State-Sponsored Cyber Operations in East Asia: A 2026 Assessment

Executive Summary

As of March 2026, East Asia continues to be a focal point for state-sponsored cyber operations, primarily attributed to Chinese and North Korean threat actors. These activities target critical infrastructure, government entities, and private sectors, leveraging sophisticated techniques to achieve geopolitical and economic objectives.

Chinese Cyber Operations

APT41 (Silver Dragon):

APT41, also known as Silver Dragon, has been active since at least mid-2024, conducting cyber-espionage campaigns targeting government entities in Southeast Asia and Europe. Their operations involve embedding malware within legitimate services such as Google Drive and Windows Update, utilizing a custom backdoor named GearDoor for command-and-control communications. This approach effectively evades traditional perimeter defenses by disguising malicious activities within normal system operations. (techradar.com)

Lotus Blossom (APT31):

APT31, also known as Lotus Blossom, has been implicated in a supply chain attack involving the popular Notepad++ application. Between June and December 2025, attackers compromised the official update mechanism to deliver malware to select users, primarily targeting organizations in the telecommunications and financial sectors across East Asia, as well as government entities in the Philippines and Vietnam. The attackers employed dynamic execution chains, frequently changing command-and-control server addresses and payloads to evade detection. (en.wikipedia.org)

North Korean Cyber Operations

Kimsuky:

The North Korean state-sponsored group Kimsuky has been active in cyber operations targeting South Korea and other regional entities. In January 2026, Kimsuky exploited the eScan antivirus software's update mechanism to deploy backdoors and cryptocurrency miners, affecting users in South Asia, including India, Bangladesh, Sri Lanka, and the Philippines. This incident highlights the group's capability to exploit supply chain vulnerabilities for espionage and financial gain. (en.wikipedia.org)

Regional Impact and Spillover Risks

The geopolitical tensions in the Middle East have had a spillover effect on East Asia, with Southeast Asian nations facing increased cyber risks. Following the U.S.-Israeli military strikes on Iran in February 2026, Iranian state-sponsored hackers and affiliated groups have been observed targeting entities in the Middle East, the U.S., and parts of Asia. This escalation underscores the interconnected nature of global cyber threats and the potential for regional conflicts to influence cyber activities in East Asia. (scmp.com)

Conclusion

State-sponsored cyber operations in East Asia have become more sophisticated and persistent, with Chinese and North Korean actors employing advanced techniques to achieve their objectives. The region's critical infrastructure and private sectors remain prime targets, necessitating enhanced cybersecurity measures and international cooperation to mitigate these evolving threats.

Highlights:

• Chinese hackers hide malware within Windows and Google Drive to hit government targets, Published on Thursday, March 05
• Cloudflare warns state-backed hackers are 'weaponizing legitimate enterprise ecosystems' as 'living off the land' attacks surge, Published on Wednesday, March 04
• U.S. braces for cyberspace retaliation from Iran, Published on Tuesday, March 03