Escalating Nation-State Cyber Attacks on East Asia's Critical Infrastructure

In early 2026, East Asia has witnessed a surge in cyber operations attributed to nation-state actors, focusing on critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These activities underscore a strategic shift towards cyber warfare, aiming to disrupt essential services and exert geopolitical influence.

China's Cyber Operations Against Taiwan

Between March and June 2025, Chinese state-sponsored hacking groups intensified cyber-espionage campaigns targeting Taiwan's semiconductor industry and financial analysts. At least three new groups—UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp—were identified, alongside the known group UNK_ColtCentury. These groups employed spear-phishing tactics and malware-laden documents to infiltrate organizations, including medium-sized firms and large multinationals. The attacks aimed to steal intellectual property and sensitive financial data, aligning with China's strategic interest in semiconductor self-sufficiency amid global trade tensions. (tomshardware.com)

North Korean Attacks on South Korean Infrastructure

In 2025, North Korean state-sponsored actors, notably the Lazarus Group, conducted cyberattacks targeting South Korea's power grid and water systems. These operations involved sophisticated malware designed to infiltrate ICS and SCADA systems, potentially leading to service disruptions. While the attacks were detected and mitigated before causing significant damage, they highlighted the vulnerability of critical infrastructure to cyber threats.

Iranian Cyber Activities in the Middle East

Following the U.S. military strikes on Iranian facilities in February 2026, Iranian-backed hackers have targeted American banks, defense contractors, and oil firms. Although critical infrastructure disruptions have been minimal, analysts warn that if the conflict escalates, the digital threat could grow significantly. These cyberattacks, mainly denial-of-service, were claimed on Telegram by pro-Palestinian groups like Mysterious Team, aimed at sowing economic and psychological disruption. (apnews.com)

Chinese Cyber Espionage in Norway

A recent report by the Norwegian Police Security Service warns of an intensifying cyber espionage campaign by the Chinese-backed hacking group Salt Typhoon, targeting critical infrastructure in Norway. The group has expanded globally, focusing on telecommunications, government, transportation, and military systems. Salt Typhoon is known for infiltrating networks via backbone and edge routers, maintaining long-term access, and evading detection. The report urges infrastructure-heavy organizations to implement strong safeguards, such as network segmentation and zero-trust policies, to mitigate exposure. (itpro.com)

Implications and Recommendations

The escalation of nation-state cyber operations targeting critical infrastructure in East Asia necessitates a comprehensive and coordinated response. Governments and private sector entities must prioritize the enhancement of cybersecurity measures, including the adoption of zero-trust architectures, regular system updates, and robust incident response protocols. International collaboration is essential to share threat intelligence and develop collective defense strategies against these evolving cyber threats.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Iranian-backed hackers go to work after US strikes, Published on Tuesday, June 24
• Security expert warns Salt Typhoon is becoming 'more dangerous' after Norwegian authorities lift lid on critical infrastructure hacking campaign, Published on Monday, February 09