Mercenary Spyware and Exploit Brokers: A Rising Threat in Southeast Asia

Introduction

In recent years, Southeast Asia has witnessed a surge in cyber activities involving mercenary spyware and exploit brokers. These entities, often operating covertly, provide sophisticated surveillance tools and services to various clients, including state and non-state actors. Their operations pose significant cybersecurity risks to the region's governments, organizations, and individuals.

Mercenary Spyware in Southeast Asia

Mercenary spyware refers to surveillance software developed and sold by private companies to government agencies and other clients. One notable example is the Predator spyware developed by the Intellexa Consortium. In 2025, leaked internal documents exposed the operational details of Predator, revealing its use in targeted surveillance campaigns. (securitylab.amnesty.org)

In Southeast Asia, countries like Indonesia have been identified as users of such surveillance technologies. Amnesty International's investigation in 2024 uncovered a network of spyware exports to Indonesia, involving entities like Q Cyber Technologies SARL and the Intellexa Consortium. These tools have been deployed by Indonesian state agencies, raising concerns about human rights and privacy. (amnesty.org)

Exploit Brokers and Commercial Offensive Tools

Exploit brokers are intermediaries who discover, develop, and sell zero-day vulnerabilities to the highest bidder. Companies like Candiru, based in Israel, have been linked to such activities. Candiru's spyware, known as DevilsTongue, has been used in various cyber-espionage campaigns targeting government entities and individuals. (en.wikipedia.org)

The proliferation of commercial offensive tools has democratized cyber capabilities, enabling a broader range of actors to conduct sophisticated cyber operations. This trend has been observed globally, with various threat actors leveraging these tools for espionage, data theft, and disruption.

Red Team Frameworks and Surveillance-as-a-Service

Red team frameworks are structured approaches to simulating adversary tactics, techniques, and procedures to assess an organization's security posture. The emergence of surveillance-as-a-service models has blurred the lines between legitimate security assessments and offensive cyber operations. This shift has raised ethical and legal questions about the use of such services, especially when they are employed for unauthorized surveillance.

Recent Trends in Southeast Asia

Vietnam has experienced a significant increase in spyware attacks, ranking second in Southeast Asia after Singapore. In the first half of 2025, Kaspersky blocked over 190,000 spyware attacks targeting Vietnamese organizations, marking a 78.8% increase from the previous year. (e.vnexpress.net)

Advanced Persistent Threat (APT) groups, such as Gelsemium, have been observed targeting Southeast Asian government entities. In late 2022 and early 2023, Gelsemium deployed web shells and backdoors to establish persistence and collect intelligence, indicating a sophisticated level of cyber-espionage activity in the region. (securityweek.com)

Conclusion

The activities of mercenary spyware providers and exploit brokers in Southeast Asia represent a growing cybersecurity threat. The region's governments and organizations must enhance their cybersecurity measures, promote transparency in surveillance practices, and collaborate internationally to address the challenges posed by these sophisticated cyber threats.