State-Sponsored Exploitation of Zero-Day Vulnerabilities in Southeast Asia

Executive Summary

State-sponsored cyber actors are increasingly exploiting zero-day vulnerabilities in Southeast Asia, targeting critical infrastructure and enterprise technologies. This trend poses significant cybersecurity risks to the region's economic and national security.

Introduction

Zero-day vulnerabilities—previously unknown flaws in software or hardware—are prime targets for cyber actors seeking unauthorized access. In Southeast Asia, the exploitation of these vulnerabilities by state-sponsored groups has escalated, with a notable emphasis on enterprise-grade technologies.

Current Threat Landscape

In 2025, a report by the Google Threat Intelligence Group (GTIG) identified 90 zero-day vulnerabilities exploited in the wild. Nearly half of these were used against enterprise-grade technologies, marking an all-time high. State-sponsored groups, particularly those linked to China, remain the most prolific, with a long history of detailed knowledge of vulnerable devices. (cybersecuritydive.com)

Notable Exploitation Cases

• Thailand: Thai businesses experienced over 21,000 spyware attacks in the first half of 2025, ranking fourth in Southeast Asia for such incidents. The rise of commercial "zero-click" spyware, which can infect devices without user interaction, has been a significant factor in this surge. (nationthailand.com)

• Myanmar: The United States Department of the Treasury sanctioned 19 entities and individuals connected to cyber-scam centers in Myanmar's Shwe Kokko region. These centers have been linked to transnational cybercrime, including online fraud and human trafficking. (home.treasury.gov)

Implications for Southeast Asia

The exploitation of zero-day vulnerabilities by state-sponsored actors in Southeast Asia has several implications:

• Economic Impact: Cyberattacks targeting critical infrastructure and enterprise technologies can disrupt business operations, leading to financial losses and diminished investor confidence.

• National Security: Compromised systems may result in the theft of sensitive governmental and military information, undermining national security.

• Regional Stability: The proliferation of cybercrime, including activities like online scams and human trafficking, can destabilize the region and strain international relations.

Recommendations

To mitigate the risks associated with zero-day exploitation, the following measures are recommended:

1. Enhanced Cybersecurity Measures: Organizations should implement robust cybersecurity protocols, including regular system updates and vulnerability assessments, to identify and address potential zero-day vulnerabilities.

2. International Collaboration: Southeast Asian nations should strengthen cooperation to share threat intelligence and coordinate responses to cyber threats.

3. Public Awareness Campaigns: Educating the public and businesses about the risks of cyber threats and the importance of cybersecurity can help reduce the effectiveness of cyberattacks.

Conclusion

The exploitation of zero-day vulnerabilities by state-sponsored actors in Southeast Asia presents a high-level threat to the region's cybersecurity landscape. Proactive measures, including enhanced security protocols, international collaboration, and public education, are essential to mitigate these risks and safeguard the region's digital infrastructure.

Highlights:

• Cambodia aims to shut down all online scam centers within weeks, Published on Wednesday, March 11
• Meta, Thai police shut down 150,000 scam accounts, Published on Wednesday, March 11