AI Cyberwarfare Programs in East Asia: A Rising Threat Landscape

Introduction

As of March 2026, cybercriminal activities in East Asia have evolved significantly, with artificial intelligence (AI) playing a pivotal role in enhancing the sophistication and scale of cyberattacks. This briefing examines the integration of AI into cybercriminal operations, focusing on national AI cyber programs, military AI offensive tools, AI-integrated advanced persistent threat (APT) operations, and autonomous cyber weapons doctrine within the region.

National AI Cyber Programs

In response to escalating cyber threats, East Asian nations have been developing and deploying AI-driven cybersecurity measures. For instance, South Korea's Cyber Operations Command has initiated the deployment of AI-based defense platforms to counteract the increasing use of AI by threat actors. However, challenges such as gaps in cyber infrastructure and workforce readiness hinder the full-scale implementation of these measures. (cyberproof.com)

Military AI Offensive Tools

The integration of AI into military cyber capabilities has been a focal point for East Asian countries. China, for example, has developed an extensive cyber warfare apparatus, reportedly operating over 210 state-backed hacker units. These units are equipped with AI-enhanced tools capable of conducting sophisticated cyber operations, including espionage and disruption campaigns targeting critical infrastructure. (visiontimes.com)

AI-Integrated APT Operations

Advanced Persistent Threats (APTs) in East Asia are increasingly incorporating AI to enhance their operational effectiveness. Chinese-speaking APT24 Group, for example, has employed AI-driven malware like BadAudio in a three-year espionage campaign. This malware was delivered through various methods, including phishing and supply chain attacks, and utilized AI to adapt to and evade detection mechanisms. (ics-cert.kaspersky.com)

Autonomous Cyber Weapons Doctrine

The development and deployment of autonomous cyber weapons are emerging as a significant concern in East Asia. The concept of Highly Autonomous Cyber-Capable Agents (HACCAs) has been introduced, referring to AI systems capable of autonomously conducting multi-stage cyber campaigns without meaningful human direction. These agents could potentially lower the barrier to entry for sophisticated cyber operations, allowing less-resourced state actors and criminal groups to execute advanced attacks. (arxiv.org)

Conclusion

The integration of AI into cybercriminal operations in East Asia represents a significant escalation in the region's cyber threat landscape. While national AI cyber programs and military AI offensive tools aim to bolster defense capabilities, the rapid adoption of AI by cybercriminals necessitates a continuous evolution of cybersecurity strategies. Ongoing vigilance, international cooperation, and adaptive defense mechanisms are essential to mitigate the risks associated with AI-enhanced cyber threats.

Highlights:

• 2025 APJ eCrime Report: AI Threats, Ransomware & Trends | CrowdStrike, Published on Sunday, October 19
• Asian banks adopt AI in cyberfraud ‘pure arms race’, but criminals are faster | South China Morning Post, Published on Wednesday, November 05
• AI Arms Race: Interpol Battles a New Generation of Cybercrime – Sri Lanka Guardian, Published on Saturday, February 14