Critical Infrastructure Under Siege: Cybercriminals Target South Asia's Vital Sectors

Executive Summary

As of March 2026, cybercriminal activities targeting critical infrastructure in South Asia have escalated, with significant implications for national security and economic stability. Key sectors under threat include power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector.

Current Threat Landscape

Recent reports indicate a surge in cyberattacks against South Asia's critical infrastructure. In the first quarter of 2025, the highest number of attacks on ICS targeted sectors such as biometrics, building automation, and electric power. Notably, nearly one in five ICS systems in India experienced malicious activity during this period. (ciso.economictimes.indiatimes.com)

Targeted Sectors

• Power Grids: Cybercriminals have increasingly targeted power grids, aiming to disrupt electricity supply and cause widespread outages. The 2015 Ukraine power grid hack serves as a precedent, where attackers remotely compromised energy distribution companies, leading to power outages for approximately 230,000 consumers. (en.wikipedia.org)

• Water Systems: The water sector is also at risk, with cybercriminals exploiting vulnerabilities in water utilities to gain unauthorized access. Chinese state-sponsored actors, including Volt Typhoon, have been observed conducting reconnaissance and gaining access to water utilities in the U.S., highlighting the global nature of this threat. (falconfeeds.io)

• Industrial Control Systems (ICS): ICS environments are prime targets due to their critical role in managing industrial processes. Malware frameworks like Pipedream have been developed to target programmable logic controllers (PLCs) and ICS devices, enabling cybercriminals to compromise and control these systems. (en.wikipedia.org)

• Healthcare Sector: Healthcare organizations are increasingly targeted by cybercriminals seeking to steal sensitive patient data and disrupt medical services. The rise in ransomware attacks has significantly impacted healthcare providers, leading to operational disruptions and data breaches.

• Financial Sector: The financial sector remains a prime target for cybercriminals aiming to steal funds and sensitive financial data. The 2016 Bangladesh Bank robbery, where attackers attempted to steal nearly $1 billion, underscores the severity of such threats. (en.wikipedia.org)

Notable Threat Actors

While specific details on cybercriminal groups targeting South Asia's critical infrastructure are limited, global trends indicate that state-sponsored actors and sophisticated cybercriminal groups are increasingly targeting critical infrastructure worldwide. For instance, Russian hacktivist groups like Z-Pentest have been observed targeting oil, gas, and water sectors globally, including in the United States. (scworld.com)

Conclusion

The escalation of cybercriminal activities targeting critical infrastructure in South Asia necessitates immediate and coordinated responses. Stakeholders across government, industry, and the cybersecurity community must collaborate to enhance the resilience of critical infrastructure against cyber threats. Implementing robust cybersecurity measures, conducting regular vulnerability assessments, and fostering information sharing are essential steps to mitigate the risks posed by these evolving cyber threats.

Recent Cyberattacks on Critical Infrastructure in South Asia:

• Surge in ICS Attacks: Biometrics and Building Automation at Highest Risk in South Asia, ETCISO, Published on Tuesday, July 08
• Russian hacktivists target oil, gas and water sectors worldwide | SC Media, Published on Sunday, December 08