An intensifying cyber threat landscape

State-sponsored groups and cybercriminals launched increasingly sophisticated campaigns, while large-scale disruptions such as subsea cable cuts underscored the fragility of global connectivity. Key developments included the following:

• Ransomware: Singapore recorded 159 ransomware cases in 2024, a 21% increase from 2023. Manufacturing, professional services and ICT were the most affected sectors.
• Phishing: Phishing attacks surged by 49%, with 6,100 cases reported in 2024 (up from 4,100 in 2023) and banking and financial services remaining the most spoofed industry (56% of all cases). Local banks were heavily spoofed, alongside government agencies like the Inland Revenue Authority of Singapore and Ministry of Finance.
• Infected infrastructure: The number of infected infrastructure increased by 67%, with approximately 117,300 systems compromised (up from 70,200 in 2023), primarily due to increased botnet drone activity.
• Distributed denial-of-service (DDoS) attacks: Global DDoS activity spiked by 53% in 2024. Singapore was ranked the seventh most attacked country in Q4, reflecting its role as a major digital hub with dense data center infrastructure.
• Emerging risks: Threat actors experimented with AI-powered malware and deepfake-enabled cams, while vulnerabilities in IoT devices and supply chains widened the attack surface.

Sophisticated attack methods

Threat actors increasingly undertake sophisticated attack methods to target critical infrastructure:

• 69% of phishing websites were served via the HTTPS protocol to appear more legitimate.
• 12% of reported phishing emails contained AI-generated content, which suggests continued nascent adversarial exploitation of AI to facilitate phishing.
• State-sponsored groups launched increasingly sophisticated campaigns targeting critical infrastructure.
• Threat actors experimented with AI-powered malware and deepfake-enabled scams.

Supply chain and infrastructure vulnerabilities

2024 also saw increased vulnerabilities in supply chains and infrastructure across the globe:

• Large-scale disruptions such as submarine cable cuts underscored the fragility of global connectivity.
• The CrowdStrike outage in July 2024 demonstrated how software updates can trigger cascading failures across critical systems.
• Vulnerabilities in IoT devices and supply chains created a widened attack surface for cybercriminals.

Growing cybercrime and scams

Cybercrime cases in Singapore rose by 10.8% in 2024, with over 55,800 incidents reported. Scams leveraging messaging apps, social media and spoofed government portals remain a persistent challenge, with criminals increasingly using AI to enhance their deception techniques.

Strengthening defenses

The Report reiterates that cybersecurity remains a shared responsibility. The CSA expanded initiatives such as Cyber Essentials and TrustMark certifications for small and medium enterprises, international partnerships against ransomware, and capacity-building for students, seniors and professionals.

Singapore's position as a trusted global digital hub depends on continued vigilance, resilience and collaboration across government, industry and the public to safeguard against this evolving cyber threat landscape.

Key takeaways

As digital adoption accelerates, the risks posed by AI, IoT and geopolitical cyber activity will continue to grow. The Report stresses the need for vigilance, resilience and collaboration across government, industry and the public to safeguard Singapore's position as a trusted global digital hub.

Organizations should prioritize the following:

• Regular security assessments and vulnerability management to address the months-old or years-old vulnerabilities that are still being exploited
• Employee training and awareness programs to combat increasingly sophisticated phishing and social engineering attacks
• Incident response planning and business continuity measures to minimize the impact of ransomware and other disruptive attacks
• Supply chain security measures, including vendor risk assessments and third-party security requirements
• Implementation of multi-factor authentication and zero-trust security frameworks

If you require assistance with navigating any cyber-related challenges, including understanding cybersecurity regulations, being prepared for incident response, enhancing cross-border data governance, and identifying risk management strategies, please feel free to reach out to your Baker McKenzie contact.

* * * * *

© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.