Chinese State-Sponsored Hackers Target Semiconductor Industry with Weaponized Cobalt Strike

Proofpoint Threat Research has identified a sophisticated multi-pronged cyberespionage campaign targeting Taiwan’s semiconductor industry between March and June 2025.

Three distinct Chinese state-sponsored threat actors, designated as UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp, conducted coordinated phishing operations against organizations spanning semiconductor manufacturing, design, testing, supply chain entities, and financial investment analysts specializing in the Taiwanese semiconductor market.

The campaign’s primary motivation appears to be intelligence collection supporting China’s strategic priority to achieve semiconductor self-sufficiency and reduce dependence on international supply chains.

This activity coincides with increasing external pressures from US and Taiwanese export controls, reinforcing the critical importance of semiconductor technologies in China’s national economic development initiatives.

UNK_FistBump emerged as the most technically sophisticated actor, conducting employment-themed phishing campaigns targeting semiconductor manufacturing, packaging, testing, and supply chain organizations throughout May and June 2025.

Posing as graduate students from National Taiwan University seeking ...