Taiwan Reports Tenfold Surge in Chinese Cyberattacks on Energy Sector

Taiwan’s National Security Bureau (NSB) has revealed that China’s cyberattacks on Taiwan’s energy sector increased by 1,000% in 2025 compared to 2024, marking one of the most aggressive campaigns against the island’s critical infrastructure to date.

Key Findings from NSB Report

Overall incidents: Cyber incidents linked to China grew 6% year-over-year.
Sector-specific increases:
- Energy sector: +1,000% (most significant spike).
- Emergency rescue & hospitals: +54%.
- Communications & transmissions: +6.7%.
- Industrial parks & food: unchanged.
- Administration agencies: slight decrease.
- Finance & water resources: significant reduction.

Attack Methods Observed

Hardware & software vulnerability exploitation (most prevalent).
Distributed denial-of-service (DDoS) attacks.
Social engineering campaigns.
Supply-chain compromises.

Energy Sector Targeting

Focused on industrial control systems (ICS) in petroleum, electricity, and natural gas companies.
Attackers probed network equipment and exploited software upgrade cycles to implant malware.
Goal: Track operational planning, procurement, and backup system establishment.
Attacks often coincided with military activity or major political events, suggesting coordination.

Other Sector Activity

Communications: Adversary-in-the-middle (AitM) attacks exploiting network flaws.
Government agencies: Phishing and data theft.
Tech sector: Supply-chain and social engineering attacks aimed at stealing advanced chip and industrial technology data.

Threat Actor Attribution

Taiwan attributed activity to well-known Chinese APT groups:

BlackTech
Flax Typhoon
Mustang Panda
APT41
UNC3886

International Cooperation

Taiwan is working with 30+ countries that identify China as a major cyber threat.
Joint investigations and intelligence sharing are underway to track malicious infrastructure and mitigate risks.

Takeaway

The tenfold surge in energy sector attacks underscores how cyber operations are being used as a strategic weapon against Taiwan’s critical infrastructure. By exploiting vulnerabilities in ICS and leveraging software upgrade cycles, Chinese APTs aim to gain long-term visibility and control over Taiwan’s energy systems.