A unique confluence of cultures and traditions, Asia is also a hub for innovation and technology. Asian nations have been at the forefront of technological innovation in recent years, but the evolution of digital technology has inevitably increased the need for robust cybersecurity strategies in these countries. In this report, we will discuss the state of cybersecurity in the region: we will examine the main cyber threats, analyze the issues with legislation and regulation in the field of cybersecurity, and also offer recommendations for enhancing cyber resilience.
Main targets of attackers
Cyberattacks may have various negative consequences, all the way to non-tolerable events that have a catastrophic effect on the organization's operations. Virtually every other (49%) successful attack on an organization resulted in compromise of sensitive information, and in 27% of cases, victims suffered disruption of core operations including suspension of business processes and interruption of access to infrastructure or data.
A non-tolerable event is an event, caused by a cyberattack, that prevents the organization from achieving its operational or strategic goals or leads to long-term disruption of its core business.
A relatively small percentage of attacks (3%) resulted in direct financial loss due to the need to pay a ransom or theft of funds from the company's accounts. Yet the cumulative damage from a cyberattack includes overhead, such as the costs of response, investigation, recovery of infrastructure, downtime, and customer churn. For instance, IBM estimates the average cost of a data leak to a company in an ASEAN country in 2023 at $3.05 million, and in India, at $2.18 million.
Common users have experienced data leaks as well, with 76% of successful attacks producing such consequences. In 27% of cases, users lost money to malicious activities.
During the period in review, from early 2022 through H1 2023, the most frequently attacked organizations were government agencies (22%), industrial companies (9%), IT companies (8%), and financial institutions (7%).
74% of attacks were targeted, that is, they were aimed at specific organizations, industries, or individuals.
24% of successful attacks were aimed at individuals
Government agencies
The government agencies in Asia have become cybercrooks' main target for several reasons. First of all, their systems hold a lot of valuable information, such as citizens' personal data, statistics, and information of national importance. Attackers managed to steal data in 44% of successful attacks on government organizations. In 2022, several major data breaches from government agencies in Asian countries were recorded. For example, in the autumn of 2022 in Indonesia, a cybercriminal stole a database containing information on 105 million citizens, including personal data such as identification numbers. It is believed that the data was stolen from the Indonesian General Election Commission. The database was put up for sale on the dark web for $5,000.
Many countries in the region are pursuing digital transformation and actively integrating new technologies into their government systems. However, this gives rise to new vulnerabilities. Some government agencies cannot meet high cybersecurity standards due to limited resources or insufficient awareness about cyberthreats. In July 2023, it was reported that data from over 300 million Indonesian residents had been leaked, presumably from the Dukcapil system. Among the leaked data were citizens' identification numbers, contact phone numbers, email addresses, and home addresses. Dukcapil, a department of the Ministry of Home Affairs, is responsible for handling citizens' data and maintaining population registries in Indonesia. Dukcapil provides government services to the population, including issuing identity cards, birth certificates, and death certificates. It allows organizations, including financial institutions, to prevent fraud by verifying users. This agency plays a crucial role in Indonesia's population accounting system and is actively involved in digital transformation and the adoption of new technologies.
Furthermore, Southeast Asia, India, and China have significant political influence. Cyberattacks on government institutions can be carried out both by hacktivists wanting to express their political ideas and by highly skilled APT groups aiming for espionage or destabilization in the region. For instance, in 2022, the hacktivist group DragonForce attacked the web resources of over 70 government and commercial organizations in India.
Manufacturing
Manufacturing enterprises in the region are important elements of the global supply chain and play a key role in the world economy. These countries are global leaders in the production of goods. For example, China accounts for about 30% of the world's total production. As a result, they are subject to attacks involving cyberespionage or economic sabotage. Furthermore, from the perspective of extortionists, large manufacturing and industrial companies are tempting targets, as they are more willing to pay substantial ransoms to restore operations and avoid downtime.
Manufacturing plants and industrial companies often possess valuable intellectual property, such as technology patents and trade secrets, which can be the target of cyberespionage. Asian manufacturers invest billions of dollars in research and development annually. For instance, China spent over 3 trillion yuan (about $456 billion) on scientific research in 2022. Stealing such information can provide competitors or foreign states with a technological advantage.
In 2023, the Indian company Solar Industries Limited, a manufacturer of industrial and defense explosives, fell victim to a ransomware attack. The BlackCat group (ALPHV) stole 2 TB of data from the company's servers. Among the stolen data were technical details of the manufactured weapons and explosives, blueprints, information on arms shipments, and the company's contracts.
Disruption of key enterprises' operations can seriously impact a country's economy as a whole. Attacks on such factories or production facilities can disrupt global supply chains, causing economic losses and market instability. Suzuki Motorcycle India faced a cyberattack in May 2023 that shut down its factories for a week. The company estimates that the loss in production during this period was more than 20,000 vehicles. Suzuki Motorcycle India is the fifth-largest manufacturer of two-wheeled vehicles in India, with a production volume approaching one million units.
IT
IT companies are among the top three most targeted industries for a number of reasons. First of all, the countries of Southeast Asia, including India and China, have experienced rapid growth in the IT sector and become centers of technological innovation, home to some of the world's leading IT companies. These companies possess a large amount of valuable data, including intellectual property and user information, which is of particular interest to cybercriminals. Hacking into these companies can bring attackers substantial profits, whether through selling information on the black market or using it for a competitive advantage. Furthermore, the resources of well-known IT companies can be used to carry out attacks on other organizations worldwide.
In June 2023, Taiwan Semiconductor Manufacturing Company (TSMC), the world's largest microchip manufacturer, reported a data breach. The culprit, LockBit ransomware group, demanded a $70 million ransom from the company, threatening to release the stolen data. The data breach, described by a company representative as «related to the initial setup and configuration of a server," occurred due to a security incident at one of TSMC's IT providers, Kinmax Technology. The extortionists threatened to disclose TSMC's network entry points and access credentials.
While security regulations are becoming stricter, many companies in these regions do not yet fully comply with international security standards. This can make them more vulnerable to cyberattacks.
Finance
Financial and insurance organizations are often at more advanced stages of digital transformation compared to other industries. As a result, cybercriminals must work harder to successfully carry out attacks against these organizations, and they typically resort to social engineering methods. However, in this region, we see two main attack vectors: malicious email attachments and vulnerability exploitation. This indicates a relatively low level of security for financial organizations. The main victims of these attacks were Indian banks. In half of the cases, a successful attack resulted in the theft of bank customer data.
It is noteworthy that the advertisements for the purchase of databases on shadow forums are mainly related to financial institutions. Such information can be used to carry out phishing attacks. For example, in March 2023, news broke about the data leak of 600,000 customers of the Indian HDFC Bank. The compromised data included names, birthdates, phone numbers, email addresses, physical addresses, employment information, credit ratings, and loan details. Following this, users began reporting breaches of their bank accounts and attempted phishing attacks.
Main cyberthreats
The majority of attacks on organizations (81%) are aimed at computers, servers, and network equipment. In 22% of cases, attackers successfully hacked web resources, most often using known vulnerabilities or compromised credentials.
In attacks on organizations, malware is used in 57% of cases. Social engineering methods (40% successful attacks) and vulnerabilities in company resources (39%) are almost equally common vectors. This indicates that the publicly available resources of companies are not sufficiently protected. Resources in less secure countries can also be used as training grounds for exploiting vulnerabilities.
In 12% of cases, attacks were carried out using compromised credentials.
Individuals were victims of social engineering in 92% of attacks, and malware was used in every third successful attack against them.
Cyberespionage and data leaks
In attacks on organizations, the perpetrators most often managed to steal personal data (38% of the total stolen information), credentials (14%), and trade secrets (28%). Personal data leaked mainly from the systems of government agencies, service companies, retailers, and financial organizations. Meanwhile, trade secrets were the criminals' main goal in attacks on industrial organizations and IT companies.
In attacks on individuals, malicious actors were mostly interested in credentials and personal data (35% and 28%, respectively), as well as payment card data (12%).
Attackers can openly publish or sell stolen databases and other information on the dark web. For example, in May, a database containing 2.1 billion unique records on customers of a Chinese express delivery service, including personal data and mobile numbers, was put up for sale for $40,000.
The majority of data offered for sale or distributed for free on the dark web is stolen from Chinese (39% among Asian countries) and Indian (22%) organizations and individuals. Primarily, the data sold is taken from government and financial organizations. In July 2023, an announcement appeared on the dark web about the sale of a database of 30 million users of the Indonesian government service Dukcapil for $15,000.
In Asian countries, attacks are carried out by a variety of highly qualified APT (advanced persistent threat) groups. These groups are well organized, experienced and technically skilled. They can carry out attacks for the purposes of cyberespionage, obtaining financial gain, or disrupting enterprise activities. Listed below are some notable APT groups and financially motivated groups that were active in 2022 and 2023 and engaged in cyberespionage in the region:
- Mustang Panda (also known as TA416, RedDelta, and Bronze President), is a cyberespionage group discovered in 2017. The criminals have attacked government, religious and non-profit organizations in Vietnam, China, Myanmar, Pakistan, and Mongolia. Mustang Panda operates not only in Asia but also in Africa, Europe, and the U.S.
- Sharp Panda has been conducting campaigns in Southeast Asia since 2021. The cyberspies are targeting government organizations in Vietnam, Thailand, and Indonesia.
- APT32 (also known as OceanLotus, Canvas Cyclone, APT-C-00, and Cobalt Kitty) has been active since at least 2012. The group specializes in cyberespionage and targets government and corporate networks in East and Southeast Asian countries.
- Dark Pink (Saaiwc Group) has been active since 2021. The cybercriminals steal documents from military, government, non-profit, and religious organizations in Southeast and Pacific Asia. They operate covertly and select their targets carefully.
- BlueHornet (also known as AgainstTheWest and APT49) attacks government organizations in China, North Korea, Iran, and Russia as well as APT groups based in these countries. Blue Hornet compromised and leaked data from Kryptonite Panda and Lazarus Group.
- Transparent Tribe (also known as APT36, Copper Fieldstone, Mythic Leopard, and ProjectM) is a Pakistani group which has been attacking Indian governmental, military, and research organizations, as well as their employees, since 2013. Since 2022, the cybercriminals have additionally targeted educational institutions and students on the Indian subcontinent.
- Billbug (also known as Lotus Blossom and Thrip) has existed since 2009. These cyberspies target government and industrial organizations in Asia. In their attacks, the criminals use both legal dual-use software and specialized backdoors.
- Charming Kitten (also known as APT35, Phosphorus, TA453, and Ajax Security Team) specializes in cyberespionage and stealing data of organizations and individuals connected to Iran's geopolitical interests. The cybercriminals target victims in the Middle East, Asia, Europe, and the USA.
- Desorden (also known as chaoscc) is a financially motivated group which has been attacking Indian and Malaysian companies in various sectors of the economy since 2021. The group steals data from high-revenue enterprises to get larger ransoms. In the summer of 2022, Desorden launched a regional campaign focusing on Thai organizations.
Malware
Remote administration tools (RATs) have become the most common type of malware in attacks on organizations (54% of attacks using malware). Ransomware ranked second, being used in half of the malware attacks. Nearly every third attack involved the use of spyware.
Individuals' devices were most frequently infected with malware designed to steal data: spyware (56%), banking trojans (47%), and RATs (42%).
The distribution of malware in attacks on organizations primarily occurs through the compromise of computers, servers, and network equipment (44%), and through email (41%). Malware most often infiltrates regular users' devices through infected websites (34%), email (16%), social networks (16%), and instant messengers (11%).
Ransomware
As in the rest of the world, the region is experiencing a surge in ransomware activity. For example, according to the Indian Computer Emergency Response Team (CERT-In), the number of ransomware attacks in India increased by 53% in 2022. A recent trend in these attacks is that attackers prefer not to encrypt infrastructure but rather demand a ransom in exchange for not spreading compromised information. This is a global trend that we mentioned in our 2023 forecasts. Meanwhile, the average ransom amount demanded remains high, in millions of dollars. For example, in India in 2022, the average ransom for decrypting data and restoring access to infrastructure was $1.2 million. Not all companies are prepared for ransomware attacks: according to a survey conducted by Corinium Intelligence in Southeast Asian countries, 45% of respondents believe that the damage to their company in the event of a ransomware attack would range from moderate to significant, with only 55% of respondents confident in the reliability of their backup and recovery measures.
The main victims of ransomware attacks are industrial enterprises, accounting for 34% of successful attacks. Extortionists also target healthcare institutions, financial organizations, and IT companies.
In November 2022, the All India Institute of Medical Sciences (AIIMS) in New Delhi experienced a ransomware attack that resulted in the suspension of medical services. The attack affected various digital services of the hospital, including billing, reporting, lab testing, emergency services, and the appointment system. The IT systems responsible for the functioning of the healthcare services had to be shut down, and all operations were switched to manual mode. It took about two weeks to restore the IT systems. Furthermore, the attackers stole patient data, including medical records, donor information, hospitalization records, and vaccination records, etc. The hospital administration refused to pay the ransom, and the extortionists published this data on the dark web. The hospital managed to prevent another attack in June 2023, which did not affect patient services.
In early April 2023, Fullerton India, a major credit institution in India, fell victim to a LockBit 3.0 ransomware attack. As a result of the attack, more than 600 GB of data was compromised, including customers' personal data, financial information, bank account numbers, and loan agreement details. The extortionists demanded a ransom of 240 million rupees (about $3 million), but the company refused to negotiate, and the criminals published the stolen data on the dark web.
The primary method of spreading ransomware (63% of successful attacks) is through email. In 32% of cases, vulnerabilities in organizations' publicly accessible resources are exploited.
Social engineering
Social engineering is the primary vector for infiltrating organizations' infrastructures and is used in 40% of successful attacks. The threat of social engineering attacks is high throughout the region. For example, Vietnam's Ministry of Information and Communications reported that the number of attacks in the country increased by 44% in the first 11 months of 2022 compared to the same period in 2021. Phishing attacks accounted for 35% of the total number of incidents. The number of phishing attacks in Singapore in 2022 more than doubled compared to the previous year. According to IBM's report, email attachments are the main vector for distributing malware in the Asia-Pacific region. IBM experts also note that the average damage from a phishing attack is $4.76 million, second only to attacks from internal intruders by cost.
Social engineering is used by inexperienced cybercriminals who buy ready-made tools for phishing campaigns, as well as by extortionists and APT groups. The most common vector for phishing attacks against organizations is email campaigns, but attackers can also create fake websites to steal credentials or distribute malware. Most often, the websites of banks and payment services are faked, to steal money or authentication data.
According to a KnowBe4 report, about 30% of employees in Asia find it difficult to recognize a phishing email, which means that in the event of an attack, one in three employees could open a malicious attachment, click on a malicious link, or give the attacker their credentials. With the development of AI tools, this problem is becoming even more serious, as generative models allow criminals to create highly convincing emails in various languages and make it easier for international groups to carry out attacks.
Development of cybercrime forums
On shadow forums, cybercriminals trade and exchange malware and stolen data, and offer various illicit services. Here, malicious actors can acquire access to the networks of organizations that interest them. In the countries of the region, the most common ads are for the sale of access to companies in China, Thailand, and India. These are mainly government organizations, IT companies and service sector companies.
The cost of access depends on the size of the organization and the privileges of the account. Access to a network with the rights of an ordinary user or to a small company can cost $100–200, while domain administrator privileges cost upwards of $500. For example, one of the most expensive offers we found was access with domain administrator privileges to the network of a Chinese manufacturer of photovoltaic modules, priced at $20,000. For access to the infrastructure of a Vietnamese telecommunications company, the attackers expected to receive up to $4,800.
