The attack targeted Microsoft Exchange servers, affecting at least 30,000 organisations globally.
Western security services believe it signals a shift from a targeted espionage campaign to a smash-and-grab raid, leading to concerns Chinese cyber-behaviour is escalating.
The Chinese Ministry of State Security (MSS) has also been accused of wider espionage activity and a broader pattern of "reckless" behaviour.
China has previously denied allegations of hacking and says it opposes all forms of cyber-crime.