A recent investigation by the US Department of Justice revealed that the hacker group “Yamata Typhoon,” which had ties to the Chinese government, targeted energy infrastructure in the US and Taiwan, as well as Taiwanese universities, launching cyberattacks and stealing documents. The US seized related vulnerability scanning and phishing tools, but scholars point out that hackers can exploit software vulnerabilities to remain hidden, unlike in the past when they implanted programs, making them difficult to detect. Experts are calling for strengthened cybersecurity protection and enhanced cross-border detection and prevention capabilities.<\/p>\n
Transnational Hackers Reappear A recent investigation by the U.S. Department of Justice revealed that the transnational hacking group “Yamata Typhoon” attacked U.S. energy companies, several multinational NGOs, and airports in Japan and Poland; critical infrastructure in Taiwan, including electricity and natural gas, and two universities were also affected.<\/p>\n
According to U.S. analysis, “Yamata Typhoon” had close ties with the Chinese government; further, it was pointed out that the Chinese IT company “Yungshin Chihcheng Technology Group” provided the hacking group with technical tools capable of conducting large-scale vulnerability scans.<\/p>\n
Wang Po-Chi, associate professor of the Department of Criminal Justice at Ming Chuan University, analyzed, “Even if my company is sanctioned, they might be able to start anew and handle the situation again. Even within the same company, they might have other departments handling related tasks, and they might feel emboldened because while the company itself may be located here, the attack, website settings, or similar data center concepts are not physically located here.”<\/p>\n
In September 2024, the U.S. Department of Justice obtained court authorization to disrupt a botnet belonging to Yung-Hsin Technology Group, combating overseas cyberattacks. In January 2025, the State Department issued a statement indicating that it would impose sanctions on Yung-Hsin Technology Group.<\/p>\n
This time, the large-scale vulnerability scanning tool Microscan and the highly targeted phishing website tool FishHub were seized. However, the new form of cyberattacks is moving towards a division of labor, with perpetrators and data center networks scattered across various locations, increasing the difficulty of investigation.<\/p>\n
The novel attack method used in this “Yamata Typhoon” attack is difficult for conventional cybersecurity defenses to detect.<\/p>\n
Professor Yun-Nung Chen of the Department of Computer Science & Information Engineering at National Taiwan University pointed out, “The malware hides beneath the existing management software, using the normal software to perform malicious actions. For example, it downloads your data and sends it out. This makes it harder to detect because you won’t see any additional programs running; the programs are already there.”<\/p>\n
Cross-border hacker groups can scan the software, networks, and IoT systems of government departments, academic institutions, etc., to identify weaknesses in the technologies that automatically collect and exchange data. They then use these vulnerabilities and the collected intelligence to disable software, remotely control systems, and launch targeted spear-phishing attacks.<\/p>\n
Scholars warn that in addition to strengthening cybersecurity certifications, it’s crucial to continuously update protection mechanisms to prevent hackers from constantly outmaneuvering them. Criminologists call for international cooperation to establish transnational horizontal communication and prevention mechanisms.<\/p>\n