The Rise of Cybercriminality in Asia

Asia: The New Epicenter of Cybercrime

Asia-Pacific has become a global cybercrime hotspot over the past decade. During the first quarter of 2023, organizations in APAC faced an average of 1,835 cyberattacks per week – far above the global average of 1,248 . Law enforcement and industry reports have noted especially sharp increases in serious attacks:

Ransomware rampage: Ransomware incidents in APAC surged by roughly 39% in 2023 , a rapid rise that outpaced other regions. Major industries like manufacturing, real estate, and finance were among the hardest hit .
APT incursions: Advanced Persistent Threat (APT) groups have been extremely active in Asia. In 2024, over one-fifth of global APT attacks targeted the APAC region , with many campaigns focusing on government networks, critical infrastructure, and other strategic targets. Security analysts note, for example, that newly emerged APT groups like “DarkPink” have infiltrated military and government systems in the region .

These trends underscore how APAC – with its rapid digitalization and economic growth – has become “ground zero” for cybercrime incidents . The sheer volume and sophistication of attacks in Asia today threaten not only local organizations but also global supply chains and international security.

Historical and Structural Enablers

Several structural factors rooted in China’s cyber strategy have enabled this rise. Chinese military doctrine has long emphasized asymmetrical warfare, drawing on texts like Unrestricted Warfare (1999) that advocate using non-military tools – including cyber attacks – to undermine more powerful opponents . In essence, early Chinese strategists realized that cyberspace could be a battlefield where hackers might be used like soldiers, allowing a less dominant power to erode a tech-superior adversary’s advantages . This philosophy of unrestricted, all-domain warfare has informed China’s approach to cyber operations as instruments of influence and state power.

Another enabler lies in China’s internal handling of software vulnerabilities. Institutions such as the China National Vulnerability Database (CNNVD, managed by CNITSEC under the Ministry of State Security) run their own disclosure processes for new software flaws. Analysts have found evidence that China’s database sometimes delays public reporting of high-impact vulnerabilities – especially if those bugs are being secretly exploited by Chinese-linked groups . In one study, critical Microsoft Office and Android vulnerabilities were published weeks or months late in the Chinese database, apparently to give state hackers a head start in using them . This practice can stall global awareness of emerging threats and reflects a blurred line between China’s defensive and offensive cyber posture.

The Hybrid Threat Ecosystem

Asia’s cybercriminal ecosystem today is a complex blend of state-aligned hackers, organized crime syndicates, and opportunistic actors. These elements often overlap, creating hybrid threats that are difficult to combat. Key components of this ecosystem include:

State-Linked APT Groups

Nation-state hacking crews with links to China have mounted persistent intrusion campaigns across the region. For example, Singapore revealed in 2024 that it was grappling with an ongoing cyber-espionage attack on critical infrastructure by a group dubbed UNC3886 . Investigators publicly identified UNC3886 as a China-nexus APT known to infiltrate defenses, telecoms, and other strategic targets in Asia and the U.S., burrowing into systems and maintaining stealthy, long-term access . Likewise, a Chinese state-sponsored actor known as Volt Typhoon was uncovered infiltrating numerous American companies in sectors like telecom, energy, and water – even pre-positioning in U.S. power grids and pipelines, according to the FBI . U.S. officials warn that Volt Typhoon’s hackers have “burrowed” into critical U.S. infrastructure and could lie in wait for the right moment to cause destructive disruptions . These cases show how state-backed groups from Asia are conducting far-reaching espionage and preparing cyber sabotage, not only in their neighborhood but around the globe.

Organized Scam Syndicates

At the other end of the spectrum, financially motivated fraud rings have flourished across Asia – often with alarming scale and sophistication. One pervasive scam is the so-called “pig butchering” scheme, a blend of romance scam and investment fraud in which victims are courted over weeks or months before being defrauded. In 2023, criminal syndicates in Southeast Asia reportedly swindled as much as $37 billion from victims (mostly in East and SE Asia) through online fraud operations . These gangs leverage every tool available – from social engineering to cutting-edge AI. Investigations reveal that pig-butchering scammers devote long periods to grooming their targets, building trust via fake relationships or friendships . Only after this extended cycle of staged trust-building do they spring the trap, convincing victims to make big “investments” or transfers to fraudulent platforms . Recent academic studies confirm the lengthy, methodical lifecycle of these scams: perpetrators employ staged emotional manipulation, fabricated investment returns, and repeated high-pressure tactics to maximize the victim’s payout over time . In short, today’s Asian fraud enterprises run more like multinational corporations – complete with customer service scripts, hierarchical teams, and tech support – than lone scammers in a cafe.

Scam Centers and Human Trafficking

Perhaps the most disturbing element of this ecosystem is the rise of physical scam compound operations, many of them in Cambodia, Myanmar, and Laos. These are essentially cyber-fraud “factories” – office park-style compounds where hundreds or thousands of workers, many trafficked from abroad, are forced to run online scams. In Cambodia, for instance, the scam-centers industry has exploded into an enormously profitable domestic business. Recent estimates put the revenue from Cambodia’s cybercrime compounds at $12.5–19 billion per year, equivalent to as much as 60% of the country’s GDP . In places like Sihanoukville, gleaming casino complexes and SEZs (some tied to Chinese investors under Belt and Road projects) have been repurposed into scam factories.

Inside these scam centers, conditions are nightmarish. Recruits from across Asia (and beyond) are duped by promises of call-center or IT jobs, then effectively enslaved – held captive, beaten or tortured if they don’t meet scam quotas, and bought and sold between criminal syndicates . Investigations by the UN and human rights groups have documented how victims from countries including China, Malaysia, Thailand, India, and even as far as Africa and South America have ended up in these compounds . Criminal networks capitalize on weak governance and corruption in some Southeast Asian regions to operate these modern cyber-sweatshops with impunity. The human trafficking feeds the fraud, and the fraud in turn generates massive illicit profits that fund further criminal expansion. It’s a vicious cycle spanning continents.

Tech Escalation: From Deepfakes to AI Automation

As if traditional cyber tricks weren’t enough, criminals in Asia are increasingly deploying artificial intelligence to amplify their schemes. Recent developments include:

Exploding deepfake scams: The use of AI-generated deepfake content (doctored video/audio impersonations) in scams has spiked dramatically. The UN Office on Drugs and Crime reported a 600% increase in deepfake-related activity on Southeast Asian cybercriminal forums in early 2024 . Threat actors are using these convincingly faked voices and videos for social engineering, misinformation, and fraud. (This builds on an earlier 1,500% rise in deepfake crimes in the region during 2023 .)
High-profile deepfake heists: One illustrative case occurred in Hong Kong – an employee of UK engineering firm Arup was duped by what appeared to be a video call with her company’s executives. In reality, hackers had deployed AI to clone the faces and voices of the executives. Believing the “urgent” instructions on the call were real, the staffer transferred approximately HK$200 million (about US$25 million) to the fraudsters . This incident, confirmed by Arup in early 2024, shows the scale of deception now possible: an intricate deepfake successfully mimicked multiple senior managers on a live call, fooling internal controls and nearly stealing $25 million in one strike.
AI-powered social engineering: Generative AI tools are also being weaponized for more subtle “financial stalking” of targets. Chatbots and algorithms can trawl social media for personal details, craft highly personalized phishing messages in flawless multiple languages, and even sustain long conversations with victims to build rapport . AI can generate fake documents, emails or websites that are virtually indistinguishable from the real thing, making scams harder to spot. In business email compromise cases, for instance, scammers can use AI to instantly translate and tailor their con emails to sound exactly like a specific CEO or supplier. Overall, the barriers to entry for sophisticated fraud have been lowered – one no longer needs a whole team of eloquent con artists when an AI model can help fabricate a compelling backstory or a realistic voice on the phone.

The net effect is that cybercriminals are scaling up their operations with automation. What once required significant manpower (or womanpower, in romance scams) can now be partly handled by bots and deepfake avatars. This tech escalation is forcing companies and governments to rethink how to authenticate identities and verify truth in the digital realm.

Regional Reach and Political Dynamics

Asian cybercrime’s footprint now extends far beyond Asia. Flush with cash and facing pressure at home, some criminal syndicates have begun exporting their operations overseas:

Global expansion: Scam networks born in China or Southeast Asia have been linked to physical scam outposts in Africa, the Middle East, Eastern Europe, and South America. In one striking example, investigators found that Asian syndicates set up partnerships with drug cartels in Latin America, even establishing scam call centers as far afield as Peru . Meanwhile, since 2024 authorities have raided scam compounds in countries like Nigeria, Zambia, Angola, and Namibia – all of which involved Chinese nationals running the schemes . Groups are also investing in Pacific Island nations (e.g. Vanuatu), building casinos and resorts as fronts and exploiting local citizenship-by-investment programs to evade extradition . In short, Asia’s cyber-fraud cartel is metastasizing globally, tapping into new populations of victims and co-opting local criminals abroad .
Cover of Belt and Road: Geopolitical initiatives like China’s Belt and Road Initiative (BRI) may have unintentionally provided cover for some illicit actors. In Southeast Asia, Chinese-owned casinos, real estate projects, and special economic zones – often BRI-linked – have at times turned into havens for scam operations. U.S. analysts note that Chinese crime syndicates often align themselves with Beijing’s interests, openly supporting BRI projects and pro-China messaging to win implicit protection from officials . This patriotic posturing (such as flying Chinese flags over scam enclaves or funding local BRI events) has allowed networks to expand with at least tacit approval from elements of the Chinese government . It blurs the line between criminal enterprise and state-connected activity, complicating efforts to crack down.
Diplomatic frictions: All the while, international cooperation against cybercrime remains patchy. Countries often disagree on definitions of cybercrime versus state espionage, and on issues of digital sovereignty. For example, Western law enforcement views state-sponsored hacking theft as crime, whereas China and others classify such activity as national security matters beyond the scope of police cooperation. These tensions have stymied joint action. Even within Asia, differing legal frameworks and concerns about sovereignty hamper cross-border investigations. INTERPOL highlights that the global nature of cybercrime collides with jurisdictional limits, making it hard to pursue perpetrators across borders . Trust between nations is easily undermined by accusations of cyber-spying. The result is an uneven regional response, where bilateral extradition of cybercriminals is rare and collective crackdowns are slow compared to the criminals’ agility.

Cybersecurity Response Trends

Amid this onslaught, governments and businesses in Asia are ramping up defenses – albeit from behind the curve in many cases. Notable response trends include:

Surge in security investment: Cybersecurity spending across APAC is rising rapidly. Industry forecasts project that APAC’s security market will reach about $52 billion by 2027, growing at roughly 12–13% annually . Countries like Singapore, Australia, and India are pouring resources into cybersecurity programs, from beefing up critical infrastructure protection to funding AI-based threat detection startups. The private sector too is investing in tools for threat intelligence, incident response, and employee training. This spending growth reflects a recognition that traditional IT security is insufficient against the new breed of threats (think deepfakes and human-operated ransomware), so new technologies and services are in high demand .
Awareness of deepfakes and AI threats: There is a growing public awareness in Asia of AI-augmented cyber threats. For instance, Singapore authorities recently issued public advisories about AI deepfake scams after seeing cases where criminals impersonated CEOs and government officials on video calls . The Monetary Authority of Singapore, police, and Cyber Security Agency jointly warned businesses to verify identities via secondary channels and not trust video alone . Critical infrastructure operators are also being alerted to the risk of synthetic media attacks – e.g. a deepfaked emergency message could be used to trigger panic or a false response. Such education efforts indicate that combatting deepfakes has become a national security priority in tech-forward Asian states.
Faster threat detection: Crucially, organizations are improving at detecting breaches faster, reducing the “dwell time” that attackers spend inside networks. According to an analysis of recent incidents in Singapore, the average attacker dwell time plummeted from 1,095 days to just 49 days in the past year . In other words, intruders who once lurked unseen for three years are now being discovered in under two months on average. This dramatic improvement suggests that investments in monitoring and anomaly detection are paying off – security teams are catching threats earlier, before they can do as much damage. Shorter dwell times mean less data stolen and fewer systems compromised. It’s an encouraging sign that despite the growing threats, defenders are learning to react more quickly and evict intruders sooner .

What “we” Recommends

To get ahead of these challenges, the Cyber Protocol Intelligence Lab (author of this analysis) suggests a multi-pronged strategy for Asian cyber defenders and policy makers:

Map the networks: Conduct intelligence-led mapping of scam syndicates and trafficking hubs – especially the big compounds in Southeast Asia and any clusters operating under cover of international projects (e.g. BRI zones). Illuminating the landscape of players, finances, and locations is a first step to coordinated crackdowns.
Leverage AI for defense: Just as criminals use AI deepfakes and bots, defenders should deploy AI-driven detection tools. Systems tuned to catch the subtle hallmarks of deepfake audio/video or the patterns of “socially engineered” narratives can help flag fraud attempts early. For example, banking systems could use AI to spot when a funds transfer request doesn’t quite match a CEO’s usual speech cadence or language – potentially neutralizing an impostor before the money moves.
Harden critical infrastructure: Given the proven APT intrusions, governments and utilities need to double down on securing vital systems. This means robust identity verification for remote access (to stop phishing-derived breaches), network segmentation and anomaly monitoring to catch suspicious movements, and regular threat hunting in OT (operational technology) environments. Assume that sophisticated adversaries might already be inside and practice incident response accordingly.
Boost cross-border cooperation: Push for stronger regional and international frameworks to pursue cybercriminals, even amid geopolitical strains. This could include new treaties or working groups focused on scam compound trafficking, information-sharing on APT indicators, and joint law enforcement operations in places willing to host them. Multilateral bodies (ASEAN, INTERPOL, UNODC, etc.) should be empowered to work around the diplomatic stalemates on “cyber sovereignty” and facilitate practical cooperation.
Invest in human resilience: Technology alone isn’t enough – people are both the targets and the first line of defense. Public awareness campaigns about deepfakes and phishing, community programs to report scam approaches, and workforce training in cybersecurity can greatly reduce the victim pool. Meanwhile, support networks for those rescued from scam slavery (with rehabilitation and witness protection) can aid prosecutions and deter recruiters. Essentially, cultivate a human immune system against cybercrime, from alert individual citizens up to cyber-savvy executives in boardrooms.

Final Reflections

What we see emerging in Asia is not a series of isolated cyber incidents, but a convergent criminal ecosystem. It blends elements of organized crime (fraud rings, trafficking cartels), state espionage (APT hackers, clandestine campaigns), advanced technology (AI deepfakes, malware-as-a-service), and social engineering on a mass scale. This means that tackling the problem also requires a holistic approach – traditional IT security fixes or arresting low-level scammers will barely make a dent. Instead, defenders must understand the full narrative and scope: from the psychological ploys of pig-butchering scams, to the geopolitical motivations behind state-backed hackers, to the money laundering pipelines that keep the whole machine running.

For Asia and the world, the stakes are high. A digital bank robbery or deepfake corporate heist can cost tens of millions overnight. A state-planted cyber “time bomb” in a power grid could, in a conflict scenario, black out cities. Beyond the monetary losses, the erosion of trust – in systems, in information, even in what one sees with one’s own eyes – is a profound societal threat. Yet, as this report has highlighted, there are also positive signs: awareness is rising, and so is the resolve to respond. If the “dragon’s digital shadow” has fallen across the cyber realm, it is incumbent on all stakeholders to shine a light and push it back. In this fight, knowledge truly is power, and collaboration is our best weapon. Understanding the enemy’s playbook is not academic – it’s essential for mounting a successful defense in the cyber age.