Loading story…
Tajikistan approved a Chinese-funded project to build nine border facilities along its frontier with Afghanistan after a series of deadly attacks on Chinese nationals near the border. The project, valued at about $61 million and structured as a non-repayable grant from Beijing, includes observation posts, headquarters, equipment, roads, water, and power infrastructure, with Chinese engineers expected to install and configure technical systems. The move follows late-2025 violence in which an explosive drone strike hit a Chinese gold-mining company compound and gunmen attacked workers from the state-owned China Road and Bridge Corporation, prompting evacuations and suspension of highway construction in Darvaz.
Analysts cited in reporting assess ISKP as the most likely actor behind the attacks, although no group has claimed responsibility, and Tajik authorities said the operations originated from villages in Afghanistan’s Badakhshan province. The broader security context is a deteriorating Afghan-border threat environment in which militant infiltration, trafficking, and extremist mobilization can expand when state control weakens, a pattern Central Asia has experienced before through the Tajik-Afghan border and earlier incursions by the Islamic Movement of Uzbekistan. That regional backdrop helps explain why Dushanbe and Beijing are hardening frontier infrastructure as violence near the Afghan-Tajik border increasingly threatens Chinese personnel, investment, and cross-border stability.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Tajikistan's parliament approved a Chinese-funded plan to build nine border facilities along the Afghan frontier, expanding Beijing's security role in a sensitive border zone. The decision came amid escalating frontier violence and concern over attacks on Chinese nationals.
In late November 2025, two deadly attacks targeted Chinese personnel in Tajikistan near the Afghan frontier: a drone strike on the Shohin SM mining compound and a shooting involving China Road and Bridge Corporation workers. No group claimed responsibility, but analysts assessed ISKP as the most likely perpetrator.
The Islamic Movement of Uzbekistan renewed its Batken-area incursions in 2000, reinforcing concerns about persistent cross-border militant threats in Central Asia. The episode is cited as another precedent for how weak border security can enable regional destabilization.
The Islamic Movement of Uzbekistan carried out cross-border incursions into Kyrgyzstan's Batken region, demonstrating how militant instability south of Central Asia could penetrate the region. The attacks became a key historical example of regional spillover from Afghanistan-linked insecurity.
Trafficking networks moved Afghan opiates through Central Asia via the Northern Route, illustrating how instability to the south has historically spread through criminal and illicit transit channels rather than conventional invasion. The route became a longstanding regional security concern.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked threat activity was reported against both critical infrastructure in India and diplomatic targets in Europe, with researchers describing sustained espionage and pre-positioning operations rather than confirmed destructive attacks. Recorded Future’s Insikt Group said intrusions hit seven Indian State Load Dispatch Centers near the disputed Ladakh border, as well as India’s national emergency response apparatus and an Indian logistics subsidiary, using **ShadowPad** malware, compromised DVR/IP camera devices for command-and-control, and the **FastReverseProxy** tool. The activity was assessed as likely intended to establish access and collect intelligence inside India’s power sector. Separately, Proofpoint said China-aligned actor **TA416** increased operations against European diplomatic entities as Russia-Ukraine tensions escalated, including targeting a person involved in refugee and migrant services. The campaigns used web bugs to confirm active recipients before sending malicious links that ultimately deployed updated **PlugX** malware through ZIP archives, droppers, and DLL search-order hijacking. Proofpoint found substantial overlap between TA416 and the publicly reported **Red Delta** cluster, while Beijing publicly denied involvement in the India-related accusations and said it opposes cyberattacks.
Aug 15, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026
Taiwan's National Security Bureau reported a dramatic escalation in cyberattacks attributed to China, with incidents targeting the country's energy sector increasing tenfold in 2025 compared to the previous year. The overall number of cyber incidents linked to China grew by 6%, with critical infrastructure sectors such as energy, hospitals, emergency services, and banks being the primary targets. Attackers focused on exploiting hardware and software vulnerabilities, launching distributed denial-of-service (DDoS) attacks, conducting social engineering campaigns, and attempting supply-chain compromises. Notably, the energy sector, including petroleum, electricity, and natural gas companies, faced intensive probing of industrial control systems, with attackers seeking opportunities to inject malware during scheduled software upgrades. The frequency of these attacks averaged 2.6 million per day, and many were reportedly coordinated with Chinese military exercises and major political events, such as speeches or international visits by senior Taiwanese officials. The semiconductor industry, including companies like TSMC, was also among the targets. While the Chinese government has denied involvement, Taiwanese authorities emphasize the strategic nature of these cyber operations, which often coincide with periods of heightened political tension. The report underscores the persistent and evolving threat posed to Taiwan's critical infrastructure by state-sponsored cyber actors from China.
Jun 29, 2026