Cybercriminals Target East Asia's Critical Infrastructure Amid Rising Attacks

Overview

In early 2026, cybercriminal groups have escalated their operations targeting critical infrastructure across East Asia. These attacks encompass power grids, water systems, industrial control systems (ICS), healthcare facilities, and the financial sector, presenting a medium-level threat to regional stability.

Notable Attacks and Threat Actors

• Qilin Ransomware Group: A Russian-speaking cybercriminal organization, Qilin has been active since 2022, deploying the Agenda ransomware. In October 2025, Qilin claimed responsibility for a ransomware attack on Asahi, a major Japanese brewery, disrupting operations and causing financial losses. (en.wikipedia.org)

• Dark Engine: This hacktivist group has targeted industrial control systems globally. In Vietnam, Dark Engine accessed SCADA systems controlling industrial furnaces, highlighting the group's capability to disrupt critical industrial operations. (cyberpress.org)

• Z-Pentest: Emerging in late 2024, Z-Pentest has been responsible for multiple ICS attacks, including targeting a water utility HMI system in the U.S. and an agricultural biotechnology SCADA system in Taiwan. The group often publicizes its activities to amplify psychological impact. (cyble.com)

Targeted Sectors

• Energy Sector: Taiwan experienced a tenfold increase in cyberattacks on its energy infrastructure in 2025, with daily attacks averaging 2.63 million. These attacks have the potential to disrupt power supply and impact daily life. (darkreading.com)

• Healthcare Facilities: In June 2025, Qilin was linked to a data breach at Covenant Health, affecting over 478,000 individuals. Such breaches compromise patient data and can disrupt healthcare services. (en.wikipedia.org)

• Financial Sector: Qilin's attacks have also targeted financial institutions, including a significant incident involving the U.S. business Inotiv, where 178 GB of data was stolen, impacting multiple systems and data. (en.wikipedia.org)

Tactics and Tools

Cybercriminals employ various tactics, including phishing, exploiting vulnerabilities, and deploying ransomware. Tools like LogicLocker, a ransomware worm targeting PLCs in ICS, and Pipedream, a malware framework for attacking ICS, have been identified in such attacks. (en.wikipedia.org)

Implications and Recommendations

The escalation of cyberattacks on critical infrastructure in East Asia underscores the need for enhanced cybersecurity measures. Organizations should implement robust security protocols, conduct regular vulnerability assessments, and foster collaboration with governmental and international bodies to strengthen defenses against cybercriminal activities.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Chinese state-sponsored cyberattacks target Taiwan semiconductor industry - security firm says motivation of three separate campaigns 'most likely espionage', Published on Friday, July 18news33