This content was originally posted on ccapac.asia. The Coalition for Cybersecurity in Asia-Pacific (CCAPAC) is a group of industry stakeholders dedicated to positively shaping the cybersecurity environment in Asia through policy analysis, engagement, and capacity building. Access Partnership is the secretariat for CCAPAC. Read the original article here.
The Asia Pacific region is home to some of the world’s fastest-growing digital economies and is simultaneously emerging as one of the most targeted regions for cyberattacks. Governments in Asia Pacific are increasingly recognising cybersecurity as a national priority and are actively working to address this multifaceted threat, even as they navigate a complex and evolving landscape of challenges.
With high profile cybersecurity incidents increasing in frequency, these threats are no longer hypothetical – they are urgent and real. Behind each breach lies a hard truth: as our digital infrastructure advances, so do the capabilities of those who seek to exploit it.
To develop effective and strategic recommendations for governments to build resilience against these emerging threats, the Coalition for Cybersecurity in Asia Pacific (CCAPAC), together with Access Partnership, highlights the region’s most prevalent cybersecurity trends, in a bid to prepare stakeholders to get ahead of the threats in 2025.
The top four cybersecurity threats shaping Asia Pacific in 2025
Threat 1: Ransomware and malware attacks
The region is battling a surge in ransomware and malware, often targeting critical infrastructure. In just the first half of 2024, Asia Pacific saw over 57,000 ransomware incidents, with Indonesia, the Philippines, and Thailand bearing the brunt of these attacks.[1]
In addition, bad actors are no longer content with simple data encryption for ransomware; they now employ double and triple extortion tactics, threatening to leak sensitive data or disrupt vital services. The economic fallout is severe, as seen when a LockBit 3.0 attack crippled fuel distribution across Indonesia’s Java region.[2] High-profile breaches, from Indonesia’s National Data Centre to Malaysia’s public transport operator and the Philippines’ health insurance provider, underscore the region’s vulnerability.[3]
Threat 2: Advanced persistent threats
Another trend CCAPAC has noted is that state-sponsored cyber espionage is on the rise. By exploiting edge devices and IoT systems, attackers bypass traditional defences. For example, the Andariel Group from North Korea launched a series of targeted intrusions into organisations with access to military secrets, demonstrating the country’s cyber capabilities and potential for state-sponsored attacks.[4] As Asia Pacific gears up to host over 14 billion IoT devices by 2025, these vulnerabilities must be addressed now, not later.[5]
Threat 3: Geopolitical tensions and foreign interference
Threat 3 is related to threat 2, where CCAPAC notes that cyber operations now serve as proxies for broader political and economic rivalries. Disputes over territory, energy resources, and trade are being fought not just in courtrooms and summits, but through sophisticated cyber espionage campaigns making it difficult to separate cybersecurity from national security.
Threat 4: Interdependencies in supply chains creating new risk vectors
The growing complexity of interconnected supply chains has created new risk vectors. The 2024 cyber breach at Indonesia’s Bank Mandiri, which impacted thousands of regional SMEs, demonstrated just how quickly localised threats can spill across borders and sectors.[6]
CCAPAC as a catalyst for cyber-resilience in Asia Pacific
The CCAPAC is a group of dedicated industry stakeholders who are working to positively shape the cybersecurity environment in Asia through policy analysis, engagement, and capacity building. Access Partnership is the secretariat for CCAPAC.
We note that there is a fragmented response to these cybersecurity challenges today in Asia Pacific. While governments across the region are making progress – Singapore’s Cybersecurity Act requires breach reporting for critical sectors, while Thailand and Malaysia have passed major regulatory reforms[7] – efforts remain fragmented. Diverse national priorities, from Vietnam’s data localisation focus to Indonesia’s limitations on cross-border data flows, have slowed efforts to create a unified regional front.[8]
Beyond policy misalignment, capacity constraints persist. There are instances where cybersecurity laws exist only on paper, and others that are still contemplating the establishment of cybersecurity legislation. Countries like Brunei lack mandates for financial sector protections,[9] while Malaysia’s new Cybersecurity Act is hamstrung by a massive talent gap – 84% of organisations struggle to find certified professionals.[10]
This challenge is compounded by funding limitations and the digital divide. Nearly one-third of Asia Pacific’s population remains offline.[11] Without sustained investment, under-resourced nations will fall further behind, creating security blind spots that threaten the entire region.
Policy responses and public private partnerships
As Asia Pacific faces unprecedented challenges in cybersecurity, with critical infrastructure becoming increasingly vulnerable to attacks and the cybersecurity talent shortage persisting, stronger multi-sector collaboration is essential. The region must prioritise:
- Harmonising cybersecurity policies and regulatory frameworks across ASEAN member states.
- Investing in cybersecurity capacity-building initiatives, particularly for MSMEs and critical infrastructure sectors.
- Fostering a culture of cybersecurity awareness by promoting individual contribution and collective action, and by promoting responsible digital citizenship.
- Enabling and leveraging emerging technologies like AI and machine learning to enhance threat detection and response capabilities.
In this context, public private partnerships and collaboration is not optional – it is essential. CCAPAC, comprising members like AWS, Cisco, KnowBe4, and Qualcomm, is helping to bridge these gaps through tangible, on-the-ground initiatives.
- Qualcomm is bolstering 5G security in Vietnam through Open RAN networks and IoT-focused R&D in Hanoi.[12]
- AWS is investing USD 5 billion in cloud infrastructure in Thailand[13] while training over 150,000 students across the region.[14]
- Cisco is enhancing network security and launching regional training initiatives to certify 50,000 cybersecurity professionals by 2026, while providing enterprise solutions to provide AI-powered defence for infrastructure and protect against attacks on AI systems.[15]
- KnowBe4 enables organisations to manage human risk by combining personalised and relevant education and training with adaptive security controls tailored to Asia’s diverse linguistic and cultural landscape.
These are not theoretical solutions, they are working models that governments can scale.
By embracing a collaborative approach that brings together governments, industry leaders, and regional partners, Asia Pacific can not only safeguard its digital future but also emerge as a global leader in cybersecurity innovation. The path forward requires sustained commitment, investment, and cooperation to build a resilient digital ecosystem that can withstand the evolving cyber threats of tomorrow.
References:
[1] https://securitybrief.asia/story/ransomware-attacks-surge-in-southeast-asia-with-57-000-cases
[2] https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a; https://sevenstonesindonesia.com/blog/indonesia-battles-cyber-attack-impact-on-government-services/
[3] https://fulcrum.sg/indonesias-national-data-centre-ransomware-attack-a-digital-governance-failure/, https://www.malaymail.com/news/malaysia/2024/08/26/prasarana-confirms-cybersecurity-breach-public-transport-operations-unaffected/148268, https://www.dataguidance.com/news/philippines-npc-investigates-potential-data-breach
[4] https://moderndiplomacy.eu/2024/12/18/the-current-impact-of-state-sponsored-cybersecurity-attacks-in-the-asia-pacific-region
[5] https://www.intralinkgroup.com/en-GB/Latest/Intralink-Insights/January-2025/the-800-billion-Southeast-Asia-digital-economy
[6] https://www.indopremier.com/ipotnews/newsDetail.php?group_news=RESEARCHNEWS&halaman=&jdl=Ada+1+Juta+Serangan+Siber+Mencoba+Bobol+Data+Bank+Mandiri+%28BMRI%29&name=&news_date=&news_id=452104&q=&search=&taging_subtype=&utm
[7] https://sso.agc.gov.sg/Acts-Supp/19-2024/Published/20240704?DocDate=20240704,
https://cybersecurityasia.net/malaysia-cybersecurity-skills-gap-fortinet/
[8] https://global.ptsecurity.com/analytics/cybersecurity-threatscape-in-southeast-asia
[9] https://global.ptsecurity.com/analytics/cybersecurity-threatscape-in-southeast-asia
[10] https://cybersecurityasia.net/malaysia-cybersecurity-skills-gap-fortinet/
[11] https://govinsider.asia/intl-en/article/public-private-collaboration-critical-for-digital-economy-growth-asean
[12] http://viettelhightech.com/en/5g-open-ran-connect-2024-vietnams-first-international-event-on-5g-open-ran
[13] https://www.capacitymedia.com/article/aws-to-invest-5bn-in-thailand
[14] https://aws.amazon.com/local/thailand/
[15] https://news-blogs.cisco.com/apjc/2024/10/18/cisco-and-csa-collaborate-to-bolster-cyber-defense-for-singapore; https://www.cisco.com/site/us/en/products/security/hypershield/index.html; https://www.cisco.com/site/us/en/products/security/ai-defense/index.html
