Escalating Cyber Threats to East Asia's Critical Infrastructure

Executive Summary

Recent developments indicate a significant escalation in cyberattacks targeting critical infrastructure across East Asia. Nation-state actors are increasingly leveraging cyber capabilities to disrupt essential services, including power grids, water systems, industrial control systems (ICS), healthcare facilities, and financial institutions. This briefing examines the current threat landscape, identifies key threat actors, and provides recommendations for mitigating these risks.

Current Threat Landscape

In 2025, Taiwan experienced a surge in cyberattacks originating from China, averaging 2.63 million incidents daily. These attacks targeted critical infrastructure such as hospitals, banks, and government institutions, often synchronized with major military and political events. This strategy aligns with China's broader objectives to destabilize Taiwan and assert territorial claims. (techradar.com)

In Singapore, the advanced persistent threat group UNC3886, affiliated with the People's Republic of China, has been active since at least late 2021. The group has targeted critical infrastructure globally, including Singapore's telecommunication companies, highlighting the transnational nature of cyber threats. (en.wikipedia.org)

Key Threat Actors

• UNC3886: An advanced persistent threat group affiliated with the Chinese government, known for targeting critical infrastructure globally. (en.wikipedia.org)

• Handala Hack: A group linked to Iran's Ministry of Intelligence and Security (MOIS), involved in cyberattacks against Israeli energy companies and other regional targets. (en.wikipedia.org)

Impact on Critical Infrastructure

The cyberattacks have led to significant disruptions in essential services:

• Power Grids: Disruptions have resulted in widespread outages, affecting millions of residents and businesses.

• Water Systems: Attacks have compromised water treatment facilities, posing public health risks.

• Industrial Control Systems (ICS): Intrusions have targeted ICS, leading to operational disruptions in manufacturing and production sectors.

• Healthcare Facilities: Cyberattacks have targeted hospitals and medical institutions, compromising patient data and disrupting services.

• Financial Institutions: Cyberattacks have targeted banks and financial institutions, leading to data breaches and financial losses.

Recommendations

To mitigate the risks associated with these cyber threats, the following measures are recommended:

1. Enhanced Cyber Hygiene: Organizations should implement robust cybersecurity practices, including regular software updates, strong authentication mechanisms, and comprehensive employee training.

2. Critical Infrastructure Protection: Governments and private sector entities should collaborate to strengthen the security of critical infrastructure, including conducting regular vulnerability assessments and implementing intrusion detection systems.

3. International Collaboration: Countries should engage in information sharing and joint exercises to improve collective defense against cyber threats.

4. Incident Response Planning: Develop and regularly update incident response plans to ensure a coordinated and effective response to cyber incidents.

Conclusion

The escalation of cyberattacks targeting critical infrastructure in East Asia underscores the need for heightened vigilance and proactive measures. By understanding the evolving threat landscape and implementing recommended strategies, stakeholders can better safeguard essential services and maintain regional stability.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Security expert warns Salt Typhoon is becoming 'more dangerous' after Norwegian authorities lift lid on critical infrastructure hacking campaign, Published on Monday, February 09