Get 24/7 incident response assistance from our global team
Please review the following rules before submitting your application:
1. Our main objective is to foster a community of like-minded individuals dedicated to combatting cybercrime and who have never engaged in Blackhat activities.
2. All applications must include research or a research draft. You can find content criteria in the blog. Please provide a link to your research or research draft using the form below.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
The High-Tech Crime Trends Report 2026 reveals how this shift has industrialized cybercrime, exposed the limits of perimeter-based defenses, and elevated identity and trust as the new primary attack surfaces.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Learn more
Group-IB’s February 2026 Intelligence Insights provide a deep dive into four critical pillars: ransomware, hacktivism, compromised accounts and financial fraud.
Unlike aggregated open-source reports, this intelligence is drawn directly from Group-IB’s proprietary telemetry, dark web monitoring and infostealer tracking.
The Gentlemen Surge as Ransomware Ticks Upward. Adversary of the Month: The Gentlemen. Thailand Becomes the DDoS Epicentre. Tax Season, Trusted Brands, and a $2 Million Fraud Campaign Targeting Indonesia.Google's Own Infrastructure Turned Against APAC Organisations. The Gentlemen is the dominant group, executing 29 attacks — a 262.5% increase from January and the highest output of any single group in the region for the second consecutive month. Qilin remains active with 10 incidents. India and Thailand are the most targeted countries, manufacturing is the hardest-hit sector at 27% of all incidents, and Singapore saw three confirmed ransomware victims in February.
For ransomware, India leads with 18 incidents, followed by Thailand (14), Australia and Taiwan (8 each). For DDoS and hacktivism, Thailand experienced a dramatic spike with 267 of the 324 total incidents recorded. For infostealer-driven account compromise, India accounts for 34.7% of the regional total, with Indonesia, Bangladesh and Vietnam also heavily affected. For bank card fraud, India (23.8%), Malaysia (13.9%), and Japan (12.4%) are the primary targets.
Vidar remains the dominant infostealer family, responsible for nearly half of all 2,337,460 compromised accounts recorded. The 61.37% month-on-month decline in total volume reflects a data normalisation following a new source onboarded in January 2026, not a genuine reduction in threat activity. India, Indonesia, Bangladesh and Vietnam are the most heavily affected countries.
February’s report documents several significant APAC-specific incidents: GoldFactory’s tax-season fraud campaign in Indonesia causing estimated losses of USD 2 million; the GTFire phishing campaign abusing Google Firebase and Google Translate at scale across 100 countries; Chinese MSS disclosures about foreign intelligence operatives infiltrating professional platforms like WeChat and DingTalk; and the GhostBat Android malware campaign targeting Indian users through fake banking and government applications to steal UPI PINs and Aadhaar numbers while covertly mining cryptocurrency.
This free report is an essential 15-minute read for APAC Security and Risk Professionals:
Chief Information Security Officers (CISOs), Chief Information Officers (CIOs) and Heads of Security.Fraud, Risk and Compliance Leaders.Government and Law Enforcement Professionals.Security Operations Center (SOC), Incident Response (IR) and Threat Intelligence (TI) Teams.Board Level and Executive Decision Makers.
If you are responsible for protecting digital assets, customers or national infrastructure in APAC, this report is for you.
We see the full picture of the evolving cyber threat landscape thanks to unique tools for monitoring the infrastructure used by cybercriminals and data from battlefields:
