Threat Intelligence focusing on Malaysia 🇲🇾

Threat intelligence focusing on Malaysia 🇲🇾 — bridging global reporting with local reality. Compiled, tagged, and analyzed for Malaysian defenders, from SOC analysts to CISOs.

Key facts (as of 8 October 2026): Rectifyq has recorded 142 alleged ransomware claims against Malaysian organisations since 2018 (50 in 2026, the highest year on record); manufacturing is the most-claimed sector; Qilin, LockBit 3.0 and The Gentlemen are the most active groups. Quick answers: Malaysia Cyber Threats: Key Facts & FAQ.

Baru di sini? New here?

Head to Start Here — a 2-minute guide that routes you to the right section based on your role. Prefer raw data? Jump straight to Feeds & MISP.

200+ Threat entries
MISP-linked, MY-triaged

50+ Threat actors
tracked with MY relevance

140+ Ransomware claims
vs. MY orgs since 2018

What Rectifyq tracks

🎯 Intelligence products

⚔ Threat Watch MISP-linked threat entries triaged for MY relevance 🎭 Threat Actors 50+ groups tracked with Malaysian relevance 🩹 Vulnerability Watch CVEs with confirmed MY exposure 🕵️ Breach Watch Ransomware claims & data leaks, victims masked 📡 Rectifyq Radar The monthly MY threat recap

🤝 Community

📅 Events Every MY cyber event, one calendar 💬 Tanya Rectifyq Ask anything about CTI 🎣 PhishHuntMY Phishing hunt challenge 🤝 Contribute Strengthen the ecosystem

Everything published maps to our open Intelligence Requirements (PIR) — so you always know why an entry exists and who it serves.

The Malaysian landscape at a glance

Ransomware extortion claims vs MY organizations — top groups (2018–present)

pie showData 
    "Qilin" : 23
    "LockBit3" : 21
    "The Gentlemen" : 11
    "Direwolf" : 8
    "RansomHub" : 7
    "Akira" : 5
    "Other groups / unattributed" : 67

142 alleged claims as of 8 October 2026. Source: Malaysia Ransomware Tracker.

Claims, not confirmations

Figures are based on ransomware group claims or news reporting. Unless the organization confirmed the incident, it remains a claim. Victims are never named on this site.

Most-claimed sectors: Manufacturing · Engineering · Government · Logistics — full breakdown in the Ransomware Tracker.

Top techniques observed in MY-relevant intrusions (MISP-MY): T1027 Obfuscated Files · T1566 Phishing · T1055 Process Injection · T1059.001 PowerShell · T1190 Exploit Public-Facing App — full heatmap in TTPs.

This week in MY cyber 📅

CTF this weekend? Meetup after work? The community calendar has it — physical and online, reviewed before publishing.

Subscribe once, never miss an event

Add the Malaysia Cybersecurity Events Calendar to Google or Apple Calendar and every vetted MY cyber event lands in your schedule automatically. Organizing something? Submit it — jom turun padang.

How the ecosystem connects

flowchart LR
    RQ(("Rectifyq 🇲🇾"))

    subgraph Intelligence
        TW["Threat Watch"]
        TA["Actor Profiles"]
        VW["Vulnerability Watch"]
        BW["Breach Watch"]
    end

    subgraph Data["Machine-readable"]
        MISP["MISP-MY"]
        FEEDS["IoC CSV / Feeds"]
    end

    subgraph You["Your stack"]
        SIEM["SIEM / TIP"]
        BRIEF["Board briefings"]
    end

    RQ --> Intelligence
    RQ --> Data
    TW --> MISP
    MISP --> FEEDS
    FEEDS --> SIEM
    BW --> BRIEF
    VW --> SIEM

    click TW "/my-threat-landscape/threats/" _self
    click TA "/my-threat-landscape/threat-actor" _self
    click VW "/my-threat-landscape/vulnerabilities/" _self
    click BW "/my-threat-landscape/breaches/" _self
    click FEEDS "/resources/feeds" _self