The most sustained conflict unfolding between China and Taiwan is not taking place on the water or in the air; it is happening in cyberspace.
Over the past two years, China has escalated a comprehensive cyber warfare campaign against Taiwan. The campaign is persistent, technically sophisticated and politically calibrated. It combines state-backed espionage, psychological operations, critical infrastructure intrusions and disinformation, and it is deeply integrated into Beijing’s broader effort to destabilise Taiwan with action below the threshold of war.
China’s cyber activities against Taiwan are extensive and strategically coordinated. Prominent Chinese intruder groups capable of lurking in networks have conducted long-term cyber operations against Taiwanese government agencies, critical infrastructure and private sector entities. These campaigns are not solely intelligence-gathering exercises; many implant malware and establish persistent access that could be exploited in the event of a military contingency.
Taiwan’s National Security Bureau reported more than 2.4 million intrusion attempts per day targeting government networks in 2024—more than double the previous year. Many of these are attributed to Chinese actors seeking to exfiltrate sensitive data and prepare for potential sabotage of communications, energy systems and military infrastructure. US officials have described this activity as the ‘preparation of the battlefield’, whereby China positions itself to disrupt Taiwan’s command-and-control, logistics and public services at the outset of any conflict.
The campaign extends well beyond conventional cyber espionage. Beijing has significantly expanded its use of information warfare. According to the National Security Bureau, over 2.15 million disinformation incidents targeting Taiwan were documented in 2024, a nearly twofold increase from the previous year. These efforts aim to undermine trust in Taiwan’s democratic institutions, weaken public morale and amplify narratives that serve Beijing’s interests—such as portraying the United States as an unreliable security partner or depicting Taiwan’s military as ineffective.
The methods used are diverse. They include AI-generated deepfakes, fake news websites, hijacked social media accounts and content farms. Many of the campaigns are designed to interfere in Taiwan’s domestic politics. During the 2024 presidential election, a coordinated wave of false claims—ranging from fabricated scandals to conspiracy theories about foreign interference—circulated on Facebook, TikTok, YouTube and Line, a Japanese messaging platform. Analysts have also observed a significant increase in disinformation targeting young Taiwanese audiences through Chinese platforms and short-video content.
Taiwan is observing spikes in cyberattacks linked to key events or cross-strait relations. According to data from Taiwan’s Ministry of Digital Affairs, July 2024 marked the highest monthly volume of recorded cybersecurity incidents on government agencies, coinciding with Taiwan’s Han Kuang military exercises. Attacks that month exploited outdated software components, weak access controls and encryption failures.
In September 2024, cyber activity surged again after President Lai Ching-te publicly suggested that, given historical border conflicts, it was China—not Taiwan—that should be in a territorial dispute with Russia. Shortly afterwards, the pro-Russian hacker group NoName057 appeared to retaliate by launching distributed denial-of-service attacks against Taiwanese government websites.
Meanwhile, April’s spike in malicious activity was partly attributed to the 3 April earthquake, which disrupted network availability and exposed latent vulnerabilities. Several government agencies reported malware infections following the incident, suggesting that hostile actors may have timed or adapted their operations to take advantage of the confusion and reduced monitoring capacity during disaster response efforts.
Cybersecurity incidents reported by Taiwan’s government agencies in 2024. Source: ASPI’s State of the Strait Database.
Taiwan’s response has been assertive, multifaceted and increasingly institutionalised. Recognising the scale of the threat, Lai’s administration has redefined cybersecurity as a matter of national defence. A new National Cybersecurity Strategy, released in April 2025, outlined a more proactive posture, including zero-trust architecture, quantum-resilient encryption and the creation of a Joint National Cybersecurity Center.
Taiwan’s approach is also notable for its emphasis on transparency and civil society involvement. Fact-checking organisations, such as the Taiwan FactCheck Center and Cofacts, counter online misinformation, while digital literacy campaigns aim to build cognitive resilience. These efforts are complemented by voluntary cooperation with platforms such as Meta and Line to flag and debunk false content in real time. Rather than adopting censorship-heavy models, Taiwan relies on openness, public trust and participatory defences to combat cognitive warfare.
International cooperation has further strengthened Taiwan’s cyber resilience. Taiwan regularly shares intelligence with the US, and its cybersecurity agencies maintain quiet but active cooperation with other allies.
Taiwan’s experience has positioned it as a model for democratic resilience in the face of authoritarian cyber pressure. Its policies, institutions and civil society initiatives are increasingly studied by governments and think tanks worldwide. Yet the threat is growing. Beijing’s cyber operations are becoming more frequent, more sophisticated and more intertwined with its broader political and military objectives. As Xi Jinping pushes toward his stated goal of ‘resolving’ the Taiwan question by 2027, Taiwan’s digital defences are likely to face even greater tests.
