Proofpoint Warns of Growing Cyber Espionage in Taiwan

Singapore may have avoided a technical recession with a 1.4% rebound in Q2 GDP, but cybersecurity researchers at Proofpoint are warning of a growing external risk that could ripple across the region’s tech and trade sectors, including Singapore’s.

Proofpoint has released new insights uncovering a significant escalation in China-aligned cyber espionage operations targeting Taiwan’s critical semiconductor industry. The findings reveal a concerted and expanding effort by multiple state-sponsored threat actors to infiltrate and gather intelligence from this vital sector—a development that may have deeper implications for Singapore manufacturing resilience, supply chain stability, and economic momentum in the second half of 2025.

Notably, this surge in activity likely reflects China’s strategic imperative to achieve semiconductor self-sufficiency and reduce its reliance on international supply chains, especially considering recent US and Taiwanese export controls.

Key findings from the latest Proofpoint study include:

• At least three distinct China-aligned threat actors—UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp—targeted Taiwanese semiconductor firmsand ecosystem players in a series of highly targeted phishing campaigns between March and June 2025.
• Campaigns spanning the entire semiconductor ecosystem, from core manufacturing to specialised financial analysis, indicating a comprehensive intelligence gathering mandate.
• Threat actors leveraging employment-themed lures, fictitious collaboration proposals, and credential phishing, often using compromised university accounts or custom Adversary-in-the-Middle (AiTM) frameworks.
• Observations of the deployment of custom backdoors like Voldemort and HealthKick, alongside the use of legitimate tools for persistence and remote access, showcasing the adaptability of these groups.
• The analysis revealed shared infrastructure patterns, including the use of Russian VPS providers and SoftEther VPN servers, offering clues into the operational security of these state-backed groups.

For the full Proofpoint report, click HERE.