Critical Infrastructure Under Siege: Ransomware Groups Escalate Attacks in Southeast Asia

Executive Summary

In early 2026, Southeast Asia has witnessed a significant escalation in ransomware attacks targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. This surge poses substantial national security risks, necessitating immediate and coordinated responses from both governmental and private entities.

Current Threat Landscape

Between January and September 2025, global ransomware incidents targeting critical infrastructure sectors increased by 34% compared to the previous year. Notably, manufacturing experienced a 61% year-over-year surge in attacks. (prnewswire.com) Southeast Asia mirrored this trend, with Indonesia, Vietnam, and the Philippines reporting the highest numbers of ransomware attacks in the region. (securitybrief.asia)

Targeted Sectors and Impact

• Power Grids and Water Systems: Ransomware groups have increasingly targeted critical infrastructure, including energy grids and water treatment facilities. The Dragonfly 2.0 campaign, for instance, escalated its activities, shifting from reconnaissance to direct attacks on operational systems, particularly in power grids and water treatment facilities. (digitalxraid.com)

• Industrial Control Systems (ICS): The convergence of IT and OT has expanded attack surfaces, with ransomware groups exploiting vulnerabilities in ICS. A total of 119 ransomware groups targeting industrial organizations were tracked during 2025, representing a 49% increase from the previous year. (infosecurity-magazine.com)

• Healthcare Sector: Hospitals and medical service providers have been prime targets due to their reliance on uninterrupted operations. The BlackCat ransomware group, among others, conducted double extortion attacks, disrupting patient care and demanding high ransoms. (digitalxraid.com)

• Financial Sector: Financial institutions have faced a surge in ransomware attacks, with cybercriminals exploiting vulnerabilities to gain unauthorized access to sensitive financial data. The increasing sophistication of these attacks has led to significant financial losses and erosion of public trust.

Notable Threat Actors

• Royal (BlackSuit): Formed in 2022 and rebranded in 2024, Royal is known for aggressive targeting and high ransom demands, ranging from $1 million to $10 million in Bitcoin. The group has targeted various critical infrastructure sectors, including chemicals, communications, and healthcare. (en.wikipedia.org)

• Qilin: A Russian-speaking cybercrime organization linked to several incidents, including a ransomware attack on London hospitals. In 2025, Qilin claimed responsibility for attacks on Asahi, a major Japanese brewery, and infrastructure in the Hauts-de-France region in northern France. (en.wikipedia.org)

• UNC3886: An advanced persistent threat group affiliated with the Chinese government, active since at least late 2021, targeting critical infrastructure globally. In July 2025, Singapore's Coordinating Minister for National Security confirmed that the country's critical infrastructure was attacked by UNC3886. (en.wikipedia.org)

Implications and Recommendations

The escalation of ransomware attacks on critical infrastructure in Southeast Asia underscores the need for enhanced cybersecurity measures. Organizations must prioritize proactive preventative measures, maintain continuous real-time monitoring, and develop comprehensive incident response plans to detect and respond to cyber threats effectively. Collaboration between governmental agencies, private sector entities, and international partners is essential to strengthen the region's cyber resilience and safeguard national security.

Conclusion

The early 2026 landscape reveals a critical need for Southeast Asia to bolster its cybersecurity posture. The increasing sophistication and frequency of ransomware attacks targeting essential sectors necessitate a unified and strategic approach to mitigate risks and ensure the continuity of critical services.

Ransomware Attacks Surge in Southeast Asia's Critical Infrastructure:

• Southeast Asia hit by almost double the cyberattacks seen globally: Check Point - Techgoondu, Published on Monday, October 06
• Significant Rise in Ransomware Attacks Targeting Industrial Operations - Infosecurity Magazine, Published on Monday, February 16
• Global Ransomware Attacks Against Critical Industries Surge 34% in 2025, Published on Monday, October 20