Cybercriminals Target East Asia's Critical Infrastructure Amid Rising Attacks

Overview

In early 2026, cybercriminal activities targeting critical infrastructure in East Asia have escalated, with notable incidents affecting power grids, water systems, industrial control systems (ICS), healthcare facilities, and the financial sector. These attacks underscore the growing threat to national security and economic stability in the region.

Notable Incidents

• Taiwan: In 2025, Taiwan's National Security Bureau reported an average of 2.63 million cyberattacks per day originating from China, marking a 6% increase from the previous year. These attacks predominantly targeted critical infrastructure, including hospitals, banks, and government institutions, often synchronized with major military and political events. (darkreading.com)

• Japan: In October 2025, the Russian-speaking cybercrime group Qilin claimed responsibility for a ransomware attack on Asahi, a major Japanese brewery. The attack disrupted operations and highlighted the vulnerability of industrial sectors to cyber threats. (en.wikipedia.org)

• Vietnam: Hacktivist group Dark Engine gained unauthorized access to SCADA systems controlling industrial furnaces in Vietnam. The group justified the attack as retaliation against adversaries hostile to China, framing it within the context of regional disputes. (cyberpress.org)

Threat Actor Profiles

• Qilin: A Russian-speaking cybercrime organization known for deploying the Agenda ransomware. In 2025, Qilin affected over 700 victims across 62 countries, primarily targeting organizations in developed markets and high-value industries, including manufacturing, technology, financial services, and healthcare. (ics-cert.kaspersky.com)

• Dark Engine: A hacktivist group with operations across Europe, Asia, and Latin America. Dark Engine has targeted critical infrastructure sectors such as energy, food and beverages, and manufacturing, often leaking ICS/HMI control interface screenshots to demonstrate system compromise. (cyberpress.org)

Tools and Techniques

• Agenda Ransomware: Deployed by Qilin, this ransomware has been used in attacks affecting various sectors, including healthcare and manufacturing. (ics-cert.kaspersky.com)

• SCADA Strangelove: An independent group of information security researchers focused on security assessment of ICS and SCADA systems. Their activities include discovering vulnerabilities and developing security hardening guides for ICS software. (en.wikipedia.org)

Implications and Recommendations

The increasing frequency and sophistication of cyberattacks on critical infrastructure in East Asia necessitate enhanced cybersecurity measures. Organizations should implement robust security protocols, conduct regular vulnerability assessments, and foster collaboration with national cybersecurity agencies to mitigate risks. Additionally, public awareness and training programs are essential to recognize and respond to cyber threats effectively.

Conclusion

Cybercriminals continue to exploit vulnerabilities in critical infrastructure across East Asia, posing significant challenges to national security and economic stability. Proactive measures and international cooperation are vital to address this evolving threat landscape.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Chinese state-sponsored cyberattacks target Taiwan semiconductor industry - security firm says motivation of three separate campaigns 'most likely espionage', Published on Friday, July 18
• Security expert warns Salt Typhoon is becoming 'more dangerous' after Norwegian authorities lift lid on critical infrastructure hacking campaign, Published on Monday, February 09