Chinese state-sponsored hackers have delivered an unprecedented cyber attack on Taiwan’s semiconductor industry through highly sophisticated espionage campaigns that penetrate the global technology supply chain and reveal essential weaknesses in the globe’s leading-edge chip-manufacturing ecosystem. The simultaneous attacks by at least three different hacking groups are a shocking intensification of China’s campaign to pilfer semiconductor technology and become technology-insular, attacking everything from top chipmakers to industry-tracking investment analysts. This cyber assault occurs as Beijing struggles to fight increasing US export restrictions and aims to decouple its economy from foreign chip technology, and the Taiwanese semiconductor industry is a high-value target for industrial espionage that may reconfigure international technological balance.
Escalating Cyber Espionage Campaigns
Chinese-linked hackers are targeting the Taiwanese semiconductor industry and investment analysts as part of a string of cyber espionage campaigns, researchers said on Wednesday.
While hacking to steal data and information about the industry is not new, there is an increase in sustained hacking campaigns from several China-aligned hacking groups, researchers with cybersecurity firm Proofpoint said in a new analysis.
“We’ve seen entities that we hadn’t ever seen being targeted in the past being targeted,” said Mark Kelly, a threat researcher focused on Chinese-related threats at Proofpoint.
The previously unreported hacking campaigns were carried out by at least three distinct Chinese-linked groups primarily between March and June of this year, with some activity likely ongoing, Proofpoint said. They come amid rising restrictions by Washington on exports to China of U.S.-designed chips that are often manufactured in Taiwan. China’s chip industry has been working to replace its dwindling supply of sophisticated U.S. chips, especially those used in artificial intelligence.
Targeting Methods and Scope
The researchers declined to identify the hacking targets, but told Reuters that approximately 15 to 20 organizations ranging from small businesses, analysts employed by at least one U.S.-headquartered international bank, and large global enterprises faced attacks.
Major Taiwanese semiconductor firms include Taiwan Semiconductor Manufacturing Co 2330.TW, MediaTek 2454.TW, United Microelectronics Corp 2303.TW, Nanya Technology 2408.TW and RealTek Semiconductor 2379.TW. TSMC declined to comment. MediaTek, UMC, Nanya and RealTek did not respond to requests for comment.
Reuters was unable to identify the specific hacking targets or determine whether any of the efforts were successful.
A spokesperson for the Chinese embassy in Washington told Reuters in an email that cyber attacks “are a common threat faced by all countries, China included,” and that the Asian country “firmly opposes and combats all forms of cyber attacks and cyber crime — a position that is consistent and clear.”
Attack Methodologies
The activity ranged from one or two emails sent as part of the more targeted campaign focused on specific people, to as many as 80 emails when trying to gain information from the company at large, Kelly said.
One group targeted semiconductor design, manufacturing and supply-chain organizations using compromised Taiwanese university email accounts to pose as job seekers and send malware via PDFs with URLs leading to malicious files, or a password-protected archive.
Another targeted financial analysts at major unnamed investment firms focused on the Taiwanese semiconductor industry by posing as a fictitious investment firm and seeking collaboration. Two of the entities are based in Asia, while the third is based in the U.S. The FBI declined to comment.
Industry Response and Broader Implications
A representative of TeamT5, a cybersecurity firm based in Taiwan, told Reuters that it had also seen an increase in emails being sent targeting the semiconductor industry tied to a few hacking groups, “but not a wide or general phenomenon.”
Targeting of semiconductors and the supply chain around them “is a persistent threat that has existed for long,” the representative said, and a “constant interest” for Chinese-related advanced hacking operators.
These groups often target “peripheral suppliers or related industries,” the representative said, such as a situation in June where a China-linked hacking group identified by TeamT5 as “Amoeba” launched a phishing campaign against an unnamed chemical company that plays a critical role in the semiconductor supply chain.
The concerted onslaught of Chinese cyber attackers against Taiwan’s microchip sector is a clear and present threat to the security of the technology worldwide, illustrating how cyber war has become the new battleground for technological hegemony for the superpowers. As these new-generation campaigns expand and become more advanced, they risk not only individual firms but the very foundation of the global semiconductor supply chain that underpins everything from military equipment to smartphones. The semiconductor industry must move quickly to strengthen its cybersecurity stance and cross-country cooperation to combat this emerging threat before technologies at the foundation are turned against us.
GCN.com/Reuters.