A cyber-spying operation traceable to China stole classified Indian security documents and obtained emails from the office of the Dalai Lama, according to an eight-month investigation.

Hackers misused online services, including Twitter, Google groups and Yahoo Mail. The companies' systems were not themselves compromised, but their services were used to send instructions to compromised computers, ultimately taking orders from servers based in Chongqing. Email addresses found by researchers could also be linked to individuals in nearby Chengdu.

The intruders penetrated dozens of high-level government networks, embassies and international organisations and stole confidential, sensitive and private documents, according to a report by US and Canadian researchers based at the Munk school of global affairs, at the University of Toronto.

The report, Shadows in the Cloud, stresses there is no evidence that China or any other government was involved in the cyber-spying network. But it adds: "An important question to be entertained is whether the People's Republic of China will take action to shut the Shadow network down."

It points out that the hackers may not have political motives and that it is possible another government is running a "false flag" spying operation.

It concludes that the network is probably run by individuals with ties to the Chinese criminal underworld, but that some of the information gathered may end up in the hands of some part of the Chinese state. Chinese foreign ministry spokesperson Jiang Yu said: "I don't know what evidence these people have, or what their motives are." She said China could investigate if it were provided with evidence, adding: "Our policy is very clear. We resolutely oppose all internet crime, including hacking."

The report comes shortly after Google closed its Chinese mainland-based search service, citing increased internet censorship and a Chinese-originated cyber-attack that targeted the emails of human rights activists as well as intellectual property.

The Toronto researchers, from the Information Warfare Monitor and Shadowserver Foundation, warn that organisations are increasingly dependent on the security of the bodies with which they exchange information, adding: "The vulnerabilities of one actor can quickly and unintentionally compromise unwitting third parties." Greg Walton of the foundation said the report was a wake-up call for governments and other bodies. While some states, including the UK, had already begun to take targeted malware attacks very seriously, others had been complacent, he said.

The UK intelligence and security committee's annual report for 2009-10, published last month, noted: "We have been told by GCHQ [the government communications centre] that the greatest threat of electronic attack to the UK comes from state actors, with Russia and China continuing to pose the greatest threat."

Walton said educating users was essential, adding that the attacks were effective not because they were particularly sophisticated in technical terms, but because of their "organisational sophistication and adaptive social engineering". Hackers knew whom to target and how to ensure they opened malware-laden emails.

Investigators used a range of techniques such as analysing malware samples and registering expired domain names previously used in attacks as command and control servers. This allowed them to monitor incoming connections from computers that had been compromised and collect information on both victims and the methods used by hackers. They also traced email addresses.

The researchers thought one hacker had links to the University of Electronic Science and Technology in Chengdu. A spokeswoman said the institution had not seen the report but was surprised by the claim. Investigators linked another hacker's account to a Chengdu resident, who told the New York Times: "That is not me … I'm a wine seller."

The network stole Indian government material including security assessments in sensitive regions and documents about the country's relationship with other nations. It also obtained reports on Indian missile systems by compromising the systems of independent analysts and took a year's worth of emails from the Dalai Lama's office. Personal information about individuals – including travel details and banking documents – was compromised.

"We have heard about the hacking report and the concerned department is looking into the case," Sitanshu Kar, spokesman for the Indian defence ministry, told Reuters.