The rhythm of life among Southeast Asians was shaken by the sudden, sweeping changes last year. Despite the gloomy outlook, policies across SEA successfully compelled both the public and business sector to shift gears quickly, step up their use of technology and go online for literally everything. Security experts from Kaspersky’s Global Research and Analysis Team (GReAT) gives us a lowdown on how cybercriminals took advantage of this year’s disruptive event and what the cybersecurity threat landscape appears to look like in 2021 in the region.
Just like the rest of the world, people in SEA have been forced to stay indoors, but the pandemic didn’t stop them from moving about, albeit digitally. A recent report showed that 40 million Internet users in Southeast Asia came online for the first time this year, many of which were from non-city areas in Malaysia, Indonesia and the Philippines.
Southeast Asians, among the world’s most active Internet users, have always been digital but the adoption wasn’t as pervasive as when COVID-19 hit. Now with 400 million netizens that is nearly 70% of the region’s population, people and businesses are now practically doing everything online that even those who were previously digitally-averse had to jump in the online world.
This is where it gets critical because apart from old-time Internet users who, until now are still being educated on cyber hygiene, here comes the newbies who count among the most vulnerable to cyber threats.
A quick recap of Kaspersky’s monitoring throughout 2020 showed that the top cyber attacks in SEA were cryptomining, phishing scams, targeted ransomware, and DDoS (distributed denial of service). Not one of these attacks are new but these have been proven effective techniques as cybercriminals only need to tap into the weakest link — the human factor.
In 2020, the region was struck with massive cyber attacks resulting to exposure of confidential data:
● Over 310,000 credit card details issued by top banks in Indonesia, Malaysia, the Philippines, Singapore, Thailand, and Vietnam, were involved in a data breach in March.
● In the same month, personal information of 91 million users of Indonesia’s largest ecommerce platform were leaked.
● In Thailand, 8.3 billion subscribers of the country’s largest mobile network were exposed in May.
● A Singapore-based online grocery platform suffered a data breach affecting 1.1 million accounts in October.
Cybercriminals also capitalized on people’s fear of COVID-19 and used healthcare as a bait for different attacks targeting medical equipment in countries where digital transformation has just begun. A government database with personal data of 230,000 COVD-19 test takers in Indonesia was breached in May. Meanwhile in Thailand, a hospital confirmed four years’ worth of patient records were affected by an attack in September.
“2020 however has seen an unparalleled adoption of technology, and an increase in attack surface that is ripe for potentially more successful breaches. Those who have been quick to come on board this transformation must also be just as vigilant to protect themselves. As always, social engineering remains to be one of the most effective attack vectors and just as much as technology, a strong focus on education and awareness is needed more than ever,” says Muhammad Umair, Security Researcher for Global Research and Analysis Team (GReAT) Asia Pacific at Kaspersky.
“We do not see anything changing so soon. People in our region will remain social and will always look for ways to be productive using technology. In the business world, we see that remote work will be practiced in most sectors even after the pandemic subsides. Now is the time to reflect on the lessons of 2020 and we recommend companies start creating a security strategy if there’s none, or revising the existing one to effectively adapt to the changing environment and protect the workforce,” says Yeo Siang Tiong, General Manager for Southeast Asia at Kaspersky.
Kaspersky researchers list down key areas to watch out for in 2021 in SEA. Let’s take a look:
Digitalization
Under the new norm, the majority of sectors in the region have been increasingly going through a digital transformation in a race for survival. Schools are switching to remote learning, SMBs that never had online presence have started to build online store fronts, restaurants that never offered home delivery are left with no choice but to change their whole business model.
2020 has witnessed a drastic increase in the use of online payment services and transactions, as well as a growing number of potential victims have come online. We have already witnessed an increased number of phishing attacks on such victims in the first half of 2020 and this trend is expected to continue through 2021.
There were ample lures going around with a COVID-19 theme this year, and as the availability of vaccines draws closer, we might see similar lures incorporating vaccination themes as well.
Similarly, perimeter security is going to be one significant area of concern throughout 2021 as people continue to work from home, connecting to their corporate networks via VPNs.
The increased focus on remote working and reliance on VPNs opens up another potential attack vector: the harvesting of user credentials through real-world social engineering approaches such as voice phishing or “vishing” to obtain access to corporate VPNs. Another possibility is for attackers to accomplish their espionage goals without deploying malware in the victim’s environment.
CONTINUE READING…
