Report an incident

Get 24/7 incident response assistance from our global team

Talk to sales

Just fill out the form, and our representative will contact you soon.

Join the Cybercrime Fighters Club

Please review the following rules before submitting your application:

1. Our main objective is to foster a community of like-minded individuals dedicated to combatting cybercrime and who have never engaged in Blackhat activities.

2. All applications must include research or a research draft. You can find content criteria in the blog. Please provide a link to your research or research draft using the form below.

AUNZ Intelligence Insights Report, April 2026
← Research Hub

AUNZ Intelligence Insights Report, April 2026

This summary provides an overview of the cybersecurity landscape in the Asia-Pacific (APAC) region for April 2026, based on intelligence from Group-IB.

Key Threat Trends (March vs. April 2026)

Ransomware:Ransomware:

Incidents decreased by 26.67% to 121, with "The Gentlemen" remaining the most active group. Manufacturing remains the most impacted industry.

DDoS & Hacktivism:DDoS & Hacktivism:

Incidents increased by 25%, with South Korea, China, and India experiencing the most activity. Government and military sectors were the primary targets.

Compromised Accounts:Compromised Accounts:

Leaked data events surged by 143.38%, totaling over 5.3 million records. Redline Stealer was the most prevalent malware.

Compromised Bank Cards:Compromised Bank Cards:

Leaked card instances decreased by 41.47%. Telegram remains the primary distribution channel.

Initial Access Brokers (IAB):Initial Access Brokers (IAB):

IAB events dropped by 44.44%, with 15 incidents recorded.

Notable Global & Regional Incidents

Supply Chain Attacks:Supply Chain Attacks:

SAP’s Cloud Application Programming Model was targeted by a supply chain attack using malicious info-stealing packages. Additionally, a malicious package impersonating the Bitwarden CLI was published to npm by TeamPCP.

Data Leaks & Breaches:Data Leaks & Breaches:

FulcrumSec leaked corporate data from LexisNexis; a database from Chongqing Fumin Bank containing over 4 million records was advertised for sale; and the Russian Infrastructure Destruction Squad claimed breaches at the FAA and several South Korean government institutions.

Attacks on Critical Infrastructure:Attacks on Critical Infrastructure:

Unauthorized access was reported to OT systems in India’s water supply and 30 American camera systems by Anonymous Switzerland.

Scams:Scams:

Group-IB researchers identified the alleged sale of 82 million Agoda records as a fabrication by a known scammer.

Adversary of the Month

Coinbase Cartel:Coinbase Cartel:

This group specializes in data exfiltration without encryption. They conducted 11 attacks in APAC during 2026, including targets like the Tokyo Institute of Science and Pacific Airlines.

Relevant reports

We see the full picture of the evolving cyber threat landscape thanks to unique tools for monitoring the infrastructure used by cybercriminals and data from battlefields:

Intelligence Insights Report, April 2026
New
Trend Report
Intelligence Insights Report, April 2026
Explore the most notable cybersecurity events in the region and the best practices
Learn more
Fake Investments, Real Consequences: Uncovering Investment Scams Targeting USA and Australia
New
Trend Report
Fake Investments, Real Consequences: Uncovering Investment Scams Targeting USA and Australia
Learn more
Inside Europe’s Manufacturing Cyber Threat Landscape
New
Trend Report
Inside Europe’s Manufacturing Cyber Threat Landscape
Why the biggest risks to industrial operations begin outside the factory
Learn more
Intelligence Insights Report, March 2026
New
Trend Report
Intelligence Insights Report, March 2026
Explore the most notable cybersecurity events in the region and the best practices
Learn more