Loading story…
Taiwan's National Security Bureau reported a dramatic escalation in cyberattacks attributed to China, with incidents targeting the country's energy sector increasing tenfold in 2025 compared to the previous year. The overall number of cyber incidents linked to China grew by 6%, with critical infrastructure sectors such as energy, hospitals, emergency services, and banks being the primary targets. Attackers focused on exploiting hardware and software vulnerabilities, launching distributed denial-of-service (DDoS) attacks, conducting social engineering campaigns, and attempting supply-chain compromises. Notably, the energy sector, including petroleum, electricity, and natural gas companies, faced intensive probing of industrial control systems, with attackers seeking opportunities to inject malware during scheduled software upgrades.
The frequency of these attacks averaged 2.6 million per day, and many were reportedly coordinated with Chinese military exercises and major political events, such as speeches or international visits by senior Taiwanese officials. The semiconductor industry, including companies like TSMC, was also among the targets. While the Chinese government has denied involvement, Taiwanese authorities emphasize the strategic nature of these cyber operations, which often coincide with periods of heightened political tension. The report underscores the persistent and evolving threat posed to Taiwan's critical infrastructure by state-sponsored cyber actors from China.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
After Taiwan publicly blamed Chinese state-linked actors for the 2025 campaign, the Chinese government denied involvement and accused Taiwan of similar hacking activity. The denial accompanied wider reporting on the surge in attacks against Taiwan's infrastructure.
By early January 2026, Taiwan said it had strengthened international cyber cooperation with more than 30 countries through intelligence sharing and joint investigations. The effort was presented as part of its response to the 2025 China-linked intrusion campaign.
In its public reporting on the 2025 activity, Taiwan's National Security Bureau attributed the campaign to groups including BlackTech, Flax Typhoon, Mustang Panda, APT41, and UNC3886. The bureau said the actors used vulnerability exploitation, DDoS, social engineering, adversary-in-the-middle, phishing, and supply-chain techniques.
Across 2025, many of the cyberattacks were timed to coincide with Chinese military exercises and major political moments in Taiwan. Activity reportedly peaked around significant events, including the anniversary of President Lai's inauguration.
In 2025, China-linked actors expanded operations beyond traditional government targets to telecommunications networks, semiconductor firms, and defense supply-chain partners. The campaigns sought to steal design documentation, strategic plans, sensitive technologies, and intelligence.
In 2025, hospitals in Taiwan were heavily targeted by China-linked cyber operations, including ransomware attacks and theft of medical data. Reports said at least 20 confirmed cases involved stolen patient information being sold on dark web forums.
During 2025, Taiwan's energy sector saw the sharpest escalation, with cyberattacks increasing tenfold compared with 2024. Attackers targeted industrial control systems and in some cases reportedly implanted malware during software upgrades to monitor operations.
Throughout 2025, Taiwan recorded an average of about 2.6 to 2.63 million daily cyber intrusion attempts attributed to China, a roughly 6% increase over 2024. The activity targeted nine critical infrastructure sectors, including energy, healthcare, communications, government, finance, and technology.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Taiwan’s National Security Bureau has reported a significant increase in cyberattacks and disinformation campaigns attributed to China, with government networks facing an average of 2.8 million intrusion attempts per day in 2025, marking a 17 percent rise from the previous year. Much of this activity targets critical infrastructure sectors such as defense, telecommunications, energy, and medical systems. Chinese operations combine cyber intrusions with coordinated information warfare, leveraging state media and organized online troll armies to spread fabricated content across social networks and forums. Over 10,000 abnormal social media accounts have been identified, disseminating more than 1.5 million pieces of disinformation, much of which attacks the Taiwanese government, promotes pro-China narratives, and seeks to undermine trust in the United States. These influence operations have increasingly used AI-generated memes and videos to amplify false narratives about sensitive issues, including tariff negotiations and domestic energy policies, as part of a broader strategy to shape public perception ahead of Taiwan’s 2026 local elections. The NSB describes these efforts as a state-level campaign designed to erode public trust in government institutions and deepen divisions within Taiwan’s democracy. In parallel, Poland has experienced a surge in cyberattacks linked to Russian actors, with Moscow’s military intelligence reportedly tripling its cyber resources targeting Polish infrastructure in 2025. Of the 170,000 cyber incidents recorded in Poland in the first nine months of the year, a substantial share was attributed to Russian state-backed groups, with daily incidents ranging from 2,000 to 4,000 and about 1,000 posing real threats to national security. Russian attackers have expanded their focus from utilities to the energy sector, and a major coordinated cyberattack on September 10 coincided with a Russian drone strike, representing the largest digital assault on Poland since 2022. Following this attack, Russian-linked bots reactivated dormant networks to spread disinformation blaming Ukraine, aiming to destabilize public trust. Both the Taiwanese and Polish cases illustrate a growing trend of state-sponsored cyber operations that blend technical intrusions with sophisticated influence campaigns. These operations are designed not only to compromise critical infrastructure but also to manipulate public opinion and undermine democratic processes. The use of AI and coordinated online activity has amplified the reach and impact of disinformation, making detection and response more challenging for targeted nations. The scale and persistence of these campaigns highlight the evolving threat landscape, where cyber and information warfare are increasingly intertwined. National security agencies in both countries have emphasized the need for heightened vigilance and international cooperation to counter these threats. The incidents underscore the importance of robust cyber defenses, real-time threat intelligence sharing, and public awareness initiatives to mitigate the risks posed by hostile state actors. As adversaries continue to innovate and escalate their tactics, defending against such multifaceted campaigns remains a top priority for governments and critical infrastructure operators worldwide.
Jul 12, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026
Hackers associated with China have gained unauthorized access to the IT networks of hundreds of small and medium-sized water utilities and other critical infrastructure providers across the United States. These intrusions are believed to be part of a broader strategy to position Chinese actors to sabotage American water and power supplies in the event of a geopolitical conflict, particularly if tensions escalate over Taiwan. U.S. officials have been aware of this threat for over two years, and recent reporting has brought renewed attention to the scale and persistence of these cyber operations. The targeted utilities are often located in rural areas and small towns, which typically lack the cybersecurity resources and expertise of larger metropolitan systems. The operational technology (OT) systems that control water treatment and distribution are especially vulnerable due to their increasing automation and remote accessibility. The risk is compounded by a significant resource gap, as many of these utilities struggle to defend against sophisticated nation-state threats. Efforts to bolster defenses have included the launch of two non-profit initiatives aimed at supporting critical infrastructure operators, but these programs face their own limitations. One of the non-profits has paused its activities to recalibrate its approach, while the other is only able to provide assistance in a limited number of states due to resource constraints. The threat underscores the broader challenge of protecting critical infrastructure in the United States, where many essential services are managed by small organizations with limited budgets. The potential for cyber sabotage of water and power systems raises concerns about the resilience of civilian infrastructure in the face of international conflict. U.S. government agencies have issued warnings and guidance to utilities, but implementation of robust security measures remains inconsistent. The situation highlights the need for increased investment in cybersecurity for critical infrastructure, particularly in rural and underserved areas. The ongoing threat from Chinese-linked hackers demonstrates the strategic importance of water and power utilities as potential targets in modern cyber warfare. The exposure of these vulnerabilities has prompted calls for greater public-private collaboration and federal support. The risk is not limited to water utilities, as other sectors of critical infrastructure may face similar threats from state-sponsored actors. The revelations serve as a wake-up call for the urgent need to address cybersecurity gaps in essential services. The possibility of coordinated attacks on infrastructure during a geopolitical crisis could have far-reaching consequences for national security and public safety. The current state of preparedness among small utilities is insufficient to counter the scale and sophistication of the threat. The situation remains dynamic, with ongoing efforts to assess and mitigate the risks posed by foreign cyber actors.
Jul 12, 2026