Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
Urgent mitigation urged for on-premises users of an endpoint security ...
VIVOTEK’s VORTEX Cloud Solution Enhances Efficiency and Security...
Do corporations know the various AI risks that come with insufficient ...
When legitimate URLs lead to dangerous destinations
Uzum Secures $70M Equity Financing Led by Tencent and VR Capital, Reac...
LOGIN REGISTER
CybersecAsia
  • Features
    • Featured

      When legitimate URLs lead to dangerous destinations

      When legitimate URLs lead to dangerous destinations

      Wednesday, August 6, 2025, 11:04 AM Asia/Singapore | Features
    • Featured

      Securing trust in a digitally ambitious Singapore

      Securing trust in a digitally ambitious Singapore

      Tuesday, August 5, 2025, 10:19 AM Asia/Singapore | Features, Newsletter
    • Featured

      Is your organization truly AI-ready?

      Is your organization truly AI-ready?

      Wednesday, July 30, 2025, 8:55 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning

Select Page

LOGIN REGISTER
  • Features
    • Featured

      When legitimate URLs lead to dangerous destinations

      When legitimate URLs lead to dangerous destinations

      Wednesday, August 6, 2025, 11:04 AM Asia/Singapore | Features
    • Featured

      Securing trust in a digitally ambitious Singapore

      Securing trust in a digitally ambitious Singapore

      Tuesday, August 5, 2025, 10:19 AM Asia/Singapore | Features, Newsletter
    • Featured

      Is your organization truly AI-ready?

      Is your organization truly AI-ready?

      Wednesday, July 30, 2025, 8:55 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning
News

Six-month snapshot of state-sponsored threats shows continued APT resilience

By CybersecAsia editors | Friday, June 20, 2025, 11:54 AM Asia/Singapore

Six-month snapshot of state-sponsored threats shows continued APT resilience

Despite takedowns, law-enforcement efforts and geopolitical effects, Advanced Persistent Threats had continued to wreak damages and losses on the world.

Based on its internal research* on Advanced Persistent Threat activities from the Oct 2024 to March 2025 period, a cybersecurity firm has reported some findings to the public.

First, during the monitoring period, Russia-aligned threat actors such as Sednit and Gamaredon, had maintained aggressive campaigns primarily targeting Ukraine (critical infrastructure and governmental institutions) and EU countries. The Russia-aligned Sandworm group had intensified destructive operations against Ukrainian energy firms, deploying a new wiper named ZEROLOT.

Second, China-aligned threat actors were noted to have continued engaging in persistent espionage campaigns, with a focus on European organizations.

Other telemetry findings

In Asia, China-aligned APT groups had continued campaigns against governmental and academic institutions. Also:

  • North Korea-aligned threat actors had significantly increased their operations directed at South Korea, placing particular emphasis on individuals, private companies, embassies, and diplomatic personnel. Mustang Panda remained the most active, targeting governmental institutions and maritime transportation companies via Korplug loaders and malicious USB drives. DigitalRecyclers continued targeting EU governmental entities, employing the KMA VPN anonymization network and deploying the RClient, HydroRShell, and GiftBox backdoors. PerplexedGoblin had used its new espionage backdoor against a Central European government entity, while Webworm had targeted a Serbian government organization using SoftEther VPN, a popularity tool among China-aligned groups.
  • Elsewhere in Asia, North Korea-aligned threat actors were particularly active in financially motivated campaigns. DeceptiveDevelopment significantly broadened its targeting, using fake job listings primarily within the cryptocurrency, blockchain, and finance sectors. The Bybit cryptocurrency theft, attributed by the FBI to the TraderTraitor APT group, had caused losses of approximately US$1.5bn in this period.
  • Other North Korea-aligned groups had seen fluctuations in their operational tempo: In early 2025, Kimsuky and Konni had returned to their usual activity levels after a noted decline at the end of 2024, shifting their targeting away from English-speaking think tanks, non-governmental organizations and North Korea experts to focus primarily on South Korean entities and diplomatic personnel. Also, Andariel had resurfaced after a year of inactivity, with a sophisticated attack against a South Korean industrial software company.
  • Iran-aligned APT groups had maintained their primary focus on the Middle East region, predominantly targeting governmental organizations and entities within the manufacturing and engineering sectors in Israel. Additionally, there had been a significant global uptick in cyberattacks against technology firms during the monitoring period, largely attributed to increased activity by North Korea-aligned DeceptiveDevelopment.

According to Jean-Ian Boutin, Director of Threat Research, ESET, the firm releasing some of its data findings to the media: “The highlighted operations are representative of the broader threat landscape that we investigated during this period. They illustrate the key trends and developments, and contain only a small fraction of the cybersecurity intelligence data provided to customers…”

*based on proprietary telemetry and associated research on specific APT groups

Share:

PreviousCohesity Strengthens Resilience of Large, Mission-Critical MongoDB Workloads
NextNEC Indonesia Introduces Integrated Command Control Centre for Industrial Estate at the 9th HKI National Conference 2025

Related Posts

Singapore brokerages broken into – mitigating the risks

Singapore brokerages broken into – mitigating the risks

Friday, November 15, 2019

Trend Micro predicts cloud security will be consumed by the SOC by 2026

Trend Micro predicts cloud security will be consumed by the SOC by 2026

Wednesday, June 14, 2023

How to outsmart filename masquerading: A practical guide to safer file handling

How to outsmart filename masquerading: A practical guide to safer file handling

Monday, May 26, 2025

Nine DevSecOps secret scanning tools to keep the bad guys at bay

Nine DevSecOps secret scanning tools to keep the bad guys at bay

Tuesday, April 26, 2022

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • PT Kereta Api Indonesia announces nationwide email and communication overhaul

    PT Kereta Api Indonesia announces nationwide email and communication overhaul

    The state railway operator’s upgraded email system improves privacy, operational reliability, and regulatory alignment for …Read more
  • Operationalizing sustainability in cybersecurity: Group-IB’s approach

    Operationalizing sustainability in cybersecurity: Group-IB’s approach

    See how the firm turned malware-group takedowns into measurements of sustainability and resilience gains: by …Read more
  • Thai government expands secure email management to close cybersecurity gaps

    Thai government expands secure email management to close cybersecurity gaps

    New measures address cybersecurity gaps in public sector communications, deploying advanced protections and operational support …Read more
  • How Iress optimized global DevSecOps

    How Iress optimized global DevSecOps

    Scaling compliance, security & efficiency – while seamlessly migrating to the cloud – with JFrog.Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.