China Launches 2.6 Million Daily Cyberattacks on Taiwan in 2025 Amid Rising Tensions Taiwan’s primary intelligence agency reported that Chinese hackers conducted an average of 2.6 million cyberattacks per day in 2025, attributing the campaign to five state-linked hacker groups from China. The surge in attacks coincides with escalating geopolitical tensions between Beijing and Taipei, as cross-strait relations deteriorate. The disclosure highlights the intensifying cyber warfare dimension of the conflict, with Taiwan’s digital infrastructure facing relentless targeting. While the specific methods and objectives of the attacks remain undisclosed, the scale underscores China’s aggressive cyber posture as regional hostilities persist. No further details on the impact of the breaches or Taiwan’s defensive measures were provided. The development follows a pattern of heightened cyber activity in the region, with both sides engaging in digital espionage and disruption efforts.

Chinese APTs Exploited Zero-Day in TeamT5’s ThreatSonar Product in Targeted Supply Chain Attack Cybersecurity firm TeamT5 has confirmed that CVE-2024-7694, a recently added vulnerability in its ThreatSonar product, was exploited by Chinese advanced persistent threat (APT) groups. The flaw, patched in August 2024, allows attackers with admin privileges to upload malicious files and execute arbitrary commands on vulnerable servers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) included the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog last week, requiring federal agencies to remediate it by March 10. TeamT5, which serves government and enterprise clients in the U.S., Japan, and Taiwan, reported that the attacks occurred earlier in 2024 and were highly targeted, focusing on a small number of high-profile customers. All affected organizations were notified and assisted with patching. TeamT5’s investigation linked the campaign to Chinese APT groups Slime57 and Slime62, which conducted a supply chain attack by exploiting the zero-day. The threat actors used hundreds of compromised Taiwanese IP addresses to obscure their origins, demonstrating significant resources and coordination. While the company confirmed that all customers have since updated their software, the incident underscores the growing threat of state-backed cyberespionage targeting cybersecurity vendors to gain access to sensitive networks. Previous reports have noted similar Chinese APT activity, including attacks on Taiwanese web hosting firms and the revival of the Tianfu Cup hacking contest under heightened secrecy.