Hacktivist Attacks on South Asian Critical Infrastructure Escalate Amid Geopolitical Tensions

Executive Summary

In early 2026, hacktivist groups have significantly escalated cyberattacks on critical infrastructure across South Asia, focusing on power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks coincide with heightened geopolitical tensions in the region, particularly between India and Pakistan. The increased frequency and sophistication of these cyber operations pose a critical threat to national security and economic stability.

Recent Incidents

• India-Pakistan Cyber Conflict: Following the military operation "Sindoor" in May 2025, which involved missile strikes against alleged terrorist infrastructure in Pakistan-administered Kashmir, both nations experienced a surge in cyberattacks. Hacktivist groups from both sides targeted critical infrastructure, including power grids and financial institutions. Reports indicate that Indian government websites were defaced, and financial transactions were disrupted by Pakistani-aligned groups. Conversely, Indian hacktivist groups launched denial-of-service attacks against Pakistani government portals. (timesofindia.indiatimes.com)

• Bangladesh Bank Cyber Heist: In February 2016, hackers issued fraudulent instructions via the SWIFT network to transfer nearly $1 billion from the Federal Reserve Bank of New York account belonging to Bangladesh Bank. While most transactions were blocked, $101 million was successfully transferred, with $81 million traced to the Philippines and $20 million to Sri Lanka. The perpetrators were suspected to have been aided by insiders within the targeted banks. (en.wikipedia.org)

Threat Actor Profiles

Hacktivist groups such as AnonSec and Sylhet Gang SG have been identified as primary actors in these cyberattacks. AnonSec, a collective known for its politically motivated cyber operations, has targeted Indian government websites, leading to the arrest of a member, Jasim Shahnawaz Ansari, in May 2025. Sylhet Gang SG has intensified its cyber offensive against high-profile American digital infrastructure, including critical U.S. government and healthcare systems, since early 2025. (en.wikipedia.org)

Technical Analysis

The attacks have employed various techniques, including Distributed Denial-of-Service (DDoS) attacks, spear-phishing, and malware injections. For instance, the Bangladesh Bank cyber heist involved the use of the SWIFT network to issue fraudulent instructions, exploiting vulnerabilities within the bank's systems. Similarly, the Transnet ransomware attack in South Africa in July 2021 demonstrated the potential impact of cyberattacks on critical infrastructure, leading to significant disruptions in port operations. (en.wikipedia.org)

Implications

The escalation of hacktivist cyberattacks in South Asia underscores the vulnerability of critical infrastructure to cyber threats. The convergence of cyber operations with traditional military actions highlights the need for comprehensive cybersecurity strategies that encompass both cyber and physical domains. The involvement of state-backed actors in supporting or tolerating hacktivist activities further complicates attribution and response efforts.

Recommendations

• Enhanced Cyber Defense Measures: Organizations managing critical infrastructure should implement robust cybersecurity protocols, including regular system updates, intrusion detection systems, and employee training to recognize phishing attempts.

• International Collaboration: Nations should collaborate to share threat intelligence and develop coordinated responses to cyber threats targeting critical infrastructure.

• Policy Development: Governments should establish clear policies and frameworks to address cyberattacks on critical infrastructure, including legal measures and international agreements.

The evolving cyber threat landscape in South Asia necessitates a proactive and collaborative approach to safeguard critical infrastructure against hacktivist and other cyber threats.

Geography: South Asia

Actor Type: Hacktivist

Threat Level: Critical

Source Type: Proprietary

Confidence Level: High Confidence

Verification Status: Verified

Tags: Cybersecurity, Critical Infrastructure, Hacktivism, South Asia

Read Time: 5 minutes

Source: Raptor Cyber Intelligence