Loading story…
Taiwan used its Han Kuang military exercises to carry out its first deliberate mobile internet blackout simulation, cutting public 4G and 5G download speeds to about 1% of normal capacity for 30 minutes in Taipei and other parts of northern Taiwan while keeping voice calls and SMS available. A similar drill was also conducted in central Taiwan, with officials framing the exercise as a test of civilian readiness for communications disruption during a cyberattack, natural disaster, or potential conflict scenario.
The exercise highlighted Taiwan’s exposure to digital disruption, including reliance on 14 international submarine cables, the 2023 Matsu cable-cutting incident that left residents without internet for weeks, and heavy cyber pressure that averaged 2.63 million intrusion attempts per day in 2025 against targets such as power grids, hospitals, and high-tech industrial parks. Reports said the drill had clear limits: it was brief, announced in advance, left fixed-line and Wi‑Fi access untouched, and did not cover southern and eastern regions that host critical semiconductor and naval infrastructure.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
On August 13, 2026, Taiwan carried out its first deliberate mobile internet blackout simulation during the Han Kuang exercises, throttling public 4G and 5G speeds to about 1% of normal for 30 minutes in Taipei and other parts of northern Taiwan. Phone calls and SMS remained available while bandwidth-heavy services were disrupted.
On August 10, 2026, Taiwan conducted a mobile internet throttling exercise in central Taiwan ahead of the broader Han Kuang drill activity. The exercise was described as similar to the later northern Taiwan test.
On August 6-7, 2026, Taiwan held an urban resilience exercise in Kaohsiung and Pingtung that combined tabletop and practical drills for evacuation, sheltering, emergency supply distribution, critical infrastructure protection, and civil-military coordination. The exercise also included hospital continuity measures such as underground medical operations, backup command procedures, and medical evacuation under disrupted utility conditions.
Taiwan's National Security Bureau reported that the island experienced an average of 2.63 million intrusion attempts per day in 2025. The reported activity targeted critical infrastructure including power grids, hospitals, and high-tech industrial parks.
In February 2023, the only two submarine cables serving Taiwan's Matsu archipelago were severed six days apart, leaving residents without internet access for several weeks. Taiwan suspected two Chinese vessels were involved, though the reporting cited no evidence the cuts were intentional.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
thediplomat.com
Open sourcecyberveille.ch
Open sourcestraitstimes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Taiwan's National Security Bureau reported a dramatic escalation in cyberattacks attributed to China, with incidents targeting the country's energy sector increasing tenfold in 2025 compared to the previous year. The overall number of cyber incidents linked to China grew by 6%, with critical infrastructure sectors such as energy, hospitals, emergency services, and banks being the primary targets. Attackers focused on exploiting hardware and software vulnerabilities, launching distributed denial-of-service (DDoS) attacks, conducting social engineering campaigns, and attempting supply-chain compromises. Notably, the energy sector, including petroleum, electricity, and natural gas companies, faced intensive probing of industrial control systems, with attackers seeking opportunities to inject malware during scheduled software upgrades. The frequency of these attacks averaged 2.6 million per day, and many were reportedly coordinated with Chinese military exercises and major political events, such as speeches or international visits by senior Taiwanese officials. The semiconductor industry, including companies like TSMC, was also among the targets. While the Chinese government has denied involvement, Taiwanese authorities emphasize the strategic nature of these cyber operations, which often coincide with periods of heightened political tension. The report underscores the persistent and evolving threat posed to Taiwan's critical infrastructure by state-sponsored cyber actors from China.
Jun 29, 2026
A congressional war game run by the Center for Strategic and International Studies simulated a Taiwan crisis in which suspected Chinese hackers used **AI-enabled cyberattacks** to disrupt U.S. transportation and logistics networks needed for military deployment. Members and staff from the House Homeland Security Committee and House Select Committee on China were forced to weigh how to defend networks, coordinate with private-sector infrastructure operators, and manage escalation as the scenario unfolded. The exercise featured AI-assisted credential theft, disruption of logistics and routing systems, misinformation operations, and a prompt-injection attack against an AI system. The scenario aligns with broader U.S. intelligence concerns that China-linked actors, including **Volt Typhoon**, could pre-position inside American critical infrastructure to interfere with communications, energy, transportation, and water systems during a future conflict involving Taiwan.
Jul 23, 2026
U.S. congressional testimony and a recent report from the U.S.-China Economic and Security Review Commission have highlighted growing concerns over China's development of advanced technologies and strategies to target undersea communications cables. These cables are critical infrastructure, carrying the vast majority of global internet traffic, and are increasingly seen as vulnerable to both physical and cyber threats. The testimony and report emphasize that new Chinese innovations, such as the AJX-002 undersea drone and deep-sea cable cutting devices, have made it technologically feasible for state actors to launch coordinated attacks on multiple cables, potentially disrupting communications for entire regions like Taiwan. The U.S. is currently ill-prepared to rapidly repair or replace damaged cables due to regulatory and logistical challenges, underscoring the urgent need for policy reform and enhanced protection measures. The Commission's report details that Chinese military-affiliated research institutions have developed and patented devices capable of severing armored cables at depths exceeding 13,000 feet. Real-world incidents have already been observed, including Chinese vessels damaging cables near Taiwan and in the Baltic Sea, with one notable case involving a ship dragging its anchor and severing two major cables in November 2024. The report warns that in the event of a conflict, particularly over Taiwan, the Chinese military is expected to target undersea cables to isolate the island. These developments represent a significant escalation in the threat landscape for global communications infrastructure, prompting calls for immediate action to strengthen the resilience and security of undersea cable networks.
Jun 29, 2026