Cybersecurity company Proofpoint has revealed a significant increase in cyber espionage campaigns linked to China, specifically targeting Taiwan’s semiconductor industry.
Between March and June 2025, Proofpoint’s threat analysis team identified at least three distinct groups—known as UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp—that carried out highly targeted phishing attacks against multiple Taiwanese industry stakeholders, including manufacturers, designers, testing laboratories, supply chain providers, and financial analysts. This wide range of targets reflects a coordinated effort to gather critical information across the semiconductor ecosystem.
The attackers employed sophisticated techniques, using themes related to fake job offers and collaborations to lure victims, as well as credential theft tactics like Adversary-in-the-Middle espionage. To maintain control over compromised systems, they deployed custom backdoors named Voldemort and HealthKick, and utilized legitimate tools to ensure persistence and remote access. Technical analysis also uncovered shared infrastructure, including VPS server providers in Russia and the SoftEther VPN technology, shedding light on the organization and security measures behind these campaigns.
Proofpoint states that this surge in espionage activities is driven by China’s strategic need to reduce its technological dependence in the semiconductor sector, especially following recent export restrictions imposed by the United States and Taiwan.
Mark Kelly, Threat Researcher at Proofpoint, remarks:
“The semiconductor industry is critical to global supply chains and national security, making it a priority target for intelligence operations. We expect these groups, along with others sponsored by China, to continue their cyber espionage efforts in this area.”
This trend aligns with China’s long-standing strategy of prioritizing technological self-sufficiency and gathering intelligence to bolster its national capabilities.