APAC Intelligence Insights Report, March 2026

Targeting varies by threat type. For ransomware: Australia and Thailand lead jointly with 18 incidents each; followed by India, Malaysia and Taiwan. For DDoS and hacktivism, India and South Korea together represent approximately 80% of all regional activity. For infostealer-driven account compromise, India accounts for 43% of the regional total. For bank card fraud, India and Japan are the primary targets, contributing nearly half of all cases between them.

Vidar is the dominant malware family in APAC, responsible for nearly 60% of all compromised accounts in March 2026 — up from 48.6% in January 2026. It primarily targets saved passwords, session tokens, and browser cookies, allowing threat actors to access accounts and bypass multi-factor authentication. India, Indonesia and the Philippines are the most heavily affected countries.

Telegram and TG bots together now account for over 93% of all stolen bank card distribution tracked by Group-IB in March 2026. The move to Telegram allows criminals to automate card sales via bots, reach buyers at scale, and reduce their exposure to law enforcement takedowns. Dark web forum monitoring now covers less than 7% of distribution activity, making Telegram channel intelligence the primary detection surface for stolen financial data.

The Gentlemen is a financially motivated ransomware group active since May 2025, with approximately 15 members. Unlike traditional Ransomware-as-a-Service operations, the group distributes tools directly via Tox messenger without an affiliate panel. In March 2026 alone, the group executed 36 attacks across nine APAC countries. Group-IB has published a full TTP overview “Hasta la vista, Hastalamuerte” providing detailed analysis of the group’s tactics, techniques and procedures.