Financial services among top cyber targets in Asia-Pacific

Only India reported more cyber crime victims than Australia in the Asia-Pacific region, according to the CrowdStrike 2025 APJ eCrime Landscape Report, which highlighted the financial services sector as one of the most targeted industries.

Focused on eCrime actors that primarily seek to exploit organisations for financial gain, the report highlighted that adversaries are leveraging financial transaction-themed phishing.

“ECrime actors are industrialising cybercrime across APJ through thriving underground markets and complex ransomware operations. Simultaneously, AI-developed malware enables adversaries to launch high-velocity, high-volume attacks,” said Adam Meyers, head of counter adversary operations at CrowdStrike.

“Defenders must meet this new pace of attack with decisive action, powered by AI, informed by human experience, and unified in response.”

From 1 January 2024 to 30 April 2025, CrowdStrike Intelligence documented 763 APJ-based victims named on data extortion and ransomware dedicated leak sites (DLSs). The five countries most represented on DLSs in this time frame are India, Australia, Japan, Taiwan, and Singapore.

“Although the APJ region represents more than half of the global population, victims based in this region constituted only 9 per cent of 8,418 organisations named on DLSs globally,” the report said.

“Ransomware actors most frequently targeted the manufacturing, technology, industrials and engineering, financial services, and professional services sectors.”

The report also found that AI-accelerated ransomware on “high-value targets” had surged over the period, with India, Australia, and Japan again the most impacted countries.

“Emerging Ransomware-as-a-Service providers KillSec and Funklocker – leveraging AI-developed malware – accounted for more than 120 incidents,” the report said.

“Top targeted sectors included manufacturing, technology, and financial services, with 763 victims publicly named on dedicated leak sites.”

Speaking with ifa last month, CrowdStrike field chief technology officer world wide Fabio Fratucello explained that the rise of malware-free intrusions has come as a result of stronger barriers at the endpoint.

“They were targeting the endpoint … where you have user interaction, people typing on a keyboard, and code execution, so you can exploit the interconnectedness of the human and the machine together,” Fratucello said.

“What threat actors do – they have KPIs and return on investment – is there an easier way to make the same money? And the answer is, let’s look at the identity. Identity today is the new perimeter.

“We need to bring a detection and response and a prevention lens into the identity domain.”

He added that these social engineering-type intrusions are utilising generative AI tools to create more convincing versions of standard methods.

“Social engineering is extremely prevalent and that really leads into an identity-based type of attack,” Fratucello said.

“When we look at the effectiveness of a social engineering attack, think of an email or a text or a combination, when generated through a GenAI tool, the click-through rate, which is that the effectiveness that is measured in cyber security, is significantly higher than human generated.”

According to the eCrime Landscape Report, as threat actors adopt AI to “strike faster, scale operations, and evade detection”, there is mounting pressure to keep pace.

“Security teams are already stretched thin, grappling with growing alerts, contending with skills shortages, and racing to respond at speed. To close these widening gaps, security teams should operationalize agentic AI – systems capable of reasoning, adapting, and acting autonomously within defined guardrails and organizational policies,” it said.

“These capabilities can scale intelligence-driven operations by using emerging threat intelligence and expertise to triage alerts, conduct investigations, and execute response actions. By offloading time-intensive, repetitive tasks, agentic AI empowers human analysts to focus on proactive threat hunting and hypothesis-driven investigation, elevating both strategic impact and operational efficiency.”