# INTERPOL Asia & South Pacific Cyberthreat Assessment 2025/2026: Surging Phishing, Ransomware, and AI-Driven Scam-Center Fraud

> INTERPOL's Asia and South Pacific Cyberthreat Assessment Report (2025/2026) documents a region-wide surge in phishing, ransomware, DDoS, and AI-driven fraud. Phishing is named the most widespread and financially damaging cybercrime, with 135,000+ ransomware attacks in 2024, DDoS up 92% year-over-year, system intrusions behind ~80% of data breaches, and transnational scam-center syndicates in Southeast Asia generating close to $40 billion annually using deepfakes and forced labor.

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-06-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0897
- **ID:** TL-2026-0897
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Southeast Asian transnational cybercrime syndicates
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

INTERPOL's Asia and South Pacific Cyberthreat Assessment Report 2025/2026, covering January 2024 to March 2025, finds that cybercrime now accounts for at least 30% of all recorded crime in more than half of surveyed member countries, with more than 6.5 billion cyber threats detected and mitigated across the region during 2024.

Phishing is identified as the most widespread and financially damaging cybercrime in the region. A third (33%) of countries reported more than 10,000 phishing cases between January 2024 and March 2025, and 5.5 of every 1,000 individuals in the Asia and South Pacific region clicked on phishing links monthly — nearly double the global average of 2.9 per 1,000. Ransomware remains a dominant threat, with more than 135,000 ransomware-related attacks recorded in 2024, concentrated against the real estate, manufacturing, and financial services sectors. Distributed denial-of-service (DDoS) attacks surged 92% in 2024 compared with the previous year. System intrusions accounted for approximately 80% of all data breaches in 2024, with malware present in 83% of cases and ransomware in 51%.

The assessment names RedLine, Lumma, LokiBot, Negasteal (an Agent Tesla variant), and ZBot (Zeus) among the banking trojans and information-stealer families driving credential theft and follow-on fraud across the region. These commodity stealers harvest browser credentials, cookies, and session tokens, log keystrokes, and capture screens, feeding initial-access brokers and downstream ransomware and business-email-compromise operations.

A central finding is the industrialization of fraud by transnational organized-crime syndicates operating scam compounds in Cambodia, Laos, Myanmar, and the Philippines, frequently staffed by trafficked and forced labor. These operations blend AI personas and social engineering in 'romance baiting' (formerly 'pig butchering') investment-fraud schemes. Discussions about deepfakes on cybercriminal forums and messaging channels used by Southeast Asian threat actors increased 600% from February to June 2024, and regional scam-center operations are estimated to generate close to $40 billion annually (with $37 billion in regional cybercrime losses cited for the romance-baiting/deepfake nexus). INTERPOL coordinates the regional response through its Asia and South Pacific Joint Operations against Cybercrime (ASPJOC) framework. This record is a strategic threat-intelligence assessment rather than a single CVE; severity reflects the scale, active exploitation, and financial impact of the documented activity.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1082 System Information Discovery
- T1518 Software Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft
- T1684.001 Impersonation
- T1486 Data Encrypted for Impact
- T1498 Network Denial of Service

## Sources

- [INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific](https://thehackernews.com/2026/06/interpol-warns-phishing-ransomware-and.html)
- [New INTERPOL report highlights escalating cyber threats across Asia and South Pacific](https://www.interpol.int/News-and-Events/News/2026/New-INTERPOL-report-highlights-escalating-cyber-threats-across-Asia-and-South-Pacific)
- [INTERPOL Asia and South Pacific Cyber Threat Assessment Report 2025/2026 (PDF)](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf)
- [Asia-Pacific scam networks generate nearly $40 billion a year](https://www.helpnetsecurity.com/2026/06/19/interpol-asia-cybercrime-trends-report/)
- [INTERPOL report warns of rising cybercrime across Asia-Pacific](https://dig.watch/updates/interpol-report-cybercrime-asia-pacific)
- [INTERPOL releases new information on globalization of scam centres](https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-releases-new-information-on-globalization-of-scam-centres)
- [RedLine Stealer, Software S1240 — MITRE ATT&CK](https://attack.mitre.org/software/S1240/)
- [Lumma Stealer, Software S1213 — MITRE ATT&CK](https://attack.mitre.org/software/S1213/)
- [LokiBot, Software S0447 — MITRE ATT&CK](https://attack.mitre.org/software/S0447/)
- [Agent Tesla, Software S0331 — MITRE ATT&CK](https://attack.mitre.org/software/S0331/)
- [Zeus / Zbot, Software S0027 — MITRE ATT&CK](https://attack.mitre.org/software/S0027/)
- [Asia and South Pacific Joint Operations Against Cybercrime (ASPJOC)](https://www.interpol.int/Crimes/Cybercrime/Projects/Asia-and-South-Pacific-Joint-Operations-Against-Cybercrime-ASPJOC)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0897