Rectifyq

Threat Actors Targeting Malaysia

Properties2
descriptionWhich APT and threat groups target Malaysia: Rectifyq's tracker of 50+ actors with Malaysian relevance, clustered by suspected origin. China-nexus groups such as APT41, APT40 and Naikon appear most often, alongside Iranian, North Korean and Russian actors.
aliasesThreat Actor Tracker

6 min read

At a glance (as of 8 October 2026)

  • China-nexus espionage groups dominate Rectifyq’s Malaysia-relevant reporting. APT41, APT40 and Naikon appear in the most entries; other active China-nexus groups include Earth Estries, SharpPanda and Mustang Panda.
  • Iranian actors (MuddyWater, OilRig, APT35, APT42, CyberAv3ngers) rose in relevance with the 2026 Iran–US/Israel conflict; see the impact analysis for Malaysian organisations.
  • Other clusters: North Korea (Lazarus Group), Russia (APT28, APT29), India-nexus groups, and regional hacktivists (e.g. INDOHAXSEC).
  • Ransomware groups are tracked separately in the Malaysia Ransomware Tracker; Qilin, LockBit 3.0 and The Gentlemen lead the claim count.

Disclaimer: The Attribution Nuance

Actor clustering and naming are interpretations by specific researchers or vendors. For most organizations, prioritizing generic detection of TTPs (Tactics, Techniques, and Procedures) offers higher defensive value than definitive attribution. Formal attribution is primarily the domain of Law Enforcement and Government entities with the authority to pursue legal or physical recourse.

TL;DR: Attribution is subjective. Focus on detecting TTPs to protect your network; leave identifying the “who” to Law Enforcement.

flowchart LR
    M["🇲🇾 Malaysia"] --o C["🇨🇳 China"]
    M --o I["🇮🇱 Israel"]
    M --o U["🇺🇸 USA"]
    M --o N["🇰🇵 North Korea"]
    M --o R["🇷🇺 Russia"]
    M --o I1["🇮🇩 Indonesia"]
    M --o I2["🇮🇳 India"]
    M --o I3["🇮🇷 Iran"]
    M --o K["🇰🇷 South Korea"]
    M --o U1["Uncategorized"]

    R --> A1[APT28]
    R --> A2[APT29]
    I2 --> A3[RAZOR-TIGER]
    I2 --> A4[QUILTED-TIGER]
    I2 --> A5[HAZY-TIGER]
    I3 --> A6[Fox-Kitten]
    C --> A7[UNC3886]
    C --> A8[APT15]
    C --> A9[APT23]
    C --> A10[APT30]
    C --> A11[APT40]
    C --> A12[APT41]
    C --> A13[Earth-Estries]
    C --> A14[Earth-Lusca]
    C --> A15[RedJuliett]
    C --> A16[RedDelta]
    C --> A17[HAFNIUM]
    C --> A18[GALLIUM]
    C --> A19[Platinum]
    C --> A20[Hellsing]
    C --> A21[Naikon]
    C --> A22[LOTUS-PANDA]
    C --> A23[GOBLIN-PANDA]
    C --> A24[Evasive-Panda]
    C --> A25[Aoqin-Dragon]
    C --> A26[TA428]
    C --> A27[Worok]
    C --> A28[Earth-Longzhi]
    U1 --> A29[SOLAR-SPIDER]
    U1 --> A30[ToddyCat]
    U1 --> A31[LabHost]
    U1 --> A32[ScamClub]
    U1 --> A33[El-Machete]
    U1 --> A34[Orangeworm]
    U1 --> A35[Cobalt]
    U1 --> A36[Thrip]
    U1 --> A37[Roaming-Mantis]
    N --> A38[Lazarus-Group]
    K --> A39[DarkHotel]
    U --> A40[Equation-Group]
    I1 --> A41[INDOHAXSEC-TEAM]

    click A1 "/tags/apt28" _blank
    click A2 "/tags/apt29" _blank
    click A3 "/tags/razor-tiger" _blank
    click A4 "/tags/quilted-tiger" _blank
    click A5 "/tags/hazy-tiger" _blank
    click A6 "/tags/fox-kitten" _blank
    click A7 "/tags/unc3886" _blank
    click A8 "/tags/apt15" _blank
    click A9 "/tags/apt23" _blank
    click A10 "/tags/apt30" _blank
    click A11 "/tags/apt40" _blank
    click A12 "/tags/apt41" _blank
    click A13 "/tags/earth-estries" _blank
    click A14 "/tags/earth-lusca" _blank
    click A15 "/tags/redjuliett" _blank
    click A16 "/tags/reddelta" _blank
    click A17 "/tags/hafnium" _blank
    click A18 "/tags/gallium" _blank
    click A19 "/tags/platinum" _blank
    click A20 "/tags/hellsing" _blank
    click A21 "/tags/naikon" _blank
    click A22 "/tags/lotus-panda" _blank
    click A23 "/tags/goblin-panda" _blank
    click A24 "/tags/evasive-panda" _blank
    click A25 "/tags/aoqin-dragon" _blank
    click A26 "/tags/ta428" _blank
    click A27 "/tags/worok" _blank
    click A28 "/tags/earth-longzhi" _blank
    click A29 "/tags/solar-spider" _blank
    click A30 "/tags/toddycat" _blank
    click A31 "/tags/labhost" _blank
    click A32 "/tags/scamclub" _blank
    click A33 "/tags/el-machete" _blank
    click A34 "/tags/orangeworm" _blank
    click A35 "/tags/cobalt" _blank
    click A36 "/tags/thrip" _blank
    click A37 "/tags/roaming-mantis" _blank
    click A38 "/tags/lazarus-group" _blank
    click A39 "/tags/darkhotel" _blank
    click A40 "/tags/equation-group" _blank
    click A41 "/tags/indohaxsec-team" _blank

Threat actors linked to Malaysia in Threat Watch

51 actors across Threat Watch entries whose targets include Malaysia. Generated 2026-10-08.

Threat actorSuspected origin (as reported)EntriesMost recent entry
APT41China62026-03-03: Silver Dragon Targets Organizations in Southeast Asia and Europe
APT40China52022-08-30: Rising Tide Chasing the Currents of Espionage in the South China Sea
NaikonChina42022-04-29: The Lotus Panda is Awake Again Analysis of the Last Strike
APT28Russia32024-06-26: APT PROFILE – FANCY BEAR
SharpPandaChina22026-06-25: SharpPanda Strike Again
MuddyWaterIran22026-03-18: Israel Conflict, how is it impacted Malaysia Organisation?
Fox KittenIran22026-03-18: Israel Conflict, how is it impacted Malaysia Organisation?
Earth EstriesChina22024-11-25: Game of Emperor Unveiling Long Term Earth Estries Cyber Intrusions
Lazarus GroupNorth Korea22020-08-26: FASTCash 2.0 North Korea’s BeagleBoyz Robbing Banks
APT30China22020-06-19: The eagle eye is back old and new backdoors from APT30
PLATINUMChina22019-11-08: Titanium the Platinum group strikes again
APT35Iran12026-03-18: Israel Conflict, how is it impacted Malaysia Organisation?
APT42Iran12026-03-18: Israel Conflict, how is it impacted Malaysia Organisation?
Cyber Av3ngersIran12026-03-18: Israel Conflict, how is it impacted Malaysia Organisation?
OilRigIran12026-03-18: Israel Conflict, how is it impacted Malaysia Organisation?
MUSTANG PANDAChina12026-01-27: HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns
Earth Kurma—12025-04-25: Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors
Earth AluxChina12025-03-31: The Espionage Toolkit A Closer Look at its Advanced Techniques
INDOHAXSEC TEAMIndonesia12025-03-13: INDOHAXSEC – Emerging Indonesian Hacking Collective
RedDeltaChina12025-01-09: RedDelta Chinese State-Sponsored Group Targets Mongolia, Taiwan, and Southeast A
RAZOR TIGERIndia12024-10-15: SideWinder APT’s post-exploitation framework analysis
APT23China12024-09-05: Tropic Trooper spies on government entities in the Middle East
Storm 2077China12024-07-16: TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromis
RedJuliettChina12024-06-24: Chinese State-Sponsored RedJuliett Intensifies Taiwanese Cyber Espionage via Net
APT27China12024-06-11: Noodle RAT Reviewing the Backdoor Used by Chinese-Speaking Groups
Calypso—12024-06-11: Noodle RAT Reviewing the Backdoor Used by Chinese-Speaking Groups
Unfading Sea HazeChina12024-05-22: Deep Dive Into Unfading Sea Haze A New Threat Actor in the South China Sea
LabHost—12024-04-18: The Fall of LabHost Law Enforcement Shuts Down Phishing Service Provider
SOLAR SPIDER—12024-04-03: The New Version of JsOutProx is Attacking Financial Institutions in APAC and MEN
ScamClub—12024-03-13: Decoding ScamClub’s Malicious VAST Attack
QUILTED TIGERIndia12024-02-01: VajraSpy A Patchwork of espionage apps
Evasive PandaChina12023-04-26: Evasive Panda APT group delivers malware via updates for popular Chinese softwar
Roaming Mantis—12023-01-19: Roaming Mantis implements new DNS changer in its malicious mobile app in 2022
Earth LongzhiChina12022-11-09: Hack the Real Box APT41’s New Subgroup Earth Longzhi
HAZY TIGERIndia12022-08-09: Meta’s Quarterly Adversarial Threat Report
Operation C Major—12022-08-09: Meta’s Quarterly Adversarial Threat Report
HAFNIUMChina12022-06-27: Attacks on industrial control systems using ShadowPad
ToddyCat—12022-06-21: ToddyCat Unveiling an unknown APT actor attacking high-profile entities in Europ
GALLIUMChina12022-06-13: GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sect
GhostEmperorChina12021-09-30: GhostEmperor From ProxyLogon to kernel mode
APT15China12020-07-01: Mobile APT Surveillance Campaigns Targeting Uyghurs
APT29Russia12020-06-05: CrowdStrike’s work with the Democratic National Committee Setting the record str
Thrip—12019-09-09: Thrip Ambitious Attacks Against High Level Targets Continue
GOBLIN PANDAChina12018-11-01: CTA Adversary Playbook Goblin Panda
Cobalt—12018-05-01: Cobalt Their Evolution And Joint Operations
Orangeworm—12018-04-23: New Orangeworm attack group targets the healthcare sector in the U.S., Europe, a
Sowbug—12017-11-07: Sowbug Cyber espionage group targets South American and Southeast Asian governme
LOTUS PANDAChina12017-07-24: Spring Dragon – Updated Activity
HellsingChina12015-04-15: The Chronicles of the Hellsing APT the Empire Strikes Back
Equation GroupUSA12015-02-16: Equation The Death Star of Malware Galaxy
El Machete—12014-08-20: “El Machete”

🔴 Latest Relevant 🇲🇾 Threat Articles

Graph View

Backlinks