APT Groups Target Critical Infrastructure in South Asia Amid Rising Cyber Threats

Executive Summary

Advanced Persistent Threat (APT) groups have escalated cyber operations targeting critical infrastructure across South Asia. These sophisticated attacks aim to disrupt essential services, steal sensitive information, and potentially cause physical damage. Notable incidents in early 2026 highlight the evolving threat landscape and the need for enhanced cybersecurity measures.

Key Developments

1. SideWinder's Shift to Nuclear Infrastructure

   In March 2025, Kaspersky's Global Research and Analysis Team (GReAT) reported that the Pakistani-linked APT group SideWinder expanded its focus to include nuclear power facilities in South Asia. This strategic pivot underscores the group's intent to infiltrate critical energy infrastructure, potentially compromising national security. (kaspersky.com)

2. UAT-7290's Attacks on Telecommunications and Critical Infrastructure

   Since at least 2022, the Chinese-affiliated APT group UAT-7290 has been targeting telecommunications companies and critical infrastructure entities across South Asia. Their operations involve meticulous planning and technical reconnaissance, aiming to disrupt communication networks and access sensitive data. (cybersecuritynews.com)

3. APT36's Campaigns Against Indian Infrastructure

   APT36, also known as Transparent Tribe, has been active in targeting Indian government and military networks. Their campaigns have expanded to include sectors such as railways, oil and gas, and the Ministry of External Affairs, utilizing advanced phishing techniques and novel payload strategies. (ics-cert.kaspersky.com)

Technical Analysis

These APT groups employ a range of sophisticated tactics to infiltrate and exploit critical infrastructure:

• Phishing and Social Engineering: Deceptive emails and messages are used to trick individuals into revealing credentials or downloading malicious payloads.

• Exploitation of Vulnerabilities: Unpatched software and hardware vulnerabilities are targeted to gain unauthorized access to systems.

• Advanced Malware Deployment: Custom malware, such as the Poseidon backdoor used by APT36, is deployed to maintain persistence and facilitate lateral movement within networks. (ics-cert.kaspersky.com)

• Targeted Attacks on Industrial Control Systems (ICS): Malware like VoltRuptor has been identified as capable of manipulating SCADA interfaces, leading to power outages and exposing systemic flaws in utilities. (geopoliticalmatters.com)

Implications for Critical Infrastructure

The targeting of critical infrastructure by APT groups poses several risks:

• Service Disruption: Attacks can lead to prolonged outages in essential services, affecting millions of people.

• Data Breaches: Sensitive information, including personal data and strategic plans, can be stolen and exploited.

• Physical Damage: Manipulation of ICS can result in physical damage to facilities, environmental hazards, and potential loss of life.

Recommendations

To mitigate these threats, organizations should consider the following measures:

• Regular Vulnerability Assessments: Conduct thorough and frequent assessments to identify and patch vulnerabilities.

• Employee Training: Implement comprehensive training programs to recognize phishing attempts and social engineering tactics.

• Advanced Threat Detection: Deploy sophisticated monitoring tools to detect and respond to anomalous activities in real-time.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and coordinated reactions to cyber incidents.

Conclusion

The increasing sophistication and frequency of APT attacks on critical infrastructure in South Asia highlight the urgent need for robust cybersecurity strategies. Proactive measures, continuous vigilance, and international collaboration are essential to safeguard vital services and national security.

Highlights:

• Kaspersky GReAT uncovers SideWinder APT's pivot to nuclear infrastructure targets, Published on Sunday, March 09
• UAT-7290 Hackers Attacking Critical Infrastructure Entities in South Asia, Published on Wednesday, January 07
• APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT, Published on Sunday, November 30