Cyber Threats Put Thailand's 12.74 Trillion Baht Industrial Base Under Pressure

Thailand's digital economy faces a growing threat

Ten major Thai industries generated 12.74 trillion baht in economic value in 2024. Their dependence on digital payments, factory controls, communications and online services now makes cybersecurity a concern for production, employment and essential public services.

Assoc Prof Dr Aat Pisanwanich, a lecturer at Rangsit University's Faculty of Economics, places finance and banking, alongside energy and utilities, in the highest risk group. Manufacturing alone accounts for 3.86 trillion baht, or 20.3% of gross domestic product (GDP). Trade and electronic commerce contribute another 2.54 trillion baht, or 13.4%.

NETSCOUT's Thailand threat intelligence report records 10,258 distributed denial of service attacks, known as DDoS attacks, between January and June 2026. These attacks overwhelm an online service with traffic until legitimate users struggle to reach it. The average attack lasted 54.2 minutes, with telecommunications businesses receiving the greatest number.

Thailand's National Cyber Security Agency (NCSA) has also identified attacks involving artificial intelligence as a leading concern in its national risk assessment for 2026. Together, the findings describe a problem extending from fraudulent messages sent to individuals to disruptions affecting services used by many businesses at once.

Prime Minister Anutin Charnvirakul has instructed relevant agencies to prepare. Speaking at ICONSIAM in Bangkok on November 8, after opening the Amazing Thailand Grand Diwali Festival, he also said companies, shops and other private businesses needed their own protective measures and response procedures.

What the 10 industry risk groups show

Aat's analysis divides the industries into three groups according to their exposure and the consequences of disruption:

• Very high risk: finance and banking; energy and utilities.
• High risk: healthcare; telecommunications; manufacturing; transport and logistics; government.
• Moderate risk: trade and electronic commerce; tourism and hotels; media and entertainment.

Manufacturing and trade together contribute 6.40 trillion baht, or 33.7% of GDP, using the figures in the analysis. They represent about half of the combined value of the 10 industries. Disruption in these two sectors could therefore reach factories, suppliers, shops and workers across a substantial part of the economy.

The 12.74 trillion baht total measures the economic activity generated by the industries. Actual losses from an attack depend on which organisations are affected, how long their systems stop working, the severity of the damage and how quickly services return.

A factory unable to access production instructions may have to pause work. A logistics company with unavailable booking systems may delay deliveries. When the two businesses depend on each other, disruption can travel beyond the organisation first attacked.

Why attack counts need their own context

Aat cites NCSA and ThaiCERT statistics showing roughly 2,000 incidents in 2023 and more than 3,000 during January to September 2026. His analysis describes an average of about 12 incidents a day. A published summary also lists 363 incidents a day without explaining that second figure, leaving the calculation unclear.

NETSCOUT's 10,258 attacks concern a specific category, DDoS, observed through its ATLAS monitoring platform during the first six months of 2026. National incident statistics and a company's technical monitoring measure different sets of activity, so each figure needs its reporting period and definition alongside it.

CYFIRMA measures another part of the threat. Its executive threat landscape report, published on April 23, 2025, identified 17 campaigns targeting Thailand in 2024, a 240% increase from 2023. A campaign is a coordinated operation that may involve multiple attempts to compromise organisations.

The figures show why businesses need to track both repeated technical attacks and longer operations aimed at stealing information or gaining access. A service overwhelmed for an hour presents a different recovery task from an intruder quietly retaining access to sensitive systems.

Telecommunications sit at the centre of disruption

NETSCOUT recorded 5,440 attacks against its category called All Other Telecommunications and 2,102 against wireless telecommunications carriers. Those two categories together accounted for about 73.5% of the 10,258 attacks recorded in Thailand during the period.

Computing infrastructure, data processing, web hosting and related services received 896 attacks. Their average duration was 176 minutes, almost three hours and more than three times the average across all recorded attacks. Wired telecommunications carriers received another 514 attacks, averaging 79 minutes.

Telecommunications and hosting businesses provide connections and computing services that other organisations depend on. An outage at a shared provider can therefore affect customers across several industries, even when those customers are operating normally inside their own premises.

NETSCOUT observed as many as 14 attack methods within a single attack. TCP ACK, a method involving messages used in internet connections, appeared in 5,098 attacks. DNS amplification followed with 937, while TCP SYN appeared in 919. DNS amplification exploits internet address lookup services to direct larger volumes of traffic towards a target.

The variety matters for protection: a service may have to withstand several types of unwanted traffic at the same time. Capacity to absorb traffic, monitoring and arrangements with network providers all become part of keeping services available.

AI leads the national risk assessment

The NCSA's Thailand National Cyber Risk Assessment Report 2026 examines 20 risk scenarios over an outlook of two years. It draws on responses from 235 people at 134 organisations and analyses 1,156 risk entries selected by those respondents.

Attacks enabled by AI, including attacks on AI systems themselves, were selected by 160 respondents, or 68.1%. Ninety-four respondents, equivalent to 40% of everyone surveyed, ranked that scenario first. Among those selecting it, 70% assessed it as high risk.

AI can help attackers generate malicious software and produce convincing false messages, voices and images more quickly. For a business, this can mean a fraudulent payment request that sounds like a familiar manager or a deceptive message tailored to an employee's work.

The assessment classified 576 selected entries, or 49.8%, as high risk. That percentage describes the entries respondents chose for detailed assessment. Across the 20 scenarios, nine had average positions in the high risk category, 10 in the moderate category and one in the low category.

The agency recommends keeping an inventory of AI systems, assigning responsibility for them, limiting their access and requiring human supervision for actions with potentially serious consequences. Its assessment also retains familiar threats, including ransomware, phishing, stolen accounts and exploitation of software weaknesses.

Espionage and ransomware add different pressures

CYFIRMA attributed 55.56% of the attacks it analysed against Thailand to information theft and espionage. Financial gain and cybercrime together accounted for 40%. Financial services, information technology services and industrial conglomerates were among the most frequently targeted sectors.

The company assessed that more than 70% of the threat actors targeting Thailand originated from China and Russia. It identified MISSION2025, Lazarus Group and TA505 among the leading groups in its observations. These are CYFIRMA's assessments of the activity it tracked.

Thailand's role in regional finance, manufacturing and logistics creates several attractions for attackers: money, customer information, industrial knowledge and information about trade or government decisions. CYFIRMA also points to dependence on outside technology providers as a route through which attackers can reach other organisations.

Ransomware locks or otherwise denies access to systems and data, with criminals demanding payment. CYFIRMA recorded eight Thai victims by April 2025 and attributed 52.78% of the ransomware activity it observed in Thailand to LockBit3. RansomHub and Qilin were also active.

Across CYFIRMA's broader ransomware dataset, verified victims increased from 4,723 in 2023 to 5,123 in 2024, an increase of 8.5%. The company describes how criminal affiliates move between ransomware services after enforcement operations disrupt particular groups, allowing attacks to continue under different names.

How Thailand compares with its neighbours

Aat's analysis cites OECD figures for 2026 showing Thailand, Singapore and the Philippines each accounting for 10% of reported incidents in the East Asian and ASEAN countries studied. They shared the highest proportion among the ASEAN countries in that dataset.

China accounted for 22% and Japan for 21%, while South Korea also represented 10%. Malaysia's share was 6%, Indonesia's 4%, and Cambodia and Vietnam each accounted for 3%. The denominator is the combined East Asian and ASEAN group studied.

For the wider world, the analysis cites cumulative figures since 2014 of 51% for North America and 27% for Europe and Central Asia, a combined 78%. East Asia and ASEAN accounted for 5% in that regional breakdown.

Aat identifies five forces increasing exposure: expanding digital activity, geopolitical conflict, AI, online criminal networks and limited security resources. In Thailand and ASEAN, call centre fraud, investment scams, impersonation and messages designed to trick people into transferring money remain major immediate problems.

Several dates help explain the progression from international disruption to Thailand's current preparations:

• 2017: NotPetya affected Ukraine and several other countries, an incident included in Aat's analysis of international cyber threats.
• February 24, 2022: Russia launched its full scale invasion of Ukraine, a reference point in the analysis of cyber activity associated with geopolitical conflict.
• 2024: CYFIRMA observed 17 campaigns targeting Thailand.
• April 23, 2025: CYFIRMA published its Thailand threat assessment.
• January to June 2026: NETSCOUT recorded 10,258 DDoS attacks in Thailand.

A single failure can spread across industries

The NCSA assessment identifies attacks on operational technology and industrial control systems, labelled R13, and supply chain attacks, labelled R14, as particular concerns for disruption spreading between sectors. Operational technology controls physical processes, such as machinery or utility equipment. A supply chain attack reaches an organisation through a supplier, software product or service it uses.

The agency describes shared systems and providers as points where disruption can spread. Respondents identified essential government services, finance and banking, information technology and telecommunications, and the wider public as groups exposed to these connected effects.

Healthcare also stands out in the research cited by Aat. A 2024 study by Friederikos Fotis comparing 17 industries gave impact estimates of $10 million for healthcare, $5.97 million for finance and $5.01 million for pharmaceuticals. Government agencies, hotels and media appeared towards the lower end of that study's risk ranking, while Aat's Thailand assessment places government in its high risk group.

Aat's review of international research gives economic loss estimates ranging from 0.32% to 2.3% of GDP, with dollar estimates spanning $40 million to $111.14 billion across the research examined. For Thai organisations, the practical concern is how an interruption affects treatment, payments, production or deliveries, and how much work can continue while systems recover.

Seven priorities for businesses and government

Aat proposes seven areas of action, linking business recovery with protection of essential services and support for smaller firms:

• Back up data regularly and prepare plans to restore systems after ransomware attacks.
• Strengthen DDoS protection for banks, payment services, government websites and widely used digital services.
• Protect critical infrastructure, including electricity, water, aviation, hospitals, food factories and logistics.
• Help small and medium sized enterprises obtain security services through subsidies, tax benefits or affordable shared services.
• Increase budgets, specialist staffing and checks for security weaknesses.
• Exchange threat information with ASEAN partners and other countries.
• Coordinate government and private sector preparations for hybrid warfare, which combines cyberattacks, sabotage and manipulation of information.

Smaller businesses face particular pressure because they may lack both specialist staff and the money to buy protective systems. Access to affordable security and recovery services would give them practical support for the same digital tools they use to take payments, manage orders and serve customers.

The NCSA turns these priorities into specific organisational tasks: keep backups separate from primary systems, test restoration, divide networks to limit an intruder's movement and map dependence on outside providers. It also recommends multifactor authentication, which requires another check beyond a password, and access controls that verify users and devices rather than automatically trusting them.

The agency also identifies preparation for quantum computing threats. Organisations are advised to inventory their encryption systems and information that must remain confidential for many years, then plan for post quantum cryptography, encryption designed to resist future quantum attacks. For today's operations, tested recovery plans and knowledge of shared dependencies remain central to reducing disruption.

Key Points

• Ten Thai industries identified as exposed to cyber threats generated 12.74 trillion baht in value in 2024.
• Manufacturing and trade together accounted for 33.7% of GDP in the analysis.
• NETSCOUT recorded 10,258 DDoS attacks in Thailand during January to June 2026, averaging 54.2 minutes.
• AI attacks were selected as a concern by 68.1% of respondents in the NCSA national assessment.
• Shared telecommunications, computing and industrial systems can carry disruption across several sectors.
• Proposed responses include tested backups, stronger service protection, support for smaller firms and international threat information sharing.