Cybercriminals Intensify Attacks on East Asia's Critical Infrastructure

Executive Summary

In early 2026, cybercriminal groups have intensified their operations against East Asia's critical infrastructure, including power grids, water systems, and healthcare sectors. These attacks have led to operational disruptions, data breaches, and heightened concerns over regional stability.

Key Developments

• Royal Ransomware Group: Formerly known as BlackSuit, Royal has been active since 2022, targeting sectors such as healthcare, finance, and critical infrastructure. Their tactics include double extortion, where both data encryption and exfiltration occur, with ransom demands ranging from $1 million to $10 million in Bitcoin. (en.wikipedia.org)

• Hacktivist Groups: Entities like Z-Pentest, Dark Engine, and Sector 16 have escalated attacks on industrial control systems (ICS) and operational technology (OT). These groups have targeted sectors including energy, water, and manufacturing, employing tactics such as data exfiltration and system disruption. (scworld.com)

• APT Groups: Advanced Persistent Threat (APT) groups, notably those linked to China, have been implicated in cyber-espionage campaigns targeting critical infrastructure in East Asia. For instance, in 2025, Taiwan experienced a significant surge in cyberattacks originating from China, averaging 2.63 million incidents daily, with energy infrastructure and healthcare systems being primary targets. (darkreading.com)

Technical Analysis

• Attack Vectors: Cybercriminals have exploited vulnerabilities in ICS/SCADA systems, often leveraging exposed Virtual Network Computing (VNC) services. By conducting internet scans for open VNC ports (typically 5900-5910), attackers gain unauthorized access to Human-Machine Interface (HMI) devices, leading to operational disruptions. (ics-cert.kaspersky.com)

• Ransomware Deployment: Groups like Royal utilize sophisticated malware strains, including Cobalt Strike and LockBit, to infiltrate networks. They employ phishing campaigns to deliver malicious payloads, followed by lateral movement within networks to maximize impact. (ics-cert.kaspersky.com)

Impact Assessment

• Operational Disruptions: Attacks on power grids have led to localized blackouts, affecting industrial operations and daily life. Healthcare facilities have experienced system outages, compromising patient care and data integrity.

• Data Breaches: Exfiltration of sensitive data has resulted in financial losses and reputational damage for affected organizations. The healthcare sector, in particular, has seen breaches of patient records, raising concerns over privacy and compliance.

Recommendations

• Enhanced Monitoring: Implement continuous monitoring of ICS/SCADA systems to detect unauthorized access attempts.

• Patch Management: Regularly update and patch systems to mitigate known vulnerabilities, particularly those associated with VNC services.

• Employee Training: Conduct regular cybersecurity awareness training to recognize and respond to phishing attempts.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift recovery from cyber incidents.

Conclusion

The escalation of cybercriminal activities targeting East Asia's critical infrastructure underscores the need for robust cybersecurity measures. Organizations must adopt a proactive approach to safeguard against evolving cyber threats and ensure the resilience of essential services.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Chinese state-sponsored cyberattacks target Taiwan semiconductor industry - security firm says motivation of three separate campaigns 'most likely espionage', Published on Friday, July 18
• North Korea unveils new military unit targeting AI attacks, Published on Friday, March 21