Cybercriminals Intensify Attacks on South Asia's Critical Infrastructure

Executive Summary

In early 2026, cybercriminal groups have escalated their attacks on critical infrastructure across South Asia, focusing on sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These activities have led to significant disruptions, highlighting the region's vulnerability to cyber threats.

Targeted Sectors and Notable Incidents

• Power Grids: In January 2026, a cyberattack attributed to the "Werewolves" group targeted a major power grid in India, causing widespread outages in several states. The attack utilized ransomware to encrypt critical systems, demanding a substantial ransom for decryption keys. (ics-cert.kaspersky.com)

• Water Systems: In October 2025, Canadian authorities reported that hacktivists breached water facilities, tampering with water pressure valves and triggering false alarms. While this incident occurred outside South Asia, it underscores the global trend of cybercriminals targeting water infrastructure. (techradar.com)

• Industrial Control Systems (ICS): The first quarter of 2025 saw a surge in ICS attacks in South Asia, particularly targeting sectors like biometrics, building automation, and electric power. These attacks exploited vulnerabilities in SCADA systems, leading to operational disruptions. (ciso.economictimes.indiatimes.com)

• Healthcare: In December 2025, a ransomware attack attributed to the "Void Rabisu" group disrupted hospital operations in Pakistan, encrypting patient records and medical equipment controls. The attackers demanded a ransom in cryptocurrency, threatening to release sensitive medical data if their demands were not met. (ics-cert.kaspersky.com)

• Financial Sector: In June 2025, the "Werewolves" group launched a phishing campaign targeting financial institutions in Bangladesh, leading to unauthorized access to customer accounts and significant financial losses. The attackers employed social engineering tactics to deceive employees into revealing login credentials. (ics-cert.kaspersky.com)

Tactics, Techniques, and Procedures (TTPs)

Cybercriminal groups in South Asia have employed a variety of TTPs, including:

• Ransomware Deployment: Encrypting critical systems and demanding payment for decryption keys.

• Phishing Campaigns: Deceiving employees into revealing sensitive information through fraudulent communications.

• Exploitation of Vulnerabilities: Targeting known weaknesses in ICS and SCADA systems to gain unauthorized access.

Implications and Recommendations

The increasing frequency and sophistication of cyberattacks on critical infrastructure in South Asia pose significant risks to national security and economic stability. To mitigate these threats, the following measures are recommended:

• Enhanced Cybersecurity Measures: Implement robust security protocols, regular system updates, and employee training to recognize phishing attempts.

• Collaboration and Information Sharing: Establish partnerships between government agencies, private sector entities, and international organizations to share threat intelligence and best practices.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and coordinated reactions to cyber incidents.

By adopting these strategies, South Asian nations can strengthen their defenses against cybercriminal activities targeting critical infrastructure.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18
• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• Canadian government claims hacktivists are attacking water and energy facilities, Published on Friday, October 31