Critical Infrastructure Under Siege: APT Threats in East Asia's Vital Sectors

Executive Summary

Advanced Persistent Threats (APTs) have escalated their operations against critical infrastructure in East Asia, focusing on sectors such as power grids, water systems, Industrial Control Systems (ICS), healthcare, and the financial sector. Notably, Chinese state-sponsored groups like Volt Typhoon and UNC3886 have been identified as primary actors in these campaigns. The threat level is assessed as critical due to the potential for significant disruption and economic impact.

Threat Actor Overview

• Volt Typhoon: An APT group affiliated with the Chinese government, active since at least mid-2021. Volt Typhoon has primarily targeted U.S. critical infrastructure, focusing on espionage, data theft, and credential access. Their operations are characterized by stealth and persistence, aiming to sabotage critical communications infrastructure during potential future crises. (en.wikipedia.org)

• UNC3886: Also linked to Chinese state-sponsored activities, UNC3886 has been active since at least late 2021, targeting critical infrastructure globally. In July 2025, Singapore's Coordinating Minister for National Security, K. Shanmugam, confirmed that the country's critical infrastructure was under attack by UNC3886, with the Cyber Security Agency of Singapore actively investigating the incidents. (en.wikipedia.org)

Targeted Sectors and Attack Vectors

• Power Grids and Water Systems: While specific incidents in East Asia are limited, the global trend indicates a rising interest in targeting energy and water infrastructure. For instance, the 2015 Ukraine power grid hack, attributed to the Russian APT group Sandworm, demonstrated the potential impact of such attacks. (en.wikipedia.org)

• Industrial Control Systems (ICS): In Q3 2025, East Asia ranked first globally in the percentage of ICS computers on which threats from network folders were blocked, highlighting the region's vulnerability. The primary threats include viruses, malware for AutoCAD, and spyware. (ics-cert.kaspersky.com)

• Healthcare Sector: APT groups have increasingly targeted healthcare organizations, exploiting vulnerabilities to access sensitive patient data and disrupt services. The rise in AI-powered cyberattacks, including deepfake services, has further complicated the threat landscape. (crnasia.com)

• Financial Sector: The financial sector remains a prime target for APTs, with attacks aimed at stealing sensitive financial data and disrupting operations. The integration of AI in cyberattacks has enhanced the sophistication and effectiveness of these campaigns. (crnasia.com)

Tactics, Techniques, and Procedures (TTPs)

APT groups employ a range of sophisticated TTPs, including:

• Living off the Land (LOTL): Utilizing existing software and network features to avoid detection. Volt Typhoon, for example, has been known to use compromised Fortinet devices to extract credentials and maintain stealthy persistence. (rhisac.org)

• Exploitation of Vulnerabilities: Targeting known vulnerabilities in widely used software and hardware. For instance, Salt Typhoon has exploited vulnerabilities in Ivanti Connect Secure and ProxyLogon to gain access to networks. (rhisac.org)

• Ransomware Deployment: Some state-aligned APT groups have increasingly deployed ransomware, either as a means of financial gain or to cover up the true intent of attacks. For example, the Iranian group Pioneer Kitten has collaborated with ransomware affiliates to enable encryption operations in exchange for a percentage of the ransom payments. (eset.com)

Recommendations

To mitigate the risks posed by APTs targeting critical infrastructure in East Asia, organizations should consider the following measures:

• Enhanced Monitoring and Detection: Implement advanced monitoring systems to detect unusual activities indicative of APT presence.

• Regular Vulnerability Assessments: Conduct frequent assessments to identify and remediate vulnerabilities, particularly in ICS and network infrastructure.

• Employee Training: Educate staff on recognizing phishing attempts and other social engineering tactics commonly used by APTs.

• Incident Response Planning: Develop and regularly update incident response plans to ensure a swift and coordinated reaction to potential breaches.

Conclusion

The targeting of critical infrastructure by APTs in East Asia represents a significant and evolving threat. Continuous vigilance, proactive defense strategies, and international cooperation are essential to safeguard these vital sectors from cyber threats.

Highlights:

• APT attacks on the rise in Asia Pacific
• RH-ISAC | Four Chinese APT Groups Target Critical Infrastructure Disruption - RH-ISAC, Published on Sunday, December 15
• State-aligned APT groups are increasingly deploying ransomware – and that’s bad news for everyone | | ESET, Published on Monday, January 13