On May 20, Taiwan’s President Lai Ching-te gave a speech to mark the completion of his first year in office, a period that has seen cross-strait tensions increase. Lai has toughened Taiwan’s stance toward Beijing, which has responded with greater military and gray zone pressure against the self-ruled island. The growing China-Taiwan tensions include both sides trading public accusations of cyberwarfare against each other’s critical infrastructure and private sectors.
Beijing recently accused Taiwan’s ruling Democratic Progressive Party (DPP) of sponsoring an unnamed foreign hacking organization to target a Chinese technology company. Chinese police said up to 1,000 military, energy, and government networks were also targeted by Taiwan. Earlier in March, the Chinese government alleged that Taiwanese intelligence officers had targeted Beijing’s infrastructure. Taipei has denied all of China’s cyberwarfare accusations and accused the mainland government of spreading disinformation about Taiwan.
China too faces many allegations from foreign governments and cybersecurity researchers that it has conducted multiple cyberattacks against Taiwan. A Chinese cyberthreat actor called Earth Ammit targeted supply chains in Taiwan’s drone and satellite sectors last year; a report in May also uncovered that Earth Ammit had infiltrated the island’s heavy industry, software, media and health care sectors. In January, Taiwan’s government estimated that the daily average number of Chinese attacks had doubled to 2.4 million in 2024, with a particular focus on government and telecommunication companies’ systems.
Shadowboxing: Gathering Intelligence for an Invasion
In part, China’s stepped up cyberattacks against Taiwan and its willingness to publicly blame the island for alleged cyberattacks against Chinese targets are straight from Beijing’s traditional playbook of pressuring Taipei below the threshold of military action. Beijing has made significant progress in isolating Taiwan diplomatically, with 70 countries endorsing China’s position that it is entitled to take “all” the efforts it needs to unify the island with the mainland.
But despite China’s growing military capabilities to launch a surprise attack, the majority of Taiwanese do not believe an invasion is imminent before 2030. This is because China’s long-term strategy has long been based on the notion it can divide Taiwan and undermine resistance there using economic coercion, military posturing, and psychological warfare to induce the island to surrender. Chinese cyberwarfare serves the dual purpose of weakening Taiwanese morale while helping China to gather intelligence for a worst-case invasion scenario.
This does not mean there is not a military aspect to China’s efforts to infiltrate Taiwanese digital networks beyond intelligence gathering or gray zone tactics to signal Beijing’s displeasure at recent actions by Taipei. China is likely attempting to cement its ability to sabotage or otherwise disrupt Taiwanese critical infrastructure in the event of a conflict with the island.
In that sense, China is replicating tactics also used against the United States. In 2023, senior U.S. officials, including the then-director of cybersecurity at the National Security Agency, Rob Joyce, warned that Chinese cyberoperations against the U.S. had taken a more aggressive turn. Instead of traditional information-gathering, U.S. cybersecurity teams said they had detected malicious code aimed at disrupting ordinary utilities in the United States, including Guam. China’s aim appeared to be to use malware to disrupt U.S. infrastructure in order to delay U.S. military deployments or resupply missions in the event of a Chinese attack on Taiwan. Cybersecurity researchers identified similar Chinese efforts aimed at Taiwan’s critical infrastructure in March.
China Not Yet Prepared to Invade Taiwan
Nevertheless, while China may be developing its offensive military cyberwarfare capabilities – as it is doing with other branches of its armed forces – U.S. intelligence does not believe it is yet ready to launch an invasion of Taiwan. U.S. Secretary of Defense Pete Hegseth warned at the Shangri-La Dialogue in Singapore in late May that Washington believes Beijing is an “imminent” threat to Taiwan, but also that China’s President Xi Jinping has given the People’s Liberation Army until 2027 to achieve the ability to successfully attack the island. Even after this point in time, China would not necessarily use its military to attack unless Xi felt it was important to do so; for example, if Beijing believed Taiwan was preparing to formally declare itself independent from the mainland.
A more important factor in China’s calculations over whether or not to risk an invasion of Taiwan is its perception of how strong U.S. military backing for the island remains. Therefore, Chinese intelligence gathering against the United States, including cyberespionage, is at least as relevant to Taiwanese security as the increase in Chinese cyberattacks against the island, or Beijing’s efforts to install malware in Taiwanese critical infrastructure.
While the current White House has pressured Taiwan with tariffs and demanded it move some semiconductor manufacturing to the United States, it does not appear that the U.S. plans to abandon its alliance with Taipei. As a result, a Chinese invasion does not appear likely in 2025, and the increased cyberattacks reported between China and Taiwan are likely to stay below the severity that would reach the threshold of an armed conflict.
Cyberthreats to Taiwan Will Remain Elevated
China-Taiwan tensions are likely to remain elevated in 2025, and with them a growing level of plausibly deniable cyberattacks and cyberespionage efforts by Beijing. Xi remains determined to unify Taiwan with China, in part due to his family’s political history and in part because he sees it as a personal political legacy. Moreover, the Chinese leader is in his early 70s and keen to escalate psychological pressure on Taipei to achieve reunification before old age impedes his abilities.
As a result, it is unlikely Beijing will reduce its present efforts to attack Taiwan’s government’s digital infrastructure this year. China will also continue more long-term efforts to infiltrate malware to disrupt critical infrastructure or gather information on Taiwanese strategic thinking.
Beijing will also be keen to publicize real or manufactured instances of Taiwanese cyberespionage or cyberattacks against the mainland. Such incidents will enable China to justify more aggressive actions against what its propaganda characterizes as a rogue separatist DPP regime running Taiwan. China has previously used the actions of Taiwanese or U.S. officials to launch military drills or other threatening actions against Taiwan. For example, China launched extremely disruptive live-fire exercises around Taiwan in 2022 when then-U.S. Speaker of the House Nancy Pelosi visited the island. If Beijing can point to a real or manufactured Taiwanese-linked cybersecurity incident on the mainland, then this too could serve as a pretext to stage more threatening military drills or other measures, such as further economic restrictions.
Beijing is likely to publish more incidents in state media this year in which it claims Taiwan has attacked it or conducted cyberespionage activities. These claims will serve a domestic and a foreign policy purpose, with the former justifying Beijing’s national security-led approach to data protection and digital technologies, and the latter buttressing its hostile diplomacy against Taiwan.
At the same time, China is likely to continue its cyberattacks and cyberespionage against both the United States and Taiwan, seeing these as useful ways to pressure both governments into accepting China’s demands that neither will seek to change the current stalemate that prevails across the Taiwan Strait. China calculates that in the longer term this stalemate can be broken in its favor; Beijing is convinced that time is on its side as U.S. power weakens while Chinese capabilities grow.
In the meantime, given the current U.S. administration has signaled it continues to back Taiwan despite its more overt isolationist and transactional foreign policy, it is unlikely that China will carry out a cyberattack that would severely cripple either the U.S. or Taiwanese economy and infrastructure, thus precipitating a major security crisis in the Taiwan Strait.