Whether it’s phishing, ransomware or insider threats, it usually starts with a compromise in an organization’s identity management system…

In a world of hybrid cloud and hybrid work, managing the identities of users and devices has become much more complex. Threat actors leverage the vulnerabilities found amid this complexity to compromise an organization’s security.

With AI as a new weapon in their arsenal, cyberthreats have become even more intimidating to organizations in APAC.

What are the latest and most pressing cybersecurity challenges that the various industry sectors in the region face, how does identity feature in them, and how can we deal with these threats? We find out from Eric Woodruff, Chief Identity Architect, Semperis.

What are the most pressing cybersecurity threats businesses face today?

Eric Woodruff (EW): Phishing attacks, ransomware, and insider threats are some of the most pressing cybersecurity threats faced by businesses today.

Phishing remains a primary entry point for attackers, often leveraging social engineering tactics to exploit human vulnerabilities. Ransomware attacks, which have become increasingly sophisticated, disrupt operations by encrypting critical data and demanding large ransoms. Insider threats, whether malicious or inadvertent, pose a significant risk as they leverage trusted access to breach security protocols.

The Asia-Pacific (APAC) region experienced a significant surge in cyber-attacks targeting organizations in 2024, particularly in email-based attacks stemming from phishing. A 30.5% increase was witnessed, with key financial hubs such as Singapore and Japan seeing an alarming 37% increase in phishing attacks.  

In 90% of ransomware attacks, threat actors compromise an organization’s identity system, most often Active Directory (AD). AD is one of the world’s most popular corporate access management tools. It enables companies to define who can do what in a network, manage users and resources, as well as access to endpoints, tools, and systems. Securing AD is essential to maintaining business continuity and maintaining operational resilience.

Have you observed any new attack trends or techniques emerging recently?

EW: It is both surprising, and not surprising, to see the ways in which attackers leverage AI. One key trend is the rise of AI-powered attacks, where attackers leverage machine learning algorithms to create more convincing phishing emails, automate attacks, and even bypass traditional security systems. These attacks are becoming more personalized and difficult to detect due to the advanced capabilities of AI to mimic legitimate communication styles, with remarkable accuracy.

Recently, the FBI issued a warning to Apple and Android phone users alerting them that AI is fueling an increase of cyberattacks by spoofing victims claiming to be their bank and tricking them into transferring money out of their accounts.

Another notable trend is the growing use of multi-stage attacks, where threat actors first infiltrate a network through a low-level attack, like phishing, and then progressively intensify their efforts, deploying ransomware or stealing data in stages, enabling them to remain undetected for longer periods, making it even more challenging for businesses to mitigate damage.

Which industries are most vulnerable to cyber-attacks right now?

EW: While nobody should consider themselves safe, certain industries are highly vulnerable to cyber-attacks due to their critical nature, valuable data, and varying levels of cybersecurity preparedness. These include:

• Healthcare: Healthcare organizations remain prime targets for cybercriminals due to the sensitive patient health information they store. Legacy systems, limited cybersecurity budgets, and the need for uninterrupted operations also contribute to their vulnerability.
• Financial services: The finance sector is another top target, given its high-value data and assets. Attackers often focus on banks, insurance companies and investment firms, looking to exploit vulnerabilities in both their systems and the trust of their clients. The growing prevalence of digital banking and fintech services has expanded the attack surface for cybercriminals.
• Critical infrastructure: Sectors such as energy, utilities and manufacturing form the backbone of any economy. It ensures essential services function smoothly, supporting economic stability, offering public safety, and national security. A cyberattack on critical infrastructure could have significant economic and social consequences, thereby making them a prime target
• Retail & e-commerce: APAC is home to one of the largest e-commerce user bases worldwide, with China, South Korea and Indonesia taking lead in terms of market dominance. With the prevalence of e-commerce, comes a corresponding increase in its vulnerability to cyberattacks. Retailers handle vast amounts of customer data, including credit card information, making them prime targets for data breaches and payment fraud. The rapid adoption of online shopping during the pandemic left many businesses vulnerable to supply chain attacks and payment system vulnerabilities.

How has ransomware evolved over the last few years?

EW: Ransomware, once a sporadic menace, has evolved into an unrelenting adversary, with billions in ransom payments made in 2024. Attacks are no longer isolated incidents; they occur incessantly. Criminal groups orchestrate multiple strikes in rapid succession, exploiting vulnerabilities across organizations. Notable evolvements include:

Double and triple extortion: Ransomware attacks represent an evolution in cybercriminal tactics. In a double extortion attack, cybercriminals not only encrypt the victim’s data but also threaten to leak and sell it on the dark web if the ransom is not paid. In triple extortion attacks, threat actors threaten a company’s customers or business partners.