A new shape of cyber risk in Malaysia

Top cyber threats in Malaysia

From reported public cases to pre- and post-incident response activities that we have helped clients with, we observe that attackers mainly target key infrastructure and organisations with poor cyber hygiene.

Poor cyber hygiene practices that attackers target—all of which provide the initial foothold​

Mirroring global trends, recent attack patterns in Malaysia reveal that attackers are choosing to log in rather than breach in. Exploits focus on traditional, perimeter-protected trust boundaries such as external connections, third-party components, compromised identities, and other trusted network relationship, pointing to a rise in identity-based attacks.​

Ransomware remains one of the most significant manifestations of this trend, both globally and in Malaysia. PwC's Annual Threat Dynamics 2026 noted that in the last year alone,

This is not theoretical for Malaysia. On 1 March 2026, a major Malaysian organisation fell victim to the ransomware group Qilin, which not only breached systems but also threatened to release sensitive data unless negotiations ensued.​

The threat extends beyond traditional ransomware. AI-powered scams leveraging deepfake and voice-cloning technology are escalating rapidly in Malaysia, with over 67,000 online crime cases and losses exceeding RM2.7 billion were recorded between January and November 2025 alone. ​

Voice cloning, facial re-enactment, and AI-generated identities have become standard tools in the scammer's kit, used to fabricate urgency and bypass verification systems that were never designed with synthetic media in mind. As organisations invest in securing their perimeters, adversaries are increasingly exploiting trust itself, whether through a cloned voice on a WhatsApp call or a fabricated video of a national leader endorsing a fraudulent scheme. ​

The elephant in the room—legacy and trust​

We often talk about progressive investments and adoption of best practices aligned with regulatory compliance. However, how often is implementation being done through the lens of doing it right up front, instead of “I just want to tick the box and move on”? ​

What compounds this challenge is architectural debt. Dependencies on legacy architecture, software, and third parties create single points of failure that adversaries can exploit, especially where implicit trust remains in play. ​

As organisations modernise their environments and adopt secure-by-design principles, many have accelerated their adoption of cloud and Software as a Service (SaaS) platforms, as well as cloud service providers' native AI services. Yet while organisations invest in securing their own environments, the ecosystems they depend on can be equally vulnerable. Third-party software, open-source libraries, cloud APIs, and managed services all form part of a complex digital supply chain. ​

A regulatory perspective on the next frontier​

There has been a clear push towards visibility and observability across Malaysia's cyber landscape, especially as organisations prepare for thenext frontier: post-quantum cryptography (PQC) risks. National CyberSecurity Agency’s (NASCA) Chief Executive Order No. 9, together with mandatory codes of practice for NCIIs, requires all NCII entities to inventory their cryptographic assets and plan for post-quantum cryptography migration. As foundational steps, NCIIs are explicitly required to prepare both a Software Bill of Materials (SBOM) and a Cryptographic Bill of Materials (CBOM).  ​

This posture is echoed across regulated industries: Bank Negara Malaysia (BNM)'s updated Risk Management in Technology (RMiT) policy not only elevates authentication, device binding, and fraud prevention controls from guidance to mandatory standards, but also strengthens requirements around cryptographic key management andalgorithm governance to address IT asset and crypto asset risk. Non-compliance with these requirements may lead to supervisory and enforcement actions. For example, a fine of RM1 million was recently imposed by BNM to a local bank due to inadequate cybersecurity controls and weak incident response following a prior breach. The Malaysian Communications and Multimedia Commission’s (MCMC) telecommunications security standards reinforce similar expectations for the communications sector.

The threat landscape, regulatory trajectory, and technology shifts outlined above are not abstract. They carry direct implications for how Malaysian businesses must operate, invest, and build resilience going forward. Organisations can no longer treat cybersecurity as a perimeter problem or a compliance exercise. The convergence of identity-based attacks, AI-powered fraud, quantum threats, and deepening supply chain dependencies demands a fundamental shift in posture—from reactive to deliberate, and from implicit trust to continuous verification. Three priorities stand out. ​

Zero Trust as the practical defence​

The volatile nature of today's cyber landscape requires organisations to adopt and consistently implement Zero Trust principles, "never trust, always verify," not as a one-time fix, but as an ongoing journey focused on continuous authentication and authorisation to minimise implicit trust and strengthen overall security.

What this looks like in practice depends on where an organisation sits in its modernisation journey.​

Businesses should prepare for quantum-related cyber threats ​

The Zero Trust principle of continuous verification is built on several foundations, but one cuts across all of them: the integrity of cryptography. If the encryption underpinning authentication, secure communications, and data protection can be broken, the entire trust model collapses.

The quantum threat makes this a practical concern, not a theoretical one. "Harvest now, decrypt later" and "trust now, forge later" strategies mean that encrypted data, communications, and digital signatures secured today could be retroactively compromised or forged once quantum capabilities mature. For organisations managing long-lived sensitive information, the exposure window is not years away. It is open now. ​

Preparing for this shift centres on post-quantum cryptography such as encryption algorithms designed to withstand quantum attacks. But migration is not a simple swap. What it demands depends on where an organisation sits.

Know your supply chain beyond the first tier ​

Every external dependency an organisation relies on falls under the scope of third-party and supply chain risk. This includes cloud service providers, managed security service providers, SaaS vendors, open-source library maintainers, and any subcontractors within their ecosystem.​

In Malaysia, regulatory attention on this front is increasing. While frameworks remain sector-specific rather than consolidated under a single regime, the direction is consistent: regulated entities are expected to set baselines, monitor continuously, and take accountability for any dependencies.

However, the practical challenge lies in what happens beyond the first tier. Current regulations place the onus on the regulated entity to manage its supply chain, but do not directly regulate fourth-party or nth-party providers.

This creates a gap: if an nth-party is breached, who is obligated to report, and how quickly does that information reach the organisation or the regulator? Without proactive incident notification obligations flowing downstream through the supply chain, organisations risk being the last to know about a compromise that directly affects them. 

From a regulator's lens, the expectation is clear: accountability rests with the regulated entity, regardless of how many layers deep the dependency runs.

The regulatory direction across sectors points the same way: know your dependencies, set the baseline, and ensure you are not reliant on trust alone to learn when something goes wrong. ​

The content and author information presented are accurate as of the time of publication.