Infected university servers. Well, la-de-daa...
There's enough hard evidence Western universities are participating.
There are thousands of colleges and universities. But who cares if their servers are getting gradually getting zombied by Beijing.
Universities are the soft underbelly of the West. Security is incredibly lax for places that crank out computer majors and scientists on a regular basis. How often have I gotten a faculty site with unverified certs and IT says, "that's OK, just log in."
After doing that several times, new students just don't bother anymore. They sign into anything, they log into any wifi that looks plausible.