Cybercriminals Target South Asia's Critical Infrastructure Amid Rising Threats

Executive Summary

Cybercriminal activities targeting critical infrastructure in South Asia have escalated, with notable attacks on power grids, water systems, industrial control systems (ICS), healthcare facilities, and the financial sector. These incidents underscore the vulnerabilities within the region's essential services and highlight the need for enhanced cybersecurity measures.

Recent Incidents

• Industrial Control Systems (ICS) Attacks: In the first quarter of 2025, South Asia experienced a surge in ICS attacks, particularly affecting sectors such as biometrics, building automation, and electric power. Manufacturing industries also reported high levels of malicious activity. Kaspersky's ICS CERT recommended regular security assessments and timely updates to protect critical infrastructure. (ciso.economictimes.indiatimes.com)

• Ransomware Attacks: The 'Werewolves' ransomware group, active since 2023, has been targeting various sectors, including banks, industrial enterprises, and retailers. Their attacks involve sending malicious emails with legal and financial-related subjects, leading to significant disruptions. (ics-cert.kaspersky.com)

• Hacktivist Activities: Hacktivist groups have shifted tactics, moving beyond traditional DDoS attacks to more advanced intrusions and data breaches. In the second quarter of 2025, ICS attacks, data leaks, and access-based intrusions constituted 31% of hacktivist activity, marking a 29% increase from the first quarter. (industrialcyber.co)

Vulnerabilities and Exploitation

Cybercriminals are increasingly targeting cyber-physical systems, exploiting exposed internet-facing devices, including Human Machine Interfaces (HMIs) and SCADA assets. Research indicates that 82% of attacks against cyber-physical systems involve using Virtual Network Computing (VNC) protocol clients to remotely access these assets. Additionally, 66% of incidents include the compromise of HMIs or SCADA systems that control industrial processes. (prnewswire.com)

Implications for Critical Infrastructure

The escalating cyber threats pose significant risks to South Asia's critical infrastructure:

• Power Grids: Attacks on power grids can lead to widespread outages, affecting millions and disrupting daily life.

• Water Systems: Compromises in water treatment and distribution can contaminate water supplies, posing public health risks.

• Healthcare Facilities: Cyberattacks on healthcare systems can disrupt medical services, delay treatments, and compromise patient data.

• Financial Sector: The financial sector is a prime target for cybercriminals seeking financial gain, with attacks potentially leading to significant economic losses.

Recommendations

To mitigate these threats, the following measures are recommended:

• Regular Security Assessments: Conduct periodic security evaluations to identify and address vulnerabilities in critical infrastructure.

• Timely Updates and Patching: Ensure that all systems, especially ICS and SCADA, are updated with the latest security patches.

• Enhanced Monitoring: Implement continuous monitoring to detect and respond to suspicious activities promptly.

• Employee Training: Educate staff on cybersecurity best practices to prevent social engineering attacks.

Conclusion

The rise in cybercriminal activities targeting South Asia's critical infrastructure necessitates a proactive and coordinated response. By strengthening cybersecurity measures and fostering collaboration among stakeholders, the region can enhance its resilience against evolving cyber threats.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18