Critical Infrastructure Under Siege: Cybercriminals Escalate Attacks in Southeast Asia

Executive Summary

In early 2026, Southeast Asia has witnessed a significant escalation in cybercriminal activities targeting critical infrastructure sectors, including power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks have demonstrated increasing sophistication and coordination, posing a critical threat to national security and economic stability.

Current Threat Landscape

Cybercriminal groups have been observed deploying advanced tactics to infiltrate and disrupt critical infrastructure systems across Southeast Asia. Notably, the Agenda ransomware group, also known as Qilin, has been active since January 2025, affecting over 700 victims in 62 countries, primarily targeting organizations in developed markets and high-value industries, including manufacturing, technology, financial services, and healthcare. (ics-cert.kaspersky.com)

In the third quarter of 2025, hacktivist attacks on critical infrastructure surged, with such attacks accounting for 25% of all hacktivist activities by September. This trend indicates a near-doubling of attacks on ICS from the second quarter of 2025. (cyble.com)

Targeted Sectors

• Power Grids and Water Systems: Cybercriminals have increasingly targeted industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems within the energy and water sectors. These attacks have led to operational disruptions and raised concerns about potential physical damage. (thecyberexpress.com)

• Healthcare Sector: The healthcare industry has become a prime target for cybercriminals, with attacks leading to data breaches and operational disruptions. The value of personal data and research assets in this sector makes it an attractive target. (cyberproof.com)

• Financial Sector: Financial institutions, including banks and cryptocurrency exchanges, have been under constant assault from cybercriminals seeking financial gain. The increasing sophistication of these attacks poses significant risks to the stability of the financial system. (cyberproof.com)

Analytical Assessment

The convergence of rapid digitalization, geopolitical tensions, and fragmented governance in Southeast Asia has created a fertile ground for cybercriminal activities targeting critical infrastructure. The region's interconnectedness and reliance on digital systems amplify the impact of these attacks, making them a significant concern for national security and economic stability.

Recommendations

To mitigate the risks associated with cybercriminal attacks on critical infrastructure, the following measures are recommended:

1. Enhanced Cybersecurity Frameworks: Develop and implement comprehensive cybersecurity policies and frameworks tailored to the unique challenges of critical infrastructure sectors.

2. Public-Private Collaboration: Foster collaboration between government agencies and private sector entities to share threat intelligence and coordinate response efforts.

3. Regular Security Audits: Conduct regular security assessments and penetration testing to identify and address vulnerabilities within critical infrastructure systems.

4. Incident Response Planning: Establish and regularly update incident response plans to ensure a swift and coordinated reaction to cyber incidents.

5. Employee Training: Implement continuous training programs to raise awareness about cybersecurity best practices among employees, reducing the risk of social engineering attacks.

Conclusion

The escalation of cybercriminal attacks on critical infrastructure in Southeast Asia underscores the urgent need for robust cybersecurity measures. By adopting a proactive and collaborative approach, stakeholders can enhance the resilience of critical infrastructure systems against evolving cyber threats.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18
• Hackers, your game is over - US government announces 'strike force' to stamp out Southeast Asian cyber scams, Published on Sunday, November 16
• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05