Loading story…
Recorded Future published research detailing how China could use cyber operations as part of coercion and potential invasion planning in cross-Strait relations, focusing on the role of cyber activity in pressure campaigns against Taiwan. The report frames cyber operations as a tool that can support broader strategic objectives, including disruption, signaling, and preparation of the information environment during periods of heightened tension.
The research describes China’s cyber activity as extending beyond espionage into operations that could enable military and political goals in a Taiwan contingency. It highlights how cyber capabilities may be integrated with coercive statecraft and conventional operations, underscoring the security implications for governments, critical infrastructure operators, and organizations exposed to cross-Strait instability.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Recorded Future published a research article titled "From Coercion to Invasion: The Theory and Execution of China’s Cyber Activity in Cross-Strait Relations." No additional incident-specific events are provided in the reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026
A congressional war game run by the Center for Strategic and International Studies simulated a Taiwan crisis in which suspected Chinese hackers used **AI-enabled cyberattacks** to disrupt U.S. transportation and logistics networks needed for military deployment. Members and staff from the House Homeland Security Committee and House Select Committee on China were forced to weigh how to defend networks, coordinate with private-sector infrastructure operators, and manage escalation as the scenario unfolded. The exercise featured AI-assisted credential theft, disruption of logistics and routing systems, misinformation operations, and a prompt-injection attack against an AI system. The scenario aligns with broader U.S. intelligence concerns that China-linked actors, including **Volt Typhoon**, could pre-position inside American critical infrastructure to interfere with communications, energy, transportation, and water systems during a future conflict involving Taiwan.
Jul 23, 2026
Taiwan’s National Security Bureau has reported a significant increase in cyberattacks and disinformation campaigns attributed to China, with government networks facing an average of 2.8 million intrusion attempts per day in 2025, marking a 17 percent rise from the previous year. Much of this activity targets critical infrastructure sectors such as defense, telecommunications, energy, and medical systems. Chinese operations combine cyber intrusions with coordinated information warfare, leveraging state media and organized online troll armies to spread fabricated content across social networks and forums. Over 10,000 abnormal social media accounts have been identified, disseminating more than 1.5 million pieces of disinformation, much of which attacks the Taiwanese government, promotes pro-China narratives, and seeks to undermine trust in the United States. These influence operations have increasingly used AI-generated memes and videos to amplify false narratives about sensitive issues, including tariff negotiations and domestic energy policies, as part of a broader strategy to shape public perception ahead of Taiwan’s 2026 local elections. The NSB describes these efforts as a state-level campaign designed to erode public trust in government institutions and deepen divisions within Taiwan’s democracy. In parallel, Poland has experienced a surge in cyberattacks linked to Russian actors, with Moscow’s military intelligence reportedly tripling its cyber resources targeting Polish infrastructure in 2025. Of the 170,000 cyber incidents recorded in Poland in the first nine months of the year, a substantial share was attributed to Russian state-backed groups, with daily incidents ranging from 2,000 to 4,000 and about 1,000 posing real threats to national security. Russian attackers have expanded their focus from utilities to the energy sector, and a major coordinated cyberattack on September 10 coincided with a Russian drone strike, representing the largest digital assault on Poland since 2022. Following this attack, Russian-linked bots reactivated dormant networks to spread disinformation blaming Ukraine, aiming to destabilize public trust. Both the Taiwanese and Polish cases illustrate a growing trend of state-sponsored cyber operations that blend technical intrusions with sophisticated influence campaigns. These operations are designed not only to compromise critical infrastructure but also to manipulate public opinion and undermine democratic processes. The use of AI and coordinated online activity has amplified the reach and impact of disinformation, making detection and response more challenging for targeted nations. The scale and persistence of these campaigns highlight the evolving threat landscape, where cyber and information warfare are increasingly intertwined. National security agencies in both countries have emphasized the need for heightened vigilance and international cooperation to counter these threats. The incidents underscore the importance of robust cyber defenses, real-time threat intelligence sharing, and public awareness initiatives to mitigate the risks posed by hostile state actors. As adversaries continue to innovate and escalate their tactics, defending against such multifaceted campaigns remains a top priority for governments and critical infrastructure operators worldwide.
Jul 12, 2026