Mercenary Spyware and Exploit Brokers: A Rising Threat in Southeast Asia

Introduction

In recent years, Southeast Asia has witnessed a surge in cyberattacks involving mercenary spyware and exploit brokers. These sophisticated tools, often developed by private companies and sold to state and non-state actors, have been employed to conduct surveillance and espionage activities across the region.

Mercenary Spyware in Southeast Asia

Mercenary spyware refers to surveillance software developed by private entities and sold to governments or other clients for intelligence-gathering purposes. Notable examples include NSO Group's Pegasus and Cytrox's Predator. These tools exploit zero-day vulnerabilities to infiltrate target devices, enabling remote access to communications, location data, and other sensitive information.

In Southeast Asia, the deployment of such spyware has been reported in several countries. For instance, in 2021, Cytrox's Predator spyware was identified in at least eleven countries, including Indonesia, the Philippines, and Thailand. (recordedfuture.com) Similarly, in 2023, Amnesty International uncovered a sophisticated hacking campaign targeting Google's Android operating system, attributed to a mercenary spyware company. (amnesty.org)

Exploit Brokers and Commercial Offensive Tools

Exploit brokers are entities that discover, develop, and sell zero-day vulnerabilities to the highest bidder. These vulnerabilities are then used to create commercial offensive tools, such as spyware and malware, which can be deployed for various purposes, including espionage and surveillance.

The market for such tools has expanded significantly, with companies like Candiru and QuaDream offering sophisticated spyware solutions. Candiru, for example, has been linked to cyber-espionage operations targeting journalists and dissidents. (en.wikipedia.org) QuaDream has developed tools capable of exploiting zero-day vulnerabilities in iOS devices, enabling remote surveillance without user interaction. (thehackernews.com)

Red Team Frameworks and Surveillance-as-a-Service

Red team frameworks are tools and methodologies used by cybersecurity professionals to simulate adversary tactics, techniques, and procedures (TTPs) to assess and improve an organization's security posture. While these frameworks are intended for defensive purposes, they can be repurposed by malicious actors to conduct offensive operations.

The rise of surveillance-as-a-service platforms has further democratized access to advanced cyber capabilities. These platforms offer clients the ability to conduct surveillance and cyber-espionage activities without the need for in-house expertise, making such operations more accessible and appealing to a broader range of actors.

Impact on Southeast Asia

The proliferation of mercenary spyware and exploit brokers poses significant cybersecurity risks to Southeast Asia. In the first half of 2025, Vietnam recorded the highest number of spyware attacks in the region, with nearly 192,000 incidents targeting local organizations. (vietnamnet.vn) This surge reflects a growing threat to the region's digital infrastructure, as users increasingly move their activities online, leaving behind digital footprints that can be exploited by cybercriminals.

Conclusion

The increasing prevalence of mercenary spyware and exploit brokers in Southeast Asia underscores the need for enhanced cybersecurity measures. Governments and organizations must invest in robust security infrastructures, conduct regular vulnerability assessments, and promote awareness to mitigate the risks associated with these advanced cyber threats.

Highlights:

• Southeast Asia’s Mercenary Pipeline – The Diplomat, Published on Monday, February 09
• Vietnam sees spike in spyware attacks, ranking 2nd in Southeast Asia after Singapore - VnExpress International, Published on Tuesday, November 25
• Chinese cyberattackers compromising telcos in Southeast Asia for espionage | CSO Online, Published on Tuesday, August 10