Cybercriminals Target Critical Infrastructure in East Asia Amid Rising Threats

Introduction

In early 2026, cybercriminal activities targeting critical infrastructure in East Asia have escalated, with notable incidents affecting power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks underscore the growing threat to regional stability and economic security.

Targeted Sectors and Notable Incidents

• Power Grids: In December 2025, the Polish power grid experienced a cyberattack attributed to the Russian cybercrime group Berserk Bear. The attack targeted both IT and industrial devices, affecting renewable energy plants and a combined heat and power plant. (en.wikipedia.org)

• Water Systems: Hacktivist group Z-Pentest has been linked to attacks on water utility systems in the United States and Taiwan. These incidents involved unauthorized access to human-machine interface (HMI) systems, potentially compromising water distribution and quality. (cyble.com)

• Industrial Control Systems (ICS): The Qilin group, a Russian-speaking cybercrime organization, has deployed the Agenda ransomware, affecting over 700 victims across 62 countries since January 2025. Targets included manufacturing, technology, financial services, and healthcare sectors, indicating a broad interest in disrupting industrial operations. (ics-cert.kaspersky.com)

• Healthcare: In June 2025, the Qilin group claimed responsibility for a data breach at Covenant Health, impacting over 478,000 individuals. This incident highlights the vulnerability of healthcare organizations to cybercriminal activities. (en.wikipedia.org)

• Financial Sector: Chinese state-sponsored cyberattacks have targeted Taiwan's semiconductor industry, with groups like UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp identified as perpetrators. These campaigns aimed to steal sensitive data, aligning with China's strategic interests in semiconductor self-sufficiency. (tomshardware.com)

Tools and Techniques

Cybercriminals have employed various sophisticated tools and techniques in these attacks:

• Ransomware: The Agenda ransomware, associated with the Qilin group, has been used to encrypt data and demand ransoms from organizations. (ics-cert.kaspersky.com)

• Supply Chain Attacks: The Notepad++ supply chain attack, attributed to a Chinese state-sponsored group, involved redirecting update traffic to deliver malware, affecting organizations in the telecommunications and financial sectors across East Asia. (en.wikipedia.org)

• Advanced Persistent Threats (APTs): Groups like UNK_FistBump and UNK_DropPitch have utilized APT tactics, including spear-phishing and malware-laden documents, to infiltrate networks and exfiltrate data. (tomshardware.com)

Implications and Recommendations

The increasing frequency and sophistication of cyberattacks on critical infrastructure in East Asia pose significant risks to regional stability and economic security. Organizations must enhance their cybersecurity measures by:

• Implementing Robust Security Protocols: Regularly updating and patching systems to mitigate vulnerabilities.

• Conducting Regular Security Audits: Identifying and addressing potential weaknesses in infrastructure.

• Training Personnel: Educating staff on recognizing phishing attempts and other social engineering tactics.

• Collaborating with Authorities: Engaging with national and international cybersecurity agencies to share threat intelligence and coordinate responses.

Conclusion

The landscape of cyber threats targeting critical infrastructure in East Asia is evolving, with cybercriminals employing increasingly sophisticated methods. Proactive measures and international cooperation are essential to mitigate these risks and safeguard critical infrastructure.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Chinese state-sponsored cyberattacks target Taiwan semiconductor industry - security firm says motivation of three separate campaigns 'most likely espionage', Published on Friday, July 18
• NSA says Volt Typhoon was 'not successful' at persisting in critical infrastructure, Published on Wednesday, July 16