Cyberattacks Surging Across Indo-Pacific, Researchers Warn

China and other nation-states are unleashing cyberattacks across the Indo-Pacific as Beijing, North Korea and their proxies use digital operations to expand influence and reshape regional norms.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Cybersecurity analysts from Japan, South Korea, Taiwan and the Philippines said Monday that regional governments are rushing to strengthen defenses while China probes cyber vulnerabilities amid a growing rift with the United States. Cyberattacks have surged 300% since 2023, with threat actors using artificial intelligence to deploy deepfakes and influence operations, said Sherin Ona, associate professor at De La Salle University.

“Most of these attacks are targeting government and educational institutions,” Ona said at a Center for a New American Security event on strengthening cyber partnerships in the Indo-Pacific. “This is indeed a deliberate and very organized effort – offensive cyber coupled with misinformation and malign influence operations.”

The CNAS event followed a yearlong study by the Washington think tank that combined desk research, fieldwork and expert workshops across the Indo-Pacific. The resulting report found most countries are the early stages of building cybersecurity resiliency. Report authors urged the United States to launch a “cyber shield” for allies, expand military cybersecurity ties with Taiwan and lead a regional strategy for resilient digital infrastructure.

The report also called on Japan, South Korea, Taiwan and the Philippines to mandate cybersecurity best practices across government, prioritize it in defense budgets and raise public awareness about the link between cyberattacks and national security. CNAS recommended that governments clarify legal and policy frameworks to enable forward-deployed teams from U.S. Cyber Command.

South Korea’s government has been “saying all the right things” but must take “more proactive and ambitious actions” to better protect its own critical infrastructure and that of the U.S., said Duyeon Kim, adjunct senior fellow with CNAS’ Indo-Pacific security program. Kim said North Korean-linked cyber operations have continued in recent years in ongoing campaigns with mixed success, forcing the government to take on a new, offensive cyber posture beginning in 2024.

“For a country that is so heavily wired like South Korea, these best practices are not actually practiced as widely as you would expect,” Kim said. South Korean industry representatives have also voiced the need to expand private sector budgets and the sector’s role in national cybersecurity.

“Right now, cybersecurity is centralized, with the government taking the lead,” she added. “Some companies are even envious of the United States, where tech companies can play a larger and often leading role in cybersecurity.”

Indo-Pacific governments have expanded cooperation with U.S. law enforcement in recent years to counter foreign cyberattacks. The U.S. has also adopted a more offensive approach, remotely disabling a Volt Typhoon hacking campaign identified by Microsoft in 2023 that targeted U.S. critical infrastructure and disrupted key facilities across the Indo-Pacific (see: FBI and DOJ Disrupt Chinese Hacking Operation).

The CNAS report urged the U.S. to “preserve and strengthen” the Department of State’s Bureau of Cyberspace and Digital Policy, calling it “highly effective at elevating cybersecurity and digital issues” in U.S. foreign policy. It called on the Trump administration to bolster the bureau by expanding the Cyber Capacity Building Fund and naming the bureau the lead coordinator for all civilian cyber engagement.

State has cut nearly 1,350 jobs in recent weeks, including intelligence analysts tracking conflicts like the Russia-Ukraine war and staff from the Bureau of Cyberspace and Digital Policy, which was moved under the Bureau of Economic Growth. The reorganization splits the bureau’s mission – shifting its economic role to one office and cybersecurity functions to another – despite warnings from staff and analysts the layoffs will undermine cyber diplomacy and hinder coordination with global partners (see: State Department Layoffs Are ‘Fracturing’ US Cyber Diplomacy).

CNAS recommended the U.S. scale joint military cyber operations with Taiwan – including expanded hunt forward deployments – authorities granted in the fiscal 2024 national defense authorization act. It should prioritize $300 million in defensive cyber capabilities through the new Taiwan Security Cooperation Initiative. It also called for expanded tabletop cyber exercises with Japan and South Korea.

“Indo-Pacific governments have taken historic steps to strengthen their resilience in a cyber landscape that has grown more varied, volatile and dangerous than ever,” the report states. “Still, these laudable efforts to bolster cyber policies, personnel and partnerships have failed to keep pace with rising threats.”