Key Takeaways
- Taiwan’s Ministry of Digital Affairs disclosed that government agencies faced AI‑assisted cyberattacks from an overseas source in July, which were successfully contained.
- The attacks combined manual hacking with AI‑agent tools (e.g., Open Claw) and displayed clear hallmarks of a foreign‑origin campaign.
- Taiwan has long warned of China’s “hybrid warfare” that blends military drills, disinformation, and cyber operations; in 2025 Chinese‑origin cyberattacks on critical infrastructure rose 6% to an average of 2.63 million per day.
- Following the incident, the government issued protective guidelines, intensified system monitoring, and pledged early‑blocking measures across all agencies.
- An Israeli cybersecurity firm, Dream, later revealed a similar AI‑driven campaign that stole credentials, justice‑ministry personnel records, and scanned Taiwan’s nuclear safety agency, implicitly pointing to Taiwan as the target.
Overview of the July Cyber Incident
In late July, Taiwan’s Ministry of Digital Affairs announced that its cybersecurity monitoring units had detected an “abnormal attack” targeting multiple government agencies. The alert came from the National Institute of Cyber Security, which began issuing warning notices on July 20 as investigators traced the activity. Officials emphasized that the affected bodies had “successfully handled” the incident, minimizing any disruption to public services. The disclosure highlighted the growing sophistication of threats confronting Taiwan’s digital infrastructure.
Details from the Ministry’s Investigation
The ministry’s subsequent investigation revealed that the attack bore clear signs of an overseas source. Hackers employed a hybrid methodology that blended traditional manual techniques with AI‑agent‑assisted tools, specifically referencing a framework dubbed “Open Claw.” This combination allowed the adversaries to automate reconnaissance, credential harvesting, and lateral movement while retaining human oversight for adaptive decision‑making. The ministry confirmed that the attack’s origin, tactics, techniques, and scope had been fully mapped, and that all compromised units had completed remediation steps.
Context of Taiwan’s Hybrid Warfare Concerns
Taiwanese authorities have repeatedly warned that China is waging a hybrid warfare campaign against the island. This strategy includes near‑daily military drills in the Taiwan Strait, pervasive disinformation operations, and sustained cyber intrusions aimed at weakening societal resilience. The July AI‑assisted intrusion fits within this broader pattern, illustrating how Beijing’s coercive toolkit now incorporates advanced automation to amplify pressure on Taipei’s democratic institutions.
Statistics on Chinese‑Origin Cyberattacks
Supporting the ministry’s claims, Taiwan’s National Security Bureau reported in January 2025 that Chinese‑origin cyberattacks on key infrastructure—spanning hospitals, banks, energy grids, and telecommunications—had increased by 6 % compared with the previous year. The bureau noted an average of 2.63 million attack attempts per day, with a noticeable spike in incidents timed to coincide with Chinese military exercises, suggesting a deliberate synchronization of kinetic and cyber pressure.
Timeline of the July Incident
The anomaly was first spotted by monitoring systems in early July, prompting the National Institute of Cyber Security to issue a series of alerts beginning July 20. Over the ensuing days, investigators collected logs, malware samples, and network traffic data to reconstruct the attack chain. By the end of the month, the ministry confirmed that the threat had been neutralized, affected agencies had restored normal operations, and preventive measures were being rolled out government‑wide.
Nature of the AI‑Assisted Techniques
The attackers leveraged AI agents to automate labor‑intensive phases of the intrusion, such as password spraying, credential stuffing, and vulnerability scanning. These agents operated under a coordinated framework—referred to by officials as Open Claw—allowing them to share intelligence in real time and adapt tactics based on defensive responses. Human operators oversaw high‑level decision‑making, ensuring the campaign could pivot when encountering unexpected obstacles, thereby increasing its overall effectiveness and stealth.
Government Response and Preventive Measures
In reaction to the AI‑enhanced threat, Taiwan’s Ministry of Digital Affairs issued new protective guidelines for all government entities. These directives emphasize heightened monitoring of anomalous login attempts, enforcement of multi‑factor authentication, and regular red‑team exercises that simulate AI‑driven attack vectors. The ministry also announced investments in AI‑based anomaly detection tools designed to identify malicious agent behavior before it can achieve its objectives, aiming to block intrusions at the earliest possible stage.
Dream’s Independent Report and Its Implications
A day after Taiwan’s announcement, Israeli cybersecurity firm Dream published a blog post detailing an AI‑driven hacking campaign it had uncovered. According to Dream, a swarm of AI agents had extracted scores of passwords from unidentified officials, exfiltrated personnel records from Taiwan’s justice ministry, and scanned the island’s nuclear safety agency for exploitable weaknesses over a four‑day window. Although Dream declined to name the victim government, the Financial Times identified the targeted agencies as Taiwanese, corroborating the ministry’s narrative and underscoring the transnational reach of such AI‑enabled operations.
Broader Significance for Cybersecurity Strategy
The July incident and Dream’s subsequent disclosure illustrate a clear evolution in the threat landscape: adversaries are increasingly integrating artificial intelligence to scale and sophisticate cyber offensives. For Taiwan, this reinforces the urgency of treating cybersecurity as a core component of national defense, on par with traditional military readiness. Continuous investment in AI‑driven detection, international information sharing, and rigorous hygiene practices will be essential to deter future hybrid threats that seek to exploit both technological and geopolitical vulnerabilities.
Conclusion
Taiwan’s experience with AI‑assisted cyberattacks in July serves as a stark reminder that modern conflict now routinely blends kinetic, informational, and digital domains. The swift containment of the breach demonstrates the effectiveness of existing monitoring mechanisms, yet the rising volume and sophistication of Chinese‑origin cyber operations demand sustained vigilance. By strengthening protective frameworks, adopting advanced AI‑based defenses, and maintaining transparent communication with allied cybersecurity firms, Taiwan aims to safeguard its critical infrastructure and democratic governance against an evolving hybrid threat landscape.