Taiwan

This page covers cyber threats to Taiwan. It brings together Taiwan’s Ministry of Digital Affairs (MODA) and its Administration for Cyber Security, the Laws and Regulations Database, reports on statements by the National Security Bureau (NSB) and the Investigation Bureau (MJIB), the MITRE ATT&CK knowledge base, a US Treasury release and Brandefense research. Where an official source names Taiwan as a target, the page says who said it and when.

Threat groups that official sources link to Taiwan

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT40: on 19 August 2020 the Investigation Bureau of Taiwan’s Ministry of Justice said groups linked to the Chinese government had attacked at least 10 government agencies and about 6,000 official e-mail accounts. It named four main groups: Blacktech, Taidoor, MustangPanda and APT40. It said the attacks started as early as 2018 and that the government believes Blacktech and Taidoor are backed by the Chinese Communist Party. The Chinese government routinely denies involvement in hacking. This account comes from a Reuters report printed in the Taipei Times on 20 August 2020.

Lazarus Group: the US Treasury sanctioned Lazarus Group, Bluenoroff and Andariel as North Korean state-sponsored groups on 13 September 2019. Its release says, according to press reports, that Bluenoroff had successfully carried out operations against banks in several countries, Taiwan among them. The release does not name a Taiwanese bank.

MITRE ATT&CK also names Taiwan in three group entries that have no profile on our site yet. It describes BlackTech as a suspected Chinese group that has mainly targeted East Asia, particularly Taiwan, Japan and Hong Kong, and the US since at least 2013. It says Tropic Trooper has led targeted campaigns in Taiwan, the Philippines and Hong Kong, and that Chimera, a suspected China-based group, has targeted the semiconductor industry in Taiwan since at least 2018.

Incidents on record

The incidents listed below are the major ones that Taiwanese authorities or the organizations themselves reported, with national impact. Small incidents are not listed.

What the NSB and MODA report

The NSB said in January 2026 that China’s cyberarmy made an average of 2.63 million intrusion attempts a day against Taiwan’s critical infrastructure in 2025, 6 percent more than in 2024. For 2024 the figure was 2.46 million a day, up from 1.23 million in 2023. The report covers nine sectors: administration and agencies, energy, communications and transmission, transportation, emergency rescue and hospitals, water resources, finance, science parks and industrial parks, and food. It says attacks on critical energy infrastructure rose 10-fold and the emergency rescue and hospitals sector saw a 54 percent increase.

The NSB put vulnerability exploitation at 57 percent of the operations it counted, DDoS at 21 percent, social engineering at 18 percent and supply chain attacks at 4 percent. In October 2025 a document the NSB gave the Legislative Yuan said the Executive Yuan’s Government Service Network saw more than 2.8 million attacks a day so far that year, and that attackers seemed focused on critical infrastructure projects and information about the government’s overseas cooperation. The NSB also said 24 people were indicted for espionage for China in the first nine months of 2025.

In August 2026 MODA said overseas hackers had used AI agents against government agencies in July 2026. It said its National Institute for Cyber Security began issuing alerts on 20 July, that the attacks combined conventional hacking with AI agents, and that affected agencies had completed their responses. It did not say where the attacks came from.

How attackers target Taiwan: Brandefense research

State-linked. Our Tick APT group profile lists East Asia (Japan, South Korea and Taiwan) as the group’s geographic focus, with government, defense, industrial, technology and telecommunications targets. The LIMINAL PANDA profile describes a 2022 campaign against technology and manufacturing businesses in Taiwan and Japan that used PlugX and Cobalt Strike and aimed at semiconductor fabrication data. It also lists gathering intelligence on security cooperation and political relations around Taiwan as one of the group’s goals.

Banking and North Korea. Our Lazarus APT Group (APT38) post lists Taiwan among 18 countries where malware of this group has been seen. It also says Europol estimated WannaCry in May 2017 affected nearly 200,000 computers in 150 countries, primarily Russia, India, Ukraine and Taiwan.

Ransomware. The AvosLocker research summary lists Taiwan among the countries that AvosLocker targets.

Industrial devices. Our post on Moxa NPort devices covers two critical vulnerabilities (CVE-2022-2043 and CVE-2022-2044) in industrial connectivity appliances made by Moxa, a Taiwan-based provider. It describes how attackers could disrupt systems that use them.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Cyber Security Management Act took effect on 1 January 2019. It names the Ministry of Digital Affairs as the competent authority. Government agencies must appoint a Chief Information Security Officer, set up a reporting and response mechanism for incidents, and not use products harmful to national cyber security unless approved case by case. The Act also covers critical infrastructure providers, government-owned enterprises and designated foundations.

The Administration for Cyber Security says the Executive Yuan’s National Information and Communication Security Taskforce has run national cyber security programs in four-year phases since 2001. The seventh phase runs from 2025 to 2028 and is titled to build a trustworthy and secure digital society.

How incident response is organized

The Administration for Cyber Security, part of MODA, has an Incident Notification and Response Division. It says agencies must immediately notify the Administration of incidents and act to contain or recover from damage, and that it offers agencies 24/7 consulting on reporting. It is building national ISAC, CERT and SOC capability in critical infrastructure domains and runs a national monitoring center that looks for abnormal network activity. It lists nine critical infrastructure fields: energy, water resources, communications and transmission, transportation, finance, emergency rescue and hospitals, government agencies, science parks and industrial parks, and food.

Personal data

The Personal Data Protection Act names the Personal Data Protection Commission as its competent authority. The Executive Yuan has set up a Preparatory Office to establish that Commission. Under the Act, an agency that learns that personal data it holds has been stolen, altered, damaged, lost or leaked must notify the data subject.

The only attack counts in the official material we opened are the NSB figures above, which we cite as reported by the Taipei Times; figures from Brandefense Atlas will be added when available.