Taipei: China's cyber army launched 2.63 million intrusion attempts against Taiwan's critical infrastructure (CI) every day in 2025, representing a six percent increase from 2024, according to Taiwan's National Security Bureau (NSB) on Sunday.

According to Focus Taiwan, in a report titled "Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025," Taiwan's security agency said that energy and hospital sectors experienced the "most significant year-on-year surge in cyberattacks from Chinese threat actors." The report detailed that cyberattacks conducted by China's cyber army involve four major tactics, namely hardware and software vulnerability exploitation, distributed denial-of-service (DDoS), social engineering, and supply chain attacks. Exploitation of hardware and software vulnerabilities accounted for more than half of the intrusion attempts.

The top five Chinese hacker groups, namely BlackTech, Flax Typhoon, Mustang Panda, APT41, and UNC3886, launched cyber operations against Taiwan's CI focusing on five primary sectors, including energy, healthcare, communications and transmission, administration and agencies, as well as technology. The report identified at least 20 cases of ransomware deployment in an attempt to compromise the operations of major hospitals in 2025.

Over the course of the year, the number of cyberattacks against Taiwan's critical infrastructure peaked around the time of the first anniversary of President Lai Ching-te's inauguration in May, and also climbed again during Vice President Hsiao Bi-khim's trip to Europe in November. The security agency did not disclose how many of the intrusion attempts were successful.

Throughout 2025, cybersecurity agencies and intelligence services across the Indo-Pacific region, NATO, and the European Union repeatedly identified China as a primary source of global cybersecurity threats. The NSB convened information security dialogues and technical conferences with more than 30 countries worldwide in 2025 and cooperates closely with "international friends and allies" to "obtain timely intelligence on attack patterns of China's cyber army."

The agency emphasized that it "conducts joint investigations into malicious relay nodes, thereby supporting government decision making, response preparedness, and further enhancing the overall resilience and capacity of Taiwan's CI protection."