The FBI and the department of homeland security are preparing to issue a warning that China’s most skilled hackers and spies are working to steal American research in the crash effort to develop vaccines and treatments for the coronavirus. The efforts are part of a surge in cybertheft and attacks by nations seeking advantage in the pandemic.

The warning comes as Israeli officials accuse Iran of mounting an effort in late April to cripple water supplies as Israelis were confined to their houses, though the government has offered no evidence to back its claim. More than a dozen countries have redeployed military and intelligence hackers to glean whatever they can about other nations’ virus responses.

Even American allies like South Korea and nations that do not typically stand out for their cyberabilities, like Vietnam, have suddenly redirected their state-run hackers to focus on virus-related information, according to private security firms.

A draft of the coming public warning, which officials say is likely to be issued in the days to come, says China is seeking “valuable intellectual property and public health data through illicit means related to vaccines, treatments and testing.”

It focuses on cybertheft and action by “non-traditional actors”, a euphemism for researchers and students the Trump administration says are being activated to steal data from inside academic and private laboratories.

The decision to issue a specific accusation against China’s state-run hacking teams, current and former officials said, is part of a broader deterrent strategy that also involves United States Cyber Command and the National Security Agency.

Under legal authorities that President Trump issued nearly two years ago, they have the power to bore deeply into Chinese and other networks to mount proportional counterattacks.

This would be similar to their effort 18 months ago to strike at Russian intelligence groups seeking to interfere in the 2018 midterm elections and to put malware in the Russian power grid as a warning to Moscow for its attacks on American utilities.

But it is unclear exactly what the US has done, if anything, to send a similar shot across the bow to the Chinese hacking groups, including those most closely tied to China’s new Strategic Support Force, its equivalent of Cyber Command, the ministry of state security and other intelligence units.

The forthcoming warning is also the latest iteration of a series of efforts by the Trump administration to blame China for being the source of the pandemic and exploiting its aftermath.

Secretary of state Mike Pompeo claimed this month that there was “enormous evidence” that the virus had come from a Chinese lab before backing off to say it had come from the “vicinity” of the lab in Wuhan.

US intelligence agencies say they have reached no conclusion on the issue, but public evidence points to a link between the outbreak’s origins at a market in Wuhan and China’s illegal wildlife trafficking.

The state department on Friday described a Chinese Twitter campaign to push false narratives and propaganda about the virus. Twitter executives have pushed back on the agency, noting that some of the Twitter accounts that the state department cited were actually critical of Chinese state narratives.

But it is the search for vaccines that has been a particular focus, federal officials say.

“China’s long history of bad behavior in cyberspace is well documented, so it shouldn’t surprise anyone they are going after the critical organisations involved in the nation’s response to the Covid-19 pandemic,” said Christopher Krebs, the director of the Cybersecurity and Infrastructure Security Agency.

He added that the agency would “defend our interests aggressively”.