Cyber threats remain a major concern across Asia Pacific (APAC), with Kaspersky reporting that it blocked 250,000 ransomware attacks in the region during the first six months of 2026.
According to data from the Kaspersky Security Network (KSN) analysed by its Global Research and Analysis Team (GReAT), the cybersecurity company detected and blocked 75 million attacks originating from online resources across APAC between January and June 2026.
During the same period, Kaspersky also prevented 3.4 million backdoor attacks and 2.4 million password stealer attacks. The company said it observed a slight increase in backdoors, although some other attack categories recorded slight declines.
Kaspersky warns AI is making cyberattacks faster and more adaptive
Kaspersky cautioned that declines in certain attack categories should not be seen as reduced cyberattacks.
Kaspersky GReAT’s Head of APAC and META research units Sergey Lozhkin said, “While we observed slight declines in some attack categories during the first half of 2026, this should not be mistaken for a weakening threat landscape in the region. We are also monitoring that threat actors are increasingly leveraging AI to automate reconnaissance, accelerate malware development, and scale attacks, making them faster and more adaptive.”
Looking at high-severity security incidents globally in 2025, Advanced Persistent Threats (APT) accounted for 24%, followed by social engineering at 15% and malware at 12%.
An APT typically involves a sophisticated and targeted cyber campaign where attackers gain unauthorised access to a network and maintain a covert presence over a prolonged period.
These attacks can be used for cyber espionage, stealing sensitive information or achieving longer-term strategic objectives.
Kaspersky said its GReAT team currently monitors more than 900 APT groups worldwide. Five of the top 12 most targeted countries globally are located in APAC, namely China, India, Myanmar, Pakistan and Vietnam.
Supply chain attacks are becoming a bigger threat
Kaspersky has also highlighted the growing threat from supply chain attacks. A Kaspersky study found that nearly one in three organisations globally had experienced a supply chain-related incident over the past year.
These attacks can be particularly concerning because threat actors can compromise software or infrastructure that users already trust.
One example highlighted by Kaspersky involved eScan, where attackers compromised its antivirus update infrastructure and used a legitimate update server to distribute malware to customers.
Kaspersky also cited an incident involving Notepad++, where a malicious installer delivered a Trojan backdoor that allowed attackers to maintain access to affected systems for months.
Meanwhile, Kaspersky GReAT said an active supply chain attack targeting the official Daemon Tools website has been underway since April 2026. Malware was bundled with legitimate software, resulting in more than 2,000 victims across over 100 countries and territories, with largest concentrations in Russia, Brazil, Turkey, Spain, Germany, France, Italy and China.
Axios supply chain attack linked to BlueNoroff campaigns
Another major supply chain incident highlighted by Kaspersky involved Axios, a widely used JavaScript HTTP client library which the company said receives more than 100 million weekly downloads on npm.
According to Kaspersky, attackers compromised the npm account of a lead Axios maintainer in March 2026 and used the account to publish malicious versions of the package.
During its analysis, Kaspersky GReAT said it identified technical overlaps between the Axios incident and GhostCall and GhostHire, two previously documented campaigns attributed to BlueNoroff.
BlueNoroff is described by Kaspersky as a financially motivated subgroup of the Lazarus Group which is known for targeting financial institutions and cryptocurrency platforms. GhostCall targets executives using social engineering, while GhostHire disguises malware as job opportunities and coding tests aimed at blockchain developers.
Open-source software increasingly targeted
Kaspersky also reported an increase in threats targeting open-source software. It detected 19,484 malicious packages in 2025, which is an increase of 37% from 14,197 in 2024.
Meanwhile, Hacktool detections increased 11% year-on-year from 2,966 to 3,302.
Lozhzin added, “We see a rising volume of threats targeting open-source software. In 2025, we detected 19,484 malicious packages, a 37% increase from 14,197 in 2024, while hacktool detections rose 11% year-on-year from 2,966 to 3,302. The findings underscore the growing need for organisations to strengthen software supply chain security as open-source components become increasingly integral to modern applications.”
As supply chain attacks continue to grow in both scale and sophistication, Kaspersky is strengthening its focus on securing open-source software ecosystem. Its Open-Source Software Threats Data Feed provides organisations with actionable intelligence on vulnerabilities (CVEs), malicious and compromised packages, as well as risk ware and hacking tools.
Kaspersky recommends that organisations strengthen their cybersecurity with real-time threat detection and response capabilities, while considering managed security services where in-house expertise is limited. It also recommends providing security teams with up-to-date threat intelligence to identify and respond to emerging cyber risks.
