APT Groups Target Critical Infrastructure in South Asia Amid Rising Cyber Threats

Executive Summary

Advanced Persistent Threat (APT) groups have intensified cyber operations targeting critical infrastructure across South Asia. Sectors such as power grids, water systems, Industrial Control Systems (ICS), healthcare, and the financial sector are experiencing heightened risks. This briefing examines recent activities, identifies key threat actors, and provides recommendations to bolster cybersecurity defenses.

Recent Developments

In the first quarter of 2025, Kaspersky ICS CERT reported a surge in cyberattacks on Industrial Control Systems (ICS) within South Asia. The most targeted sectors included biometrics, building automation, and electric power, with manufacturing and construction also facing significant threats. (ciso.economictimes.indiatimes.com)

Notably, the SideWinder APT group, active since at least 2012, has expanded its focus to include nuclear power facilities in South Asia. This shift indicates a strategic move towards critical energy infrastructure, potentially aiming to gather sensitive information or disrupt operations. (kaspersky.com)

Key Threat Actors

• SideWinder: An APT group known for targeting government, military, and diplomatic entities, SideWinder has recently broadened its scope to include critical infrastructure sectors in South Asia. (kaspersky.com)

• Z-Pentest: A hacktivist group that has been active in compromising ICS across various sectors, including critical infrastructure, to advance its propaganda agendas. (scworld.com)

Technical Analysis

The convergence of Operational Technology (OT) and Information Technology (IT) has expanded the attack surface of ICS/SCADA systems. Threat actors exploit vulnerabilities such as unpatched software, insecure remote access, and weak authentication mechanisms to gain unauthorized access. Once inside, they can deploy malware designed to disrupt operations, manipulate control logic, or issue unauthorized commands, potentially leading to widespread service disruptions. (publicsafety.ieee.org)

Recommendations

1. Regular Security Assessments: Conduct comprehensive security evaluations of ICS/SCADA systems to identify and mitigate vulnerabilities.

2. Network Segmentation: Implement strict network segmentation between IT and OT networks to limit lateral movement of potential intruders.

3. Access Controls: Enforce robust authentication mechanisms and limit remote access to critical systems to authorized personnel only.

4. Incident Response Planning: Develop and regularly update incident response plans tailored to ICS environments to ensure swift and effective responses to cyber incidents.

5. Employee Training: Provide ongoing cybersecurity training to staff to recognize and respond to potential threats, including phishing attempts and social engineering tactics.

Conclusion

The escalation of cyberattacks targeting critical infrastructure in South Asia underscores the need for enhanced cybersecurity measures. By proactively addressing vulnerabilities and implementing robust defense strategies, organizations can mitigate risks and safeguard essential services against evolving cyber threats.

Highlights:

• Canadian government claims hacktivists are attacking water and energy facilities, Published on Friday, October 31