Taiwan targeted by large-scale cyberattack campaign against sensitive IT systems

A newly identified cybercriminal group known as HoldingHands, likely linked to China, has launched a major cyberespionage campaign targeting Taiwan’s government agencies, strategic industries, and critical infrastructure.

According to a report published by cybersecurity firm Fortinet on June 17, 2025, the attackers infiltrated sensitive information systems through phishing campaigns aimed at professionals in both the public and private sectors with access to key infrastructure. While Fortinet did not quantify the full scope of the operation, it characterized the campaign as both sophisticated and covert.

HoldingHands reportedly deployed three main types of malware:

Winos 4.0, a modular tool capable of keylogging and privilege escalation
HoldingHands RAT, a custom-built remote access trojan that allows full control over compromised machines
Gh0stCringe, a data exfiltration tool derived from Gh0st RAT, which has previously been used by China-affiliated actors

The infections were marked by their stealth and the systematic installation of backdoors. Fortinet analysts believe the group’s primary objective is long-term access to Taiwan’s sensitive IT systems, likely to exploit them in the event of a geopolitical crisis.