Cybercriminal activity across the Asia Pacific region is becoming more industrialised and resilient, driven by artificial intelligence and supported by a mature underground ecosystem spanning multiple countries, according to the latest CrowdStrike research.
CrowdStrike’s 2025 Asia Pacific and Japan (APJ) eCrime Landscape Report shows AI is accelerating the scale, speed and sophistication of financially motivated cybercrime, particularly among Chinese-speaking threat actors operating across Southeast Asia, South Asia and beyond. Between January 2024 and April 2025, at least 763 victims across APJ were named on ransomware and data-extortion leak sites, with India, Australia, Japan, Taiwan and Singapore the most affected markets.
Manufacturing, technology, industrial and engineering firms, financial services and professional services were the most targeted sectors. Despite its relatively small size, Singapore emerged as the most targeted market in Southeast Asia, ahead of Indonesia, Malaysia and Thailand.
The research highlights the role of a resilient Chinese-language underground economy enabling cross-border eCrime operations. Prior to its takedown by US authorities in May 2025, the Huione Guarantee marketplace is estimated to have processed around US$27 billion in illicit transactions linked to money laundering and large-scale scam activity. Other services continue to operate, including hosting providers advertising “bulletproof hosting” via encrypted messaging platforms and claiming infrastructure across Singapore, Thailand and other regional hubs.
Vietnam-based malware developers were also identified as playing a growing role in the ecosystem, producing information-stealing malware designed specifically to compromise social media business accounts. These tools have been used to hijack advertising budgets and monetise access at scale. Meanwhile, South Asia-based threat groups have launched finance-themed phishing campaigns targeting banks and foreign exchange companies across Asia and the Middle East.
Separate CrowdStrike research has identified a new category of supply-chain risk emerging from the use of AI coding assistants. Analysis of the Chinese AI model DeepSeek found that political and ideological constraints embedded within the model can degrade code quality in subtle but significant ways. When prompts included politically sensitive terms, the likelihood of the model producing insecure code increased sharply, even when the task itself was unrelated to politics. In some cases, the model internally generated a correct solution but failed to output it, creating hidden vulnerabilities for developers relying on the tool.
The findings suggest AI model selection is becoming a security decision rather than a purely technical or compliance choice, particularly as AI agents are embedded more deeply into software development pipelines.
Looking ahead to 2026, CrowdStrike anticipates that AI will increasingly define both offensive and defensive cyber operations. Prompt injection is expected to emerge as a primary attack vector, with adversaries using hidden instructions to manipulate AI systems and extract data. At the same time, security operations centres are forecast to evolve toward agent-driven orchestration models, where automated systems reason and act at machine speed under human oversight.
Crowdstrike also warns that AI is likely to accelerate the discovery of zero-day vulnerabilities by optimising automated fuzzing techniques, reducing the cost and time required for adversaries to find exploitable flaws. As a result, defenders will face growing pressure to deploy AI-enabled detection, response and identity controls capable of operating at similar speed and scale.
The research underscores a central challenge for organisations across the region: as AI reshapes both cybercrime and cybersecurity, understanding the hidden risks within AI systems themselves is becoming as critical as defending against traditional threats.
You can read the full report here.
