Akamai SOTI report flags quadruple extortion ransomware surge in APAC

While double extortion remains widespread, Akamai warns that ransomware actors are escalating attacks through a quadruple extortion model, adding DDoS disruptions and third-party coercion to intensify pressure on victims and force ransom payments

Ransomware attacks in the Asia-Pacific (APAC) region are becoming increasingly sophisticated, with cybercriminals adopting a new "quadruple extortion" tactic, according to Akamai Technologies' latest State of the Internet report. The 2025 edition, titled Ransomware Report: Building Resilience Amid a Volatile Threat Landscape, highlights the evolution of attack strategies and the urgent need for businesses to bolster cyber resilience.

While double extortion—encrypting data and threatening to leak it—is still the most prevalent approach, Akamai warns that threat actors are now layering additional pressures. The emerging quadruple extortion model incorporates Distributed Denial of Service (DDoS) attacks and coercion of third parties such as customers, partners, or media to amplify the pressure on victims.

“Today’s ransomware tactics go far beyond just data encryption,” said Steve Winterfeld, Advisory CISO at Akamai. “They’re designed to create full-scale business crises by weaponizing public exposure, operational outages, and regulatory risks.”

Critical sectors face escalating threats

Healthcare and legal sectors remain prime targets in APAC. Groups like LockBit, BlackCat/ALPHV, CL0P, and newer players such as Abyss Locker and Akira have executed high-impact breaches. Recent incidents include the theft of 1.5TB of sensitive data from Australia’s Nursing Home Foundation by Abyss Locker, and a US$1.9 million ransom payment made by a Singapore law firm after an Akira attack.

Smaller organisations are increasingly vulnerable, with hybrid ransomware gangs using ransomware-as-a-service (RaaS) platforms to strike educational institutions and medical practices. Clinics in Australia have already reported breaches by groups like RansomHub and Anubis.

Akamai also flags the region’s fragmented regulatory environment as a growing risk. With varying enforcement and penalties across countries like Singapore, India, and Japan, multinational organisations face compliance uncertainty that ransomware groups exploit through regulation-based extortion.

To counter these threats, Akamai advocates the adoption of Zero Trust security architectures and software-defined microsegmentation. Reuben Koh, Director of Security Technology and Strategy for APJ at Akamai, emphasized the need for verified access controls and proactive resilience strategies.

“As APAC’s digital economy grows rapidly, so does its attack surface,” said Koh. “Organisations must reassess their security frameworks and prioritise Zero Trust models, recovery drills, and response simulations to defend against today’s complex ransomware landscape.”