Loading story…
Taiwan’s National Security Bureau has reported a significant increase in cyberattacks and disinformation campaigns attributed to China, with government networks facing an average of 2.8 million intrusion attempts per day in 2025, marking a 17 percent rise from the previous year. Much of this activity targets critical infrastructure sectors such as defense, telecommunications, energy, and medical systems. Chinese operations combine cyber intrusions with coordinated information warfare, leveraging state media and organized online troll armies to spread fabricated content across social networks and forums. Over 10,000 abnormal social media accounts have been identified, disseminating more than 1.5 million pieces of disinformation, much of which attacks the Taiwanese government, promotes pro-China narratives, and seeks to undermine trust in the United States. These influence operations have increasingly used AI-generated memes and videos to amplify false narratives about sensitive issues, including tariff negotiations and domestic energy policies, as part of a broader strategy to shape public perception ahead of Taiwan’s 2026 local elections. The NSB describes these efforts as a state-level campaign designed to erode public trust in government institutions and deepen divisions within Taiwan’s democracy. In parallel, Poland has experienced a surge in cyberattacks linked to Russian actors, with Moscow’s military intelligence reportedly tripling its cyber resources targeting Polish infrastructure in 2025. Of the 170,000 cyber incidents recorded in Poland in the first nine months of the year, a substantial share was attributed to Russian state-backed groups, with daily incidents ranging from 2,000 to 4,000 and about 1,000 posing real threats to national security. Russian attackers have expanded their focus from utilities to the energy sector, and a major coordinated cyberattack on September 10 coincided with a Russian drone strike, representing the largest digital assault on Poland since 2022. Following this attack, Russian-linked bots reactivated dormant networks to spread disinformation blaming Ukraine, aiming to destabilize public trust. Both the Taiwanese and Polish cases illustrate a growing trend of state-sponsored cyber operations that blend technical intrusions with sophisticated influence campaigns. These operations are designed not only to compromise critical infrastructure but also to manipulate public opinion and undermine democratic processes. The use of AI and coordinated online activity has amplified the reach and impact of disinformation, making detection and response more challenging for targeted nations. The scale and persistence of these campaigns highlight the evolving threat landscape, where cyber and information warfare are increasingly intertwined. National security agencies in both countries have emphasized the need for heightened vigilance and international cooperation to counter these threats. The incidents underscore the importance of robust cyber defenses, real-time threat intelligence sharing, and public awareness initiatives to mitigate the risks posed by hostile state actors. As adversaries continue to innovate and escalate their tactics, defending against such multifaceted campaigns remains a top priority for governments and critical infrastructure operators worldwide.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The Record reported that Taiwan's National Security Bureau disclosed an increase in cyber activity and disinformation efforts attributed to China. With no more specific timing in the reference, the event date is inferred from the publication date.
SC Media reported that Russian hackers were targeting Poland's infrastructure. The reference provides no additional incident details beyond the targeting claim, so the event date is inferred from the publication date.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Taiwan's National Security Bureau reported a dramatic escalation in cyberattacks attributed to China, with incidents targeting the country's energy sector increasing tenfold in 2025 compared to the previous year. The overall number of cyber incidents linked to China grew by 6%, with critical infrastructure sectors such as energy, hospitals, emergency services, and banks being the primary targets. Attackers focused on exploiting hardware and software vulnerabilities, launching distributed denial-of-service (DDoS) attacks, conducting social engineering campaigns, and attempting supply-chain compromises. Notably, the energy sector, including petroleum, electricity, and natural gas companies, faced intensive probing of industrial control systems, with attackers seeking opportunities to inject malware during scheduled software upgrades. The frequency of these attacks averaged 2.6 million per day, and many were reportedly coordinated with Chinese military exercises and major political events, such as speeches or international visits by senior Taiwanese officials. The semiconductor industry, including companies like TSMC, was also among the targets. While the Chinese government has denied involvement, Taiwanese authorities emphasize the strategic nature of these cyber operations, which often coincide with periods of heightened political tension. The report underscores the persistent and evolving threat posed to Taiwan's critical infrastructure by state-sponsored cyber actors from China.
Jun 29, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026
Multiple nation-state actors, including China, Russia, Iran, and North Korea, are intensifying cyber operations targeting critical infrastructure, government entities, and private sector organizations worldwide. China-linked groups such as Ink Dragon have expanded espionage campaigns against European governments, while Russia-linked actors like Callisto have targeted NGOs and are implicated in disruptive attacks in Europe. Iran's MuddyWater has focused on critical infrastructure in Israel and Egypt, and North Korea is increasing disruptive attacks on various sectors. These activities are accompanied by sophisticated cybercrime campaigns, exploitation of zero-day vulnerabilities, and significant data breaches affecting sectors such as health, telecommunications, and justice. In response, Western governments and institutions are taking legal and policy actions, including EU sanctions and fines, UK and Polish legal proceedings against Russian actors, and increased attribution of attacks to state-sponsored groups. However, there is growing concern that U.S. cyber defenses are lagging behind adversaries, with strained mission capacity, weakened public-private collaboration, and unstable federal leadership. Experts call for renewed strategic focus, improved coordination with allies, and robust policy reforms to counter the persistent and evolving threat landscape posed by hostile nation-states.
Jun 29, 2026