Desk live·
ForensicPost
Nation-state/Espionage/File 25-1213

Chinese Espionage Campaigns Targeted Southeast Asia Across Four Sectors in 2025

Chinese espionage campaigns through 2025 targeted government, manufacturing, telecommunications and media across Southeast Asia, Hong Kong and Taiwan. The sector list is the same one filed at 25-0725.

Constructed geometry · not a chart of case data
JurisdictionTaiwanthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetSoutheast Asian organisations
ActorChinese state-linked actors
D. Kennedy & S. Rosler12 min readConfidence: medium2 sources reviewed

Reporting through 2025 describes ongoing Chinese cyber espionage campaigns targeting government, manufacturing, telecommunications and media organisations across Southeast Asia, Hong Kong and Taiwan.

The Same Four Categories, In A Different Region

At 25-0725 this desk analysed a target list of telecom, government, transportation, lodging and military, and argued the combination points at pattern-of-life collection rather than at any individual dataset’s value.

This list substitutes manufacturing and media for transportation and lodging, and the logic holds. Government supplies intent. Telecom supplies who talks to whom. Manufacturing supplies industrial and supply-chain position. Media supplies the reporting apparatus — sources, unpublished material, and the identity of people talking to journalists.

None of the four is chosen for resale value. It is collection.

Media Is The Target With The Sharpest Human Consequence

A newsroom’s systems hold source contacts, unpublished drafts and the record of who spoke to whom. In jurisdictions where speaking to a journalist carries risk, that is not a data-protection matter.

It is the same structure as the research association at 25-0408: an institution whose correspondence is worth far more than the institution, holding information about people who never chose to be in a database and cannot be safely notified.

And The Corpus Can Say Almost Nothing More

No named victims, no affected counts, no dates, no disclosure filings. The four filters at 25-0502 apply in full: limited mandatory disclosure, no collective redress, thinner regional research coverage, and reporting largely not in English.

Graded medium. This file records a campaign shape, and the absence of everything else in it is a fair illustration of the coverage problem at 25-1225.

How we reported this

Compiled from published incident tracking, listed below. Attribution follows those assessments. No victims are named and no scope is established. Corrections: corrections@forensicpost.com.

Sources
  1. Significant cyber incidentsCSIS
  2. Asia and South Pacific cyber threat assessment report 2025/2026INTERPOL
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary