Nation-State Cyber Attacks Target Southeast Asia's Critical Infrastructure

In early 2026, Southeast Asia has witnessed a surge in cyberattacks targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These operations, attributed to nation-state actors, underscore the region's escalating vulnerability to cyber threats.

Power Grids and Industrial Control Systems (ICS)

In December 2025, the Polish power grid experienced a sophisticated cyberattack attributed to the Russian state-sponsored group Berserk Bear. The attack targeted both IT and physical industrial devices, including renewable energy plants and combined heat and power facilities. While this incident occurred outside Southeast Asia, it highlights the global nature of such threats and the potential for similar attacks in the region. (en.wikipedia.org)

In Southeast Asia, the threat landscape is similarly concerning. Between December 2024 and December 2025, several hacktivist groups, including Z-Pentest and Sector 16, increased their focus on ICS and operational technology (OT) attacks. These groups exploited vulnerabilities in Supervisory Control and Data Acquisition (SCADA) systems, posing significant risks to critical infrastructure. (scworld.com)

Water Systems

Hacktivist activity targeting water systems has also escalated. In 2025, groups like Z-Pentest and Sector 16 exploited internet-facing Virtual Network Computing (VNC) connections to infiltrate OT control devices within water facilities. These attacks led to temporary disruptions, necessitating manual interventions to manage processes. (ics-cert.kaspersky.com)

Healthcare Sector

The healthcare sector in Southeast Asia has been a prime target for cyber espionage campaigns. In 2025, the Amaranth-Dragon group, linked to the China-affiliated APT 41 ecosystem, conducted targeted cyber espionage campaigns against government and law enforcement agencies across the ASEAN region. The group weaponized newly disclosed vulnerabilities, including a critical WinRAR flaw, to gain access to sensitive information. (blog.checkpoint.com)

Financial Sector

The financial sector has also faced increased cyber threats. In the fourth quarter of 2025, the RomCom group, known for both financial cybercrime and intelligence collection, targeted industrial organizations in Southeast Asia. The group relied on misconfigured customer network edge devices, such as enterprise routers and VPN gateways, to gain unauthorized access. (ics-cert.kaspersky.com)

Conclusion

The heightened cyber threat landscape in Southeast Asia's critical infrastructure sectors reflects a strategic shift by nation-state actors and hacktivist groups towards more sophisticated and targeted cyber operations. The region's rapid digitalization and interconnectedness have expanded the attack surface, making it imperative for governments and organizations to enhance cybersecurity measures. This includes regular vulnerability assessments, robust incident response plans, and international collaboration to mitigate the risks associated with cyber threats to critical infrastructure.