Cybercriminals Intensify Attacks on East Asia's Critical Infrastructure

Executive Summary

In early 2026, cybercriminal activities targeting critical infrastructure in East Asia have escalated, with significant implications for national security and economic stability. Key sectors under threat include power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector.

Current Threat Landscape

Cybercriminal groups are employing sophisticated tactics to infiltrate and disrupt critical infrastructure across East Asia. Notably, in 2025, Taiwan experienced an average of 2.63 million cyberattacks per day, primarily targeting critical infrastructure sectors such as energy, communications, transportation, and healthcare. (globalsecurity.org)

Targeted Sectors

• Power Grids: Cybercriminals have exploited vulnerabilities in ICS and SCADA systems to manipulate power distribution. For instance, in 2025, a cyberattack on a Norwegian hydropower dam resulted in the deliberate opening of floodgates, releasing 500 liters of water per second for four hours, causing significant disruption. (weforum.org)

• Water Systems: Attacks have targeted water treatment facilities, leading to potential contamination risks. In Canada, hacktivists breached water and energy facilities, tampering with water pressure valves and automated tank gauges, highlighting the vulnerabilities in ICS. (techradar.com)

• Industrial Control Systems (ICS) and SCADA: Cybercriminals have increasingly targeted ICS and SCADA systems, leading to operational disruptions. In the third quarter of 2025, hacktivist attacks on ICS nearly doubled, with a significant focus on critical infrastructure sectors. (cyble.com)

• Healthcare: Healthcare institutions have been targeted for sensitive data, with cybercriminals deploying ransomware to disrupt services and demand payments. The healthcare sector's reliance on digital systems makes it a prime target for such attacks.

• Financial Sector: Financial institutions have faced cyberattacks aimed at data theft and financial gain. Chinese-speaking cybercriminals have been linked to illicit activities in the financial sector, utilizing anonymized marketplaces to solicit criminal services. (crowdstrike.com)

Threat Actors and Tactics

Cybercriminal groups, including state-aligned hacktivists, are employing a range of tactics:

• Distributed Denial-of-Service (DDoS) Attacks: Hacktivist groups have conducted DDoS attacks targeting SCADA and critical infrastructure across multiple countries. Between February 28 and March 2, 2026, 149 DDoS attacks targeted 110 organizations in 16 countries, following geopolitical tensions in the Middle East. (rescana.com)

• Ransomware: Cybercriminals are increasingly deploying AI-enhanced ransomware, enabling high-velocity, high-volume attacks on critical systems. This evolution in ransomware operations poses significant challenges to cybersecurity defenses. (crowdstrike.com)

Implications and Recommendations

The escalation of cybercriminal activities targeting critical infrastructure in East Asia underscores the need for enhanced cybersecurity measures. Organizations should implement robust security frameworks, conduct regular risk assessments, and ensure redundancy in critical systems. Collaboration between public and private sectors is essential to strengthen defenses against these evolving threats.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Canadian government claims hacktivists are attacking water and energy facilities, Published on Friday, October 31