“North Korea has been a constant threat in terms of missiles and nuclear weapons,” said Cheng Xiaohe, an associate professor of international relations at Renmin University. “All of a sudden, it poses a cyber threat.”
Amid these tensions, Beijing is not eager to call attention to its deteriorating relations with its longtime ally. North Korea’s missile launch took place hours before Mr. Xi addressed an international gathering in Beijing to promote China’s “One Belt, One Road” project — an enormous infrastructure undertaking that is expected to build projects in Asia, Europe and Africa.
Even though the timing of the launch suggested it was a deliberate ploy to embarrass Mr. Xi at an inopportune time, it was not reported in the Chinese state media.
Regarding the ransomware attack, China analysts say Beijing will hesitate before directly casting blame on North Korea even if evidence, still inconclusive, directly ties the North to the attack. Beijing is more likely to single out other actors, particularly the United States, experts say.
The attack took advantage of vulnerabilities in Microsoft Windows software through a tool stolen from the United States’ National Security Agency. That plays into broader Chinese concerns about its overreliance on American software.
Initially, the North Korean government viewed the internet as a threat. But in the early 1990s, a group of computer experts returned from China with the idea of using the web to take secrets and attack government enemies, according to one defector.
Since then, North Korean hackers have attended schools in China and used it as a staging ground for attacks. As North Korea devoted more resources to those efforts — eventually selecting child math prodigies for training and assembling an army of more than 6,000 — it established a large outpost for its secretive hacking unit in China.
Security analysts say North Korean hackers operate out of hotels, restaurants and internet cafes in northeastern Chinese cities like Shenyang and Dandong, which are outposts for trade with North Korea. Though many still operate in China, North Korean hackers have increasingly moved further afield, to countries in Southeast Asia, where government surveillance and control is less strict.
The moves are also intended to protect cyberattack options in the event of a war on the Korean Peninsula. Security analysts say some attacks are also carried out from North Korea, but are limited by the fact that the country has only one main portal to the internet, through China’s state telecom operator China Unicom.
Despite evidence suggesting a North Korean role in the ransomware attack, the most common reaction among experts and on Chinese social media was to blame the United States.
“Many criticized the U.S. government, saying that it was responsible for this spread of ransomware. Obviously this accusation is reasonable,” the editor in chief of state-run Global Times wrote in a prominent commentary on Monday.
“Attacks always happen,” said Chen Zhong, a professor in computer science at Peking University. “What catches our eyes this time is that the attack used a tool that leaked from the N.S.A.,” he said.
On the social media site Weibo, users almost uniformly blamed the United States for the attack.
“Since North Korea started its nuclear program in 2006, China-North Korea relations have gradually deteriorated, and are currently at an abnormal level. If we add another virus, the image of North Korea in the eyes of China will be even worse.”
China’s news organizations, both state-run and private, reported on the hacking attacks, as well as the possible links to North Korea, hours after it occurred, but they did so in a controlled fashion that was confined to inside pages of newspapers, and played in modest ways on websites.
Still, several news portals wrote that cybersecurity firms like Kaspersky Lab had found initial evidence that pointed to North Korea. The news portal Sina pointed to previous attacks – in Bangladesh, against Sony and the South Korean subway – that may have originated from the North.
Over the years, North Korea has flooded northeastern China with counterfeit $100 bills of American currency. It has also mass manufactured counterfeit Chinese renminbi, but China says little about the problem.
This year, South Korea accused the North of assassinating the half brother of the North Korean leader, Kim Jong-un, at the international airport in Kuala Lumpur, the capital of Malaysia. The relative, Kim Jong-nam, was considered a friend of China and he had lived in the Chinese-controlled territory of Macau, where he was protected by state security.
Chinese state-run media reported on the killing but refrained from associating Mr. Kim, the half brother, with China.
In 2013, an uncle of Kim Jong-un, who was the main financial conduit between China and the North, was executed by a firing squad that used antiaircraft guns, according to South Korea’s National Intelligence Service.
South Korean intelligence said the killing of the uncle, Jang Song-thaek, was ordered by Mr. Kim as he was consolidating power over North Korea. His death meant that China lost its most important interlocutor with the North, and was an early signal from Mr. Kim that under his rule relations between China and North Korea would not be business as usual. But China withstood the insult without public recrimination.