Semperis has released Singapore findings from its annual ransomware report, which found that organisations in Singapore faced AI-linked ransomware attacks at 1.5 times the global rate.
According to the study, six in 10 Singapore organisations targeted by ransomware in the past year said attackers used AI, compared with 40% globally. Nearly all respondents in Singapore, or 98%, said AI featured in the attack in some way, whether used by attackers, defenders or both.
The data also pointed to a new route into organisations. Some 42% of Singapore respondents said attackers manipulated or exploited an AI agent or system within their organisation, suggesting internal AI tools are becoming part of the attack surface.
Identity systems remained central to these incidents, with 92% of ransomware attacks in Singapore targeting or exploiting identity infrastructure, above the global figure of 87%.
Systems cited included Active Directory, Entra ID and Okta. Yet only 54% of organisations said they maintained dedicated identity backup systems, while fewer than half had automated identity system recovery.
Threat tactics
The findings showed attackers were also putting pressure on employees beyond the workplace. Among organisations that received threats, 56% reported threatening texts, letters or packages sent to home or office, while 41% said family members or friends were threatened.
In a smaller but more severe category, 14% of organisations whose attackers used threats said they also faced threats of abduction. Across the wider group of countries surveyed, psychological intimidation featured in nearly a quarter of all attacks.
Methods used by ransomware groups in Singapore have changed since the previous year. Last year, 66% of Singapore organisations said hackers threatened to file regulatory complaints if incidents went unreported.
This year, the most common threats were blackmail, extortion or public shaming at 47%, followed by data erasure, destruction or release at 45%. System lockouts or operational sabotage followed at 37%.
The business fallout was also significant. The study found that 52% of Singapore organisations reported business disruption or revenue loss, 47% had cyber insurance cancelled or premiums raised, and 26% paid a ransom.
Mixed AI results
Defensive use of AI produced mixed results. Some 49% of respondents said they successfully used AI to detect or respond to an attack, but 28% said the AI tools in place failed or worked only partly.
Looking ahead to the next 12 months, 50% of Singapore organisations identified evolving threats, including AI-based threats, as the biggest challenge to operational resilience. That places AI at the centre of both the threat environment and the response debate.
Singapore organisations also identified practical barriers to handling incidents effectively. The main blockers were cross-team communication gaps, cited by 49%, too many disparate tools at 38%, and outdated response plans at 37%.
Gerry Sillars, Vice President, Asia Pacific and Japan, Semperis, said the results showed that AI risk extended beyond tools used by criminals. “Attackers are using AI against Singapore organisations more often than the global average. And the fact that attackers manipulate internal AI agents show that the risk is not limited to AI in the attackers’ hands,” said Sillars.
He said organisations needed to bring internal AI systems under standard security controls. “Organisations need to treat their own AI agents as part of the attack surface, with the same identity controls, permissions and monitoring as any privileged account,” Sillars said.
Mickey Bresman, Chief Executive Officer, Semperis, said ransomware groups had repeatedly adapted their methods as companies improved resilience. “The bad guys are always evolving their tactics,” Bresman said. “When the initial wave of ransomware attacks began, most focused on data encryption. Then, after data backup and recovery systems started gaining traction and enabling companies to resist ransom demands, we saw double extortion: encryption coupled with data theft and threats to expose or sell that data. So it makes sense that we’ll continue to see attackers trying to find more ways to make victims pay.”
Sillars said incident preparation needed to extend to identity systems and staff safety. “Organisations should back up and rehearse recovery of the identity layer as well as data and applications, and build staff safety and law-enforcement contact into their crisis plans. Regular tabletop exercises are the quickest way to find out whether the plan works and whether the teams involved can communicate under pressure,” Sillars said.
Click Here For The Original Source.
——————————————————–
