The tense relationship between the People’s Republic of China (PRC) and Taiwan was further exacerbated by the US House of Representatives speaker Nancy Pelosi visit to Taipei last week. Pelosi’s visit was intended to reiterate the US support for Taiwan against potential external threats. However, the last Chinese military drills off the coasts of Taiwan indicate that this diplomatic trip may not have obtained the expected results.
The PRC and Taiwan have had thorny diplomatic relations since the inception of the Taiwan state in 1949, when Chiang Kai-shek and the Kuomintang party installed a new government in Taipei at the end of the Chinese Civil War. Without going too deep into the international relations nerdy stuff, it suffices to notice that this is a tense situation deeply rooted in decades of antagonistic diplomatic relations and external influences.
Currently, the PRC sees Taiwan as a breakaway province that will eventually come back under Beijing’s control. On the other hand, Taiwan is firm in identifying itself as an independent and democratic country, with its own leaders, goals, and ambitions. As you can see, highly divergent perspectives that may trigger significant tensions.
The Chinese military drills carried out in the past few days represent a considerable display of the PRC’s military strength in the air and sea domain. On top of this, we’ve observed increasing malicious activity in the cyber sphere, likely testing out Taiwan’s defenses and resilience plans. No surprises here though, as low intensity cyber attacks have become an integral part of the PRC’s hybrid warfare playbooks.
In the following sections, we’ll analyze the importance of Taiwan in the global arena, the cyber attacks associated with this tension, and the potential implications in the upcoming weeks.
Taiwan’s role in global order
Despite Taiwan’s small size, this island country is critical for world stability for two main reasons: its strategic location and its position as a leader in chip manufacturing.
Taiwan’s location makes it part of the so-called ‘first island chain’, a group of Pacific islands off the East Asian continental mainland coast. These islands are crucial for both the PRC and the US, as they constitute an perceived line of demarcation and defense between these two superpowers. Exerting economic and diplomatic influence on these islands is therefore a key strategic goal for both countries.
Possibly even more important than Taiwan’s geographical location is its role as a leading chip manufacturer. According to some statistics, Taiwan organizations own more than half of the world’s production of computer chips—chips necessary to build almost every electronic equipment we use every day, going from smartphones to laptops (and yes, even your beloved PS5). As you have already guessed, the importance of Taiwan for the global economy is therefore enormous and potential trade halts with this country will have disproportionate effects elsewhere.
As a consequence of the factors described above, a military conflict involving Taiwan would have a disproportionate impact on the rest of the world, with considerable repercussions in the economic, diplomatic, and military domains.
How is this impacting the cyber threat landscape?
Although no military actions have started yet (and we sincerely hope that things will remain the same in the future), we’ve started observing malicious cyber activity directed against both PRC and Taiwanese entities. This is not a surprising behavior, as low intensity cyber attacks often accompany tense diplomatic and military situations; this allows nation states to pursue the art of brinkmanship, by committing to a retaliatory response, whilst minimizing the risk of escalating to a real conflict.
Some of the activity observed so far include distributed denial of service (DDoS) attacks against Taiwanese government websites, defacement attacks against PRC websites claimed by hacktivist groups, and pro-PRC misinformation campaigns. Does this sound familiar to you? You may in fact remember that similar activity occurred in the weeks leading to Russia’s invasion of Ukraine, highlighting the almost ubiquitous presence of malicious cyber activity during tense geopolitical situations.
The observed attacks are more disruptive than destructive, so far. The likely purpose of these attacks is to test Taiwan’s defenses, showcasing the PRC’s capabilities, whilst simultaneously sowing distrust and delegitimizing the Taiwanese government. These attacks live in a gray area between wartime and peacetime and can be referred to as hybrid threats; although they do not meet the threshold to be considered like a war declaration, these attacks can still spiral out of control and cause unintended, disproportionate damage against their targets.
Preparing your response for potential escalations
A military invasion of Taiwan isn’t the most likely scenario at this time. However, organizations should start adapting their incident response plans to include a potential escalation of this diplomatic and military confrontation.
If the situation escalates, it is realistically possible that we’ll observe more destructive attacks against critical national infrastructure (CNI) and large corporations. Advanced persistent threat (APT) groups will likely conduct political and industrial cyberespionage and destructive attacks against organizations operating in key sectors, such as financial institutions, energy and telecommunications providers, and food and beverage industries.
The most recent conflicts have also highlighted how an abundance of threat actors with different capabilities, resources, and motivations will enter the cyber threat landscape during wartime. As such, defenders should also include hacktivist groups in their threat model to encompass those ideologically-motivated threat actors that have been particularly active during the Russia-Ukraine war.
Ultimately, if you want to stay updated on every cyber attack happening in the context of the current PRC-Taiwan tensions, sign up for a demo of SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) here. Alternatively, you can access a constantly-updated threat intelligence library providing insight on this and other cybercriminal-related trends that might impact your organization and allow security teams to stay ahead of the game. Just sign up for a free seven-day test drive of SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) here.