Thailand braces for high-impact threats

The National Cyber Security Agency (NCSA) remains on alert for major cyber-attacks in Thailand and is coordinating with the National Security Council (NSC) to share threat intelligence and risk assessments, while urging critical infrastructure operators to address vulnerabilities and strengthen access controls.

The NSC is scheduled to convene a meeting on Wednesday with relevant parties to prepare for threats in five areas: cybersecurity, emerging and re-emerging infectious diseases, terrorism, energy crises and food crises.

The council emphasised that preparedness is part of strategic planning to limit potential damage.

According to AFP, a suspected cyber-attack hit grocery stores across at least nine European countries on Monday, prompting the EU to warn of a deliberate attempt to disrupt the bloc's food supply chain.

According to Reuters, Malaysia's key institutions were scheduled to hold a series of meetings on Tuesday to prepare for cyber and geopolitical threats.

Maj Gen Teerawut Wittayakorn, deputy and acting secretary-general of NCSA, said Thailand faces persistent cyberthreats, although the likelihood of a full-scale, state-sponsored cyber-attack intended to trigger military conflict involving the country remains relatively low.

"However, Thailand must still prepare for severe disruptions, particularly those affecting telecoms, energy and essential government systems," he said.

The agency evaluates threats based on both their probability and potential impact, with contingency plans needed even for scenarios considered unlikely.

Maj Gen Teerawut differentiated state-sponsored cyber operations from financially motivated cybercrime, noting that the objectives shape the nature of an attack and the response required.

Cyber warfare typically involves sophisticated operations designed to create confusion, disrupt services or undermine operational stability, potentially ahead of military action.

He cited Russia's cyber-attacks against Ukraine before its ground invasion as an example of cyber operations supporting military objectives.

Maj Gen Teerawut also pointed to attacks on cold-storage facilities in France, the US and Sweden, describing them as examples of operations intended to cause disruption rather than directly steal money.

He contrasted these with an attack on cryptocurrency exchange Binance, which he described as financially motivated cybercrime carried out by organised groups.

Maj Gen Teerawut said NCSA contributes cyberthreat intelligence, technical information and assessments of the likelihood of attacks to the broader national security assessment led by the NSC.

The council considers this information alongside risks in other areas to determine whether national alert levels should be raised.

For NCSA, the immediate priority is to reduce opportunities for attackers to gain access to essential systems by addressing known vulnerabilities and strengthening access controls. This approach provides protection against a broad range of threats without requiring agencies to anticipate every possible attack method, he noted.

The agency's response to serious vulnerabilities in PHP, which is widely used in Thailand's web applications and legacy systems, includes the use of multi-factor authentication (MFA) for logins to reduce credential leaks.

PHP VULNERABILITIES

NCSA issued urgent alerts about PHP, the programming language that powers a large share of the world's websites, to relevant organisations from Oct 21, setting a deadline for them to report their progress in addressing the vulnerabilities, said Maj Gen Teerawut.

One challenge is the continued use of legacy systems that have reached the end of vendor support and no longer receive security patches, he said.

For affected PHP systems, the agency has developed temporary configuration measures intended to block exploitation while preserving essential functions. NCSA also provides step-by-step technical assistance to organisations lacking specialist personnel.

The agency is also urging critical infrastructure operators and sectoral computer emergency response teams to implement MFA to reduce the risk of unauthorised access.

Potential damage to undersea communications cables illustrates why Thailand must prepare for threats with a low probability but potentially severe consequences, Maj Gen Teerawut said.

Cable cuts could reduce internet speeds and force operators to redirect substantial amounts of traffic through alternative international routes. Although redundant connections provide resilience, repairing damaged cables or laying new ones takes considerable time.

Such scenarios require contingency arrangements and coordination without causing unnecessary public alarm, he said.

In the energy sector, NCSA works with sectoral response teams and operators, including power plants, to monitor suspicious reconnaissance activities and attempted intrusions.

The agency also conducts annual national cyber-exercises to test the preparedness of critical infrastructure organisations.