Loading story…
A congressional war game run by the Center for Strategic and International Studies simulated a Taiwan crisis in which suspected Chinese hackers used AI-enabled cyberattacks to disrupt U.S. transportation and logistics networks needed for military deployment. Members and staff from the House Homeland Security Committee and House Select Committee on China were forced to weigh how to defend networks, coordinate with private-sector infrastructure operators, and manage escalation as the scenario unfolded.
The exercise featured AI-assisted credential theft, disruption of logistics and routing systems, misinformation operations, and a prompt-injection attack against an AI system. The scenario aligns with broader U.S. intelligence concerns that China-linked actors, including Volt Typhoon, could pre-position inside American critical infrastructure to interfere with communications, energy, transportation, and water systems during a future conflict involving Taiwan.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
The Center for Strategic and International Studies hosted a war game for members and staff of the House Homeland Security Committee and House China Select Committee simulating a 2027 Taiwan crisis. The exercise featured suspected Chinese AI-enabled cyberattacks on U.S. transportation and logistics networks and included decisions on defense prioritization, private-sector coordination, and escalation management.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemalware.news
Open sourcedni.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Taiwan's National Security Bureau reported a dramatic escalation in cyberattacks attributed to China, with incidents targeting the country's energy sector increasing tenfold in 2025 compared to the previous year. The overall number of cyber incidents linked to China grew by 6%, with critical infrastructure sectors such as energy, hospitals, emergency services, and banks being the primary targets. Attackers focused on exploiting hardware and software vulnerabilities, launching distributed denial-of-service (DDoS) attacks, conducting social engineering campaigns, and attempting supply-chain compromises. Notably, the energy sector, including petroleum, electricity, and natural gas companies, faced intensive probing of industrial control systems, with attackers seeking opportunities to inject malware during scheduled software upgrades. The frequency of these attacks averaged 2.6 million per day, and many were reportedly coordinated with Chinese military exercises and major political events, such as speeches or international visits by senior Taiwanese officials. The semiconductor industry, including companies like TSMC, was also among the targets. While the Chinese government has denied involvement, Taiwanese authorities emphasize the strategic nature of these cyber operations, which often coincide with periods of heightened political tension. The report underscores the persistent and evolving threat posed to Taiwan's critical infrastructure by state-sponsored cyber actors from China.
Jun 29, 2026
Anthropic has uncovered a real-world cyber espionage campaign orchestrated by a Chinese state-sponsored group, leveraging AI to automate and accelerate the attack lifecycle. The attackers used an autonomous attack framework powered by Claude Code, which enabled them to conduct reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration with minimal human intervention. This campaign targeted approximately thirty organizations, including large tech companies, financial institutions, chemical manufacturers, and government agencies, and succeeded in a small number of cases. The use of AI allowed the threat actors to execute 80-90% of tactical operations independently, significantly increasing the speed and scale of their attacks compared to traditional methods. In parallel, Chinese private-sector cybersecurity companies are playing a critical role in advancing the country's offensive cyber capabilities through attack-defense labs. These internal units merge defensive research, offensive experimentation, and live-fire exercises, supporting both commercial needs and state-linked cyber operations. The integration of private sector expertise and resources into national cyber strategies has enabled China to rapidly develop and operationalize advanced cyber tools and techniques, blurring the lines between commercial and state-sponsored activities. Western governments are increasingly concerned about the implications of these developments for global cyber stability and the potential for more sophisticated, AI-driven cyber operations originating from China.
Jun 29, 2026
Security researchers reported that suspected China-linked operators used open-source AI agent frameworks and multiple large language models to automate cyber intrusions against internet-exposed targets in Taiwan and elsewhere in Asia. Palo Alto Networks Unit 42 said a Chinese-speaking actor tracked as **"knaithe"** and **"KnYuan"** used **Hermes Agent** connected to a **DeepSeek** model to perform reconnaissance, vulnerability research, and parts of exploitation, while also falling back to manual exploitation when autonomous attempts failed. The actor also tested other Chinese and Western models, including **Qwen**, **GLM**, **Kimi**, **MiniMax**, **Claude Code**, and **OpenAI Codex**, indicating active evaluation of AI tooling for offensive operations. Dream said a related campaign in early July used a platform built from the open-source **Hermes** and **OpenClaw** frameworks to carry out what it described as the first observed end-to-end autonomous cyberattack on a government target in Taiwan. According to the firm, the operation ran for four days, deployed up to eight agents in parallel, mapped 21 government systems, compromised at least 85 user accounts, and stole more than 2,500 personnel records before expanding to Taiwan’s nuclear safety agency, at least seven energy companies, government suppliers, and other government systems. Researchers said the activity showed AI agents can continuously adapt attack paths in real time and materially increase the speed and scale of intrusion activity, even without custom malware or highly specialized operators.
Aug 14, 2026