Cyber999 Advisories

Quarter 1 2025 Cyber Incident Summary Report
Cyber999 Incident Response Centre of CyberSecurity Malaysia
TLP WHITE

1.0 Introduction
The Cyber Incident Quarterly Summary Report Q1 2025 provides an overview of computer security incidents handled by the Cyber999 Incident Response Centre of CyberSecurity Malaysia in Q1 2025.

This quarterly Cyber Incident Report also highlights statistics of incidents dealt with by Cyber999 Incident Response Centre in Q1 2025 according to their categories and security alerts and advisories released in this quarter. It should be noted that the statistics provided in this report reflect only the total number of incidents reported and handled by the Cyber999 Incident Response Centre, excluding elements such as monetary value or aftermaths of the incidents. Computer security incidents dealt with by the Cyber999 Incident Response Centre involved IP addresses and domains from Malaysia.

CyberSecurity Malaysia works closely with ISPs, CERTs, Special Interest Groups (SIGs) and Law Enforcement Agencies (LEAs), from local and international, to remediate and mitigate computer security incidents affecting Malaysia's organisations and the public.

2.0 Trends Q1 2025
There were 33.59 million internet users in Malaysia at the start of 2024, while Malaysia was home to 28.68 million social media users in January 2024, equating to 83.1 percent of the total population [1]. Meanwhile, a total of RM3.18 billion has been lost to online scams involving more than 95,800 victims between 2021 and April 2024 [2]. In general, the Cyber999 Incident Response Centre receives incident reports from Internet users, members of the public, home users, small and medium enterprises (SMEs), industries, academia, and non-profit organisations (NGOs). We proactively seek and gather insights on cyber threats through partnerships and collaborations worldwide that could impact Internet users and organisations in Malaysia and aid in mitigating these threats. The Cyber999 Incident Response Centre received 1657 incidents in Q1 2025, compared to 1550 incidents in Q4 2024. This indicates a 7 percent increase in Q1 2025.

Tables 1 to 3 below provide details of the incidents, and their figures reported in Q4 2024 and Q1 2025.

Table 1: Comparison of Incidents Reported in Q4 2024 and Q1 2025

Table 2: Breakdown of Incidents Based on Months in Q1 2025

Table 3: Breakdown of categories and sub-categories of incidents in Q1 2025

Figure 1 illustrates and provides an overview of the incidents reported in Q1 2025 in a chart. Figure 2 illustrates the percentage of incidents based on their classification.

Figure 1: Breakdown of incidents based on categories in Q1 2025

Figure 2: Percentage of incidents reported by categories in Q1 2025

Based on the above statistics, it is remarkable that most categories of incidents reported to us increased in Q1 2025 compared to Q4 2024. Intrusion incidents rose by 76 percent compared to Q4 2024. In Q1 2025, the most frequently reported incidents were Fraud, Intrusion, and Data Breach. Fraud accounted for the majority, representing 68 percent of all reported cases, followed by Intrusion at 12 percent and Data Breach at 8 percent.

Based on the current trends, fraud incidents will most likely continue to grow in Malaysia in 2025. Data breach incidents have slightly increased for this quarter. However, organisations and Internet users are urged to take proper security measures to prevent data breaches.

Meanwhile, for fraud incidents other than phishing URLs, new tactics and techniques in online scams that concatenate social engineering, and malicious code could grow in Malaysian cyberspace.

2.1 Top Fraud Incidents Reported in Q1 2025
Fraud continuously prevails within the community, targeting various citizens, end users and organisations, from students to professionals, large to small organisations. It has become a preferred method of criminals as awareness is still lacking among the public, making them an easier target. One thousand one hundred – twenty-six fraud incidents were handled this quarter, representing 2 percent increase compared to Q4 2024. All the fraud incidents were received from organisations and public users. The top fraud incidents reported to the Cyber999 Incident Response Centre are as follows:

Table 4: Top Fraud Incidents Reported in Q1 2025

Our statistics show that over three-quarters of fraud incidents reported are phishing, representing 68percent of total fraud incidents reported in Q1 2025. We observed the following phishing trends in Malaysia based on the incidents reported to us. These trends are similar in the previous quarter, Q4 2024.

a.Contextualised and Localised Phishing Themes 

Government Aid Scams: Phishing emails or SMS impersonate legitimate government programs (e.g., bantuan/sumbangan kerajaan), offering financial aid but requiring victims to provide personal details or click malicious links.

Fake Promotions and Discounts: Popular brands like Lazada, Shopee, or local retailers are spoofed, luring victims with fraudulent discounts or free vouchers. 

Traffic Summons Scams: Messages claim unpaid police summons, providing fake payment links to steal financial credentials. 

Subscription Services: Services like Netflix or Spotify are impersonated, tricking victims into renewing subscriptions or fixing payment issues on fake websites. 

b.Mobile-Focused Phishing (Smishing and App-Based) 

Smishing (SMS Phishing): Attackers send fraudulent SMS messages mimicking banks, e-wallets, or delivery services (e.g., J&T, Pos Malaysia) with malicious links. 

c.Phishing Calls (Vishing) 

Phone Scams: Attackers impersonate government agencies (e.g., police or LHDN, MCMC), banks, companies, or even CyberSecurity Malaysia, pressuring victims to disclose sensitive information. Common tactics include threats of legal action, account suspension, or overdue payments. 

Therefore, Internet users and organisations must be vigilant when conducting online transactions or performing e-commerce transactions to avoid becoming victims of online fraud.

2.2 Top Malware Incidents Reported in Q1 2025
The top malware incidents include malware hosting, ransomware, malicious APK, backdoors, and trojans. The top reported malware incidents are related to malicious APKs. This type of incident is typically received from Internet banking users and sometimes from local financial institutions.

A malicious APK is an Android Package (APK) file containing malware designed to harm devices, steal data, or perform unauthorised actions. APK files are used to distribute and install applications on Android devices, and malicious versions exploit this format to spread malware. They often mimic popular apps (e.g., social media, games, or utilities) to trick users into downloading. Attackers may distribute these files through phishing emails, social media, fake websites, or third-party app stores.

Table 5: Types of Malicious APKs Reported in Q1 2025

The second top-reported incident within the malware category is malware hosting. Malware hosting primarily targeted vulnerable servers with outdated security patches and updates. These incidents are usually received from foreign entities, such as anti-virus vendors and special interest groups, regarding servers in Malaysia that are hosting malware. System Administrators must be vigilant and keep systems up to date with the latest patches and security updates to prevent servers from being compromised and hosting malware.

Ransomware incidents decreased in Q1 2025 compared to the previous quarter. We received 16 incidents in Q4 2024 and 12 in Q1 2025, indicating a 25% decrease. Nevertheless, organisations must be vigilant about the decrease in ransomware incidents in this quarter. Ransomware is malicious software (malware) that infects a computer and restricts access until the requested ransom is paid. It is also considered one of the costliest and most devastating attacks, as it is enormous to recover all the data and rectify infected machines.

Our finding identified that businesses are most impacted by ransomware incidents in Malaysia, consistent across the globe. Active Directory(AD) servers have become primary targets in Malaysia. Compromising AD servers can significantly amplify the impact of a ransomware attack. Using tools like PsExec, Group Policy Objects (GPOs), or Windows Management Instrumentation (WMI) to execute ransomware on all connected systems. Ryuk and Conti have been observed targeting AD servers for mass deployment and faster network-wide encryption. We also observed attackers exploit vulnerabilities in virtualisation platforms like VMware, and ESXi servers can be targeted directly, allowing attackers to gain control over multiple VMs simultaneously. Ransomware operators use phishing attacks, brute force, or stolen credentials to access VM management consoles or servers. LockBit has been observed deploying scripts to attack VMware environments, including deleting backups and snapshots.

Looking at the current trends, ransomware incidents will continue to grow in Malaysia in 2025. The results show that reported ransomware incidents have slightly decreased in this quarter. Organisations and Internet users must always take proper security measures against ransomware incidents. Good backup management, password security, and cyber security awareness are essential in combating ransomware and other types of malware. Implementing the backup procedure, policy, and best practices among organisations and public users is also essential in mitigating ransomware attacks.

Table 6: Ransomware Variants Reported in Q1 2025

Apart from ransomware, we also handled incidents involving botnets that infected computers in Malaysia. A botnet (short for robot network) is a network of computers or devices infected by malicious programs and controlled by a single attacker called a botmaster or bot herder. These infected devices, called bots or zombies, enable the attacker to control them remotely. Botnets are commonly used in:

1. Distributed Denial-of-Service (DDoS) Attacks: to overwhelm a target system, server, or network, making it unavailable to legitimate users.
2. Massive Spam Campaigns: Sending large amounts of phishing or spam emails.
3. Credential Theft: Logging keystrokes to steal passwords or sensitive information.
4. Cryptojacking: Using infected devices to mine cryptocurrency without consent.

Below is the list of top botnets that infected computers, primarily belonging to individuals and organisations in Malaysia, as reported to the Cyber999 Incident Response Centre in Q1 2025:

Table 7: Types of Botnets Reported in Q1 2025

Apart from ransomware, botnets and malware hosting, we also handled incidents related to infostealer in Q1 2025. Infostealer is malicious software created to breach computer systems and steal sensitive information, including login details. Generally, data from the infostealers contained login credentials from various sources, including information saved on web browsers (such as passwords and credit logins), auto-filled logins, FTP clients, email apps, instant messaging clients, and VPNs.

Below is a list of infostealers associated with data breach reported to us in Q1 2025:
Table 8: Info stealers reported in Q1 2025

2.3 Data Breach Incidents Growing in Malaysia
Data breach incidents are growing in Malaysia, with a nearly 29 percent increase this quarter, underscoring the need for better security measures to ensure national security and public trust. High-profile breaches often involve massive datasets, including personal identifier information (PII) like identification numbers, addresses, and financial details, and often involve PII from national databases. Serious security measures must consistently be implemented to prevent and mitigate data breaches, especially for personal data. 

We are also observing a trend where perpetrators exfiltrate or steal sensitive data from organisations and hold the data hostage, in some cases after ransomware attacks. Perpetrators will then threaten the organisation to release or sell the data on the dark web unless the organisation pays ransom within a timeframe set by the perpetrators. In the case of extortion by perpetrators, we always advise organisations to refer the matter to the LEAs, such as the police, for assistance.Other trends we observed in this quarter include resurfacing of previous data breaches. Perpetrators claimed and posted on the dark web that they have breached data belonging to specific organisations. However, our analysis confirmed these are resurfaces of previous data breaches that happened a few years back and not new breaches. 

Table 9: Data Breaches Reported in Q1 2025

3.0 Security Advisories and Alerts Released in Q1 2025
In Q1 2025, the Cyber999 Incident Response Centre issued 73 Security Advisories and one Alerts, each with descriptions, mitigation steps, and recommendations for organisations and Internet users to follow. The security advisories involved Mozilla, Microsoft, Apple, VMware, and several other CVEs listed in Table 10. The security alerts concern growing online fraud and malware threats that we identified as potentially serious to citizens and organisations in Malaysia. If not correctly identified and mitigated, such threats could have serious consequences for citizens and organisations.

Table 10: List of Significant CVEs in Q1 2025 
Here is the table with the CVEs and their descriptions:

4.0 Conclusion
Overall, the number of computer security incidents reported to the Cyber999 Incident Response Centre in Q1 2025 was 1,657, representing an increase of about 7% compared to Q4 2024. No significant or severe incidents were observed during this quarter. Nevertheless, organisations and individuals must always be vigilant with readiness and preventive and mitigation steps against potential threats. Perpetrators are very motivated, eager, and determined to use new and sophisticated tactics and techniques to execute cyber-attacks. 

Hence, we strongly recommend that all internet users be constantly aware of today's cybercrime trends and adhere to the best cyber hygiene practices. This also includes secure handling of emails from unknown sources, safe web browsing, purchasing goods online, and using social media applications. Users must keep systems up to date with the latest security patches and updates to prevent their computers from being compromised or infected with malware. Always check the legibility of the applications, portal, merchants, services, and products before conducting any online transaction. 

As the complexity of cyber threats continues to increase, organisations and individuals could be potential targets if they are not equipped with security awareness. Providing security awareness campaigns to citizens and organisations is among the best efforts to improve national cyber security and public trust. 

Malaysian Internet users and organisations may contact us to report cyber security incidents at the below contact:

E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my

5.0 References:

[1] https://datareportal.com/reports/digital-2024-malaysia

[2] https://www.nst.com.my/business/economy/2024/08/1090337/rm32b-lost-online-scams-between-2021-and-april-2024-gobind