China-linked groups intensify attacks on Taiwan’s critical infrastructure, NSB warns

Taiwan says China-linked cyberattacks on its energy sector rose tenfold in 2025, hitting critical infrastructure across nine sectors and pushing total incidents up 6% year on year. National Security Bureau (NSB) reports that China launched an average of 2.63 million daily intrusion attempts in 2025 against these nine critical sectors, with energy and hospitals singled out as the most targeted.

The NSB analysis links the attacks to a broader pattern in which China’s cyber operations coincided with political and military activities, and notes peak activity in May 2025, the first anniversary of President Lai’s inauguration. China’s cyber army uses four main tactics—exploiting hardware and software vulnerabilities, distributed denial-of-service attacks, social engineering, and supply-chain compromises—with vulnerability exploitation accounting for over half of operations.

Groups including BlackTech, Flax Typhoon, Mustang Panda, APT41, and UNC3886 targeted Taiwan’s energy, healthcare, communications, government, and tech sectors, probing ICS and networks, deploying malware, and selling stolen data, with at least 20 cases confirmed in 2025. The NSB also highlights extensive cross-border cooperation, stating it established cybersecurity cooperation with over 30 countries worldwide in 2025.