Malaysia's Kuala Lumpur International Airport (KLIA) suffered hours of disruption on March 23, 2025 after a ransomware intrusion crippled flight information displays, check-in counters, and other passenger-facing systems. The operator, Malaysia Airports Holdings Berhad (MAHB), acknowledged a cyberattack while insisting operations were unaffected; two days later Prime Minister Anwar Ibrahim told the country the disruption was "quite heavy" and that a US$10 million ransom demand had been rejected outright. Dark Reading's retrospective this week revived the incident as a warning for transport operators across Asia, and it has become a case study in how slowly regulated transport operators adapt to fast-moving criminal threats.
What happened at KLIA
Travelers began reporting problems on March 23, 2025 with flight information display systems, check-in counters, and other services across the airport. MAHB initially confirmed a cyberattack "affecting certain computer systems," but the company maintained that operations had not been affected. Photographs circulated on social media — including one posted by Wee Choo Keong via X.com — showing what appeared to be a whiteboard being used to track flights manually during the outage.
The gap between MAHB's public framing and the on-the-ground reality became clearer on March 25, when the Prime Minister addressed the incident during a speech marking the nation's 218th Police Day. He described the disruption as "quite heavy" and confirmed that a US$10 million ransom had been demanded. According to his account, the government did not pay.
MAHB, which operates 39 airports across Malaysia, said it continues to investigate and has made the matter "the highest priority at this time."
"When we first became aware of suspicious activity involving our network, MAHB immediately enacted our incident management protocols and launched an internal investigation with the assistance of external cybersecurity experts," a company spokesperson said. "Passenger safety is our first priority, and flights continue to arrive and depart from the airport as normal."
The article carrying that statement was updated on April 2, 2025 at 1:04pm EDT to include it.
A refusal, in the Prime Minister's words
Ibrahim framed the decision not to pay as a matter of national principle rather than arithmetic. "I didn't wait five seconds and immediately answered, 'No!'" he told the audience, speaking in Malay. "There is no way this country will be safe if its leadership and system allow us to submit to the ultimatum of criminals and traitors at home or abroad."
He added that the country needs to properly fund its police and financial system and raise the technical sophistication of the population. He did not say whether MAHB itself had paid anything to recover its systems — a distinction worth noting, since the Prime Minister's remarks address the government's position, not necessarily the operator's.
Why transport operators lag behind
Aaron Bugal, field CISO for Asia Pacific and Japan at Sophos, argues the root problem is structural. Critical infrastructure such as airports, he says, is governed by long-tail regulation and oversight bodies that have not responded well to the rapid changes required to stay ahead of criminals.
"With this public knowledge and the sometimes glacial pace [at which] critical infrastructure organizations adapt to cyber requirements, [they are] an attractive target given their high impact if an attack is successful," Bugal says.
He expects the KLIA recovery and investigation to run for weeks or possibly months. The core concern, in his view, is not the specific malware family but the reach of the intrusion: a successful attack or network outage was able to degrade systems KLIA relied on for both flights and ground logistics, which handed a criminal the leverage to demand payment.
"The primary concern is that a successful cyberattack [or] network outage was able to impact the operation of critical systems that the KLIA airport relied upon for both flights and ground logistics," Bugal says. "Regardless of the type of attack unfurled on the systems in question, it has given leverage to a cybercriminal in demanding a monetary payment, a ransom, as a way to halt any further damage."
Regional context
KLIA is not an isolated case in Southeast Asia. In June, a ransomware group known as Brain Cipher hit more than 160 government agencies in Indonesia, causing disruption severe enough that the group ultimately handed over its decryption software to the country at no cost.
Around the same period, Malaysian police arrested two men who allegedly worked with accomplices in Hong Kong and Taiwan on an information-stealing campaign that targeted Singaporeans using Android malware.
National governments in the region have begun putting more money into cybersecurity and revising regulations in response to the rise in cybercrime.
The broader critical-infrastructure picture
Sophos' State of Ransomware in Critical Infrastructure 2024 report, cited in the coverage, quantifies the exposure:
- Two-thirds of critical infrastructure operators — a category that specifically includes energy firms, oil and gas providers, and utilities — reported a ransomware incident.
- Nearly half of all compromises resulted from threat actors exploiting a vulnerability.
- 80% of critical infrastructure operators experienced an incident in which data was encrypted, the third-highest rate among sectors surveyed. Only state and local government (98%) and lower education (85%) had higher encryption rates.
Bugal's advice is to widen the lens beyond the ransomware payload itself. Organizations need to understand how attackers gain entry and move laterally, and whether those movements can be detected at all.
"Although ransomware will continue to be used as a tool in the cyberattacker arsenal, one must not get caught hyper-focusing on ransomware alone," he says. "These are the 'left-of-breach' signposts that are typical [signs of] cyberattacker motives — with ransomware [being] the mic-drop moment for the attacker to ensure you know they've already had their way with your environment and data."
Technical background
The source reporting for this incident does not disclose the intrusion vector, the ransomware family, file hashes, command-and-control infrastructure, or any indicator of compromise. What follows is general, publicly documented background on how this class of attack typically unfolds in critical-infrastructure environments. It is illustrative only and is not a description of what happened at KLIA.
Ransomware operations against large enterprises generally follow a staged pattern rather than a single smash-and-grab:
- Initial access. Frequently an unpatched internet-facing appliance — VPN concentrators, edge gateways, file-transfer services — or stolen credentials, sometimes purchased from initial-access brokers. Exploitation of a known vulnerability is the most common route cited in sector reporting.
- Discovery and privilege escalation. Attackers enumerate Active Directory, identify service accounts with weak controls, and move toward backup infrastructure and hypervisor management planes.
- Persistence and defense evasion. Scheduled tasks, newly created services, remote-monitoring agents, and disabled or tampered endpoint protection.
- Staging and exfiltration. Data is collected and pushed to cloud storage or attacker-controlled hosts to support double extortion.
- Impact. Backups and shadow copies are destroyed, then encryption is deployed broadly and a ransom note is dropped.
That fifth step is where operators usually notice — and by then, the earlier four have often been sitting in logs for weeks. The practical takeaway is to instrument the earlier stages.
Generic, illustrative detection examples (adapt to your own environment; these are not indicators from this incident):
# Hunt for security log entries showing process creation of shadow-copy deletion
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} |
Where-Object { $_.Message -match 'vssadmin.*delete.*shadows' }
# Inventory listening services on an internet-facing Linux host
ss -tulpn
Generic recovery-resilience checks worth scheduling on a recurring basis:
# Confirm backup targets are reachable and immutable/offline as designed
# (replace with your own backup tooling and endpoints)
ls -l /path/to/backup/root
# Verify Volume Shadow Copy service state before an incident, not during one
Get-Service VSS | Select-Object Name, Status, StartType
Bugal's framing suggests where to invest: shortening recovery time matters more than assuming prevention will hold. Immutable, tested backups, segmented networks that keep passenger-facing systems away from core operational technology, MFA on every remote-access path, and alerting on credential-use anomalies all raise the cost of an attack before a ransom demand is ever made.