and Industrialized Intrusion Vectors – the platform’s own prior use of the exact “Cyber-Kinetic Convergence” framework term applied to this actor; the strongest single link-back for establishing the term’s continuity of use
• Mustang Panda CoolClient Evasion Framework Forensics – direct technical forensics on Mustang Panda’s evasion tooling, a stronger primary citation than referencing Mustang Panda only in passing within the broader ASEAN ecosystem pieces below
• ASEAN Cyber Espionage & Critical Infrastructure Penetration – documents Salt Typhoon’s use of kernel-level implants engineered specifically for enterprise routing hardware (Cisco IOS, Huawei VRP), including firmware-level persistence designed to survive reboots and administrative resets – precisely the class of ICS/firmware compromise EO 14420 is now structured to prevent at the point of hardware acquisition
• ASEAN Cyber Espionage Ecosystems & Sub-Sea Interception and ORB Botnets & Edge Appliance Exploitation in ASEAN – document the shift by Mustang Panda and associated clusters away from rented commercial infrastructure toward Operational Relay Box (ORB) networks built on compromised edge devices, the same edge-appliance exposure EO 14420’s ICS/RTU/PLC language targets
• ASEAN Cyber Espionage Topologies & APT TTPs Analysis – maps the broader PRC-linked APT ecosystem (Mustang Panda/TA416, Naikon, UNC4191) against ASEAN government, defense, and energy infrastructure targets
• Cyber Intelligence Report: Global C2 Exploitation of Telecom Networks – broadens the picture beyond ASEAN to global telecom C2 infrastructure, directly relevant to Salt Typhoon’s telecom-sector targeting pattern

Read together, this four-part series – published on the CommandEleven platform in the weeks before EO 14420 – describes the same intrusion logic, the same category of hardware exposure, and in some cases the same threat actors the executive order now names by policy.

For analysts tracking CommandEleven’s predictive record, this is a citable instance of it, not an assertion of one.

Grey Zone Interdiction Zone: South China Sea

China’s maritime posture in the South China Sea remains the clearest single illustration of the Grey Zone Interdiction Zone concept in the series – sustained pressure on a strategic chokepoint, applied through means (maritime militia, sensor grids, coast guard presence) calibrated to avoid formally contesting sovereignty or triggering a collective-defense response.

• South China Sea Surveillance: PRC Sensor Grids, Maritime Militia Architecture, and Allied ISR Counter-Postures – CommandEleven’s technical assessment of PRC sensor-grid deployment, maritime militia patterns, and allied ISR counter-postures across the theater, including coverage of the Escoda Shoal blockade and the geomorphological transformation of Antelope Reef as part of China’s broader maritime denial strategy
• South China Sea C4ISR: Sensor Topologies, Multi-Domain Radar Grids, Undersea Acoustic Networks, and Kill-Chain Target Acquisition – a deeper technical companion to the surveillance piece above, focused specifically on kill-chain target acquisition architecture
• Sabina Shoal Standoff: Allied Tactical Data Links – a specific incident case study (the Sabina Shoal standoff) that grounds the broader sensor-grid material in a concrete, named event
• Subsea Cable Vulnerability and Data Interdiction Axis – extends the Grey Zone Interdiction Zone concept beyond surface/maritime militia activity into subsea cable infrastructure specifically, directly reinforcing Part I’s framing of infrastructure (cables included) as the series’ common target set

This section of the dossier draws directly on these existing assessments rather than restating them – readers seeking the full technical picture of PRC sensor architecture, kill-chain acquisition, and subsea cable exposure should treat the linked reports as the primary reference, with this dossier providing the grey-zone framework context around them.

Kinetic Gate / Deniability: BeiDou and the Iran Proving Ground

Iran’s abandonment of GPS in favor of China’s BeiDou-3 satellite navigation system is the chapter’s clearest Deniability/Proxy Warfare case study, and its most direct link to the active war covered in Parts III and IV of this series.

• Following GPS jamming that disrupted Iranian drone and missile guidance during the 2025 conflict, Iran migrated its missile and drone guidance architecture to BeiDou-3’s military-tier B3A signal – reported by multiple defense analysts as effectively unjammable under current Western electronic-warfare capability.
• The BeiDou short-message communication feature reportedly allows real-time re-tasking of drones and missiles at range, an operationally significant capability improvement over GPS-only guidance.
• Reported effect: Iranian missile circular error probable has reportedly fallen to under five meters, a substantial precision gain analysts have tied directly to the BeiDou migration.

Framing this as “war as proving ground”

China gains real-world combat performance data on its own satellite architecture, under contested electronic-warfare conditions, without any direct Chinese military involvement in the conflict generating that data. This is Deniability/Proxy Warfare operating through infrastructure access rather than through arms transfer or troop deployment – a distinct mechanism from the proxy relationships profiled in Parts III and IV, and worth reading as a companion case to both.

Tradecraft note: this dossier maintains the distinction between confirmed usage (Iran is using BeiDou) and confirmed coordination (China is actively assisting Iranian targeting through it) throughout. The former is well-supported by multiple independent sources; the latter remains an analytical inference, not an independently confirmed fact, and is tiered ASSESSED accordingly.

CommandEleven Dossiers:

China’s Iran 2026 Attrition Strategy – CommandEleven’s existing assessment of how Beijing is positioned relative to the current war, directly underpinning the “war as proving ground” framing above; readers seeking the full strategic picture of China’s attrition-strategy calculus toward Iran should treat this as the primary reference.

Boxed Item , Taiwan / Xi Legacy Signal (SPECULATIVE, Single-Source)

This item is explicitly excluded from the Key Judgments above and from the trajectory assessment

CommandEleven has received signaling through a single MSS-linked channel suggesting President Xi Jinping may pursue a move on Taiwan before leaving office, framed around legacy considerations. This has not been corroborated by any other line of reporting available to CommandEleven.

Context for the reader, not corroboration of the claim:

• The “legacy before he leaves office” framing is not new – it has been a standard feature of open-source China-watching analysis since at least Xi’s 2022 third-term consolidation, not a novel insight from this channel.
• The most commonly cited public benchmark – that the PLA has been instructed to be ready for a Taiwan operation by 2027 – traces to a 2023 public statement by then-CIA Director William Burns. The CIA has stated publicly that it has not identified a confirmed specific timeline.
• Countervailing open-source analysis published in 2026 argues that Xi’s recent internal purges have plausibly pushed any such timeline back rather than forward.

CommandEleven’s own editorial standard requires that single-source claims touching current leadership intent or military posture be re-verified before any higher-confidence framing is applied. As of this dossier’s drafting, that verification has not occurred. This item is presented as a named, dated signal for reader awareness – consistent with how this series treats the unverified Moscow-embassy claim in Part III – not as an analytical judgment.

Assessment: 12–24 Month Trajectory

Near-term (0–6 months): EO 14420 implementation becomes the first hard test of the policy response.

• The Department of Energy has 120 days from signature – to approximately December 24, 2026 – to publish implementing rules. This window is the single most concrete near-term milestone in this chapter.
• ASSESSED: implementation will likely surface friction between the order’s stated intent and the practical difficulty of auditing embedded firmware and ICS supply chains at scale, a gap CommandEleven’s own ASEAN reporting has already documented at the technical level (firmware persistence surviving reboot and administrative reset). Watch for whether DOE’s rules address firmware-level compromise specifically, or focus primarily on point-of-acquisition hardware sourcing – the two require materially different enforcement mechanisms.

Near-term (0–6 months):

• The BeiDou-Iran relationship will be shaped directly by how the current war resolves.
• ASSESSED: if the US-Iran conflict moves toward a durable ceasefire, expect reduced real-world testing volume for Iranian BeiDou-guided systems, but no reversal of the underlying migration – the strategic logic (reducing dependence on US-controlled infrastructure) outlasts any single conflict. If the conflict instead re-escalates, expect continued refinement of Iranian precision-strike doctrine and further open-source reporting on BeiDou’s operational performance under contested electromagnetic conditions, which will itself generate more data for this framework term.

Medium-term (6–18 months):

• South China Sea sensor-grid and maritime militia activity continues on its existing trajectory absent a triggering event.

• ASSESSED, low uncertainty: this is the most structurally stable of the chapter’s three threads – China’s posture here has been consistent for years and nothing in current reporting suggests a near-term inflection. The main analytical value over this window is incremental: tracking specific chokepoint activity (as CommandEleven’s linked South China Sea assessment already does) rather than anticipating a strategic shift.

Medium-term (12–24 months):

The Taiwan/MSS signal remains an unresolved watch item, not a forecast.

This dossier does not project a timeline for Taiwan-related action. The single-source signal referenced in Section 6 should be treated as exactly that – a signal to monitor for independent corroboration – not as a basis for a trajectory judgment. Any future installment that elevates this item to CONFIRMED or ASSESSED status should do so only on the strength of independent corroboration obtained between now and then, not on the passage of time alone.

Cross-cutting judgment

China’s grey-zone posture across all three threads in this chapter shares one structural feature worth carrying into Part VI’s synthesis – each thread (infrastructure intrusion, BeiDou/Iran, South China Sea) advances Chinese strategic position through other actors’ crises or other actors’ infrastructure decisions rather than through direct Chinese action. That pattern is the chapter’s clearest throughline and the strongest argument for why Cyber-Kinetic Convergence and Kinetic Gate/Deniability are both genuinely load-bearing for this actor, rather than one being the “real” story and the other decorative.

GREY ZONE WARFARE SERIES

PART I – Grey Zone Warfare Explained: The Framework Behind China, Russia, Iran & North Korea

PART II – China’s Grey Zone Playbook: Salt Typhoon, EO 14420 & Iran’s BeiDou Pivot

PART III – Russia’s Grey Zone Hub: North Korea, China & the Iran Weapons Pipeline

PART IV – Iran’s Proxy Empire: The Axis of Resistance and the Grey Zone Playbook

PART V – North Korea’s New Threat: ICBMs, Japan, and the Homeland Reclassification

PART VI – Grey Zone Warfare Synthesis: How China, Russia, Iran & North Korea Connect