Cyber attacks in 2025 did not follow a single pattern, but they were not random either. Across regions, they served a small set of functions. According to global
cybersecurity firm Check Point Software Technologies’
Cyber Security Report 2026, the attackers focused on gaining access early, what the report calls “positioning”. Then came “operational support”, where cyber activity helped ongoing military or political moves. In some cases, attacks caused direct disruption. In others, they were used to shape public perception.
These roles often overlapped as the same access could begin as surveillance, move into disruption, and later feed into influence campaigns.
The report highlighted that this shift is important because
cyberattacks are no longer just about breaking systems. They are being used alongside events on the ground.
Why is India seeing the highest attack volume
Within the Asia-Pacific region, the report noted that India recorded the highest average attack volume of about 7,684 cyber attacks per week, which puts it ahead of other countries in the region in terms of sheer targeting.
The report said that educational institutions are the most heavily targeted sector in Asia-Pacific. “India experienced the highest average attack volume, at 7,684 weekly attacks,” it said.
A large part of this is structural as India’s rapid digital expansion has increased exposure across sectors. With more services going online, more data is being generated, and hence, more interconnected systems are being operable. That makes the country both a large target and a relatively accessible one.
Why are Indian educational institutes being targeted
The report highlighted that universities and schools hold large volumes of personal data and research material. At the same time, their networks tend to be more open and less tightly controlled than those of banks or critical infrastructure.
This combination makes them more attractive and less defensible targets. The report said that both targeted attacks and opportunistic ones are rising in this segment.
How cyber operations played out in the India-Pakistan conflict
According to the report, the India-Pakistan tensions in 2025 offer a closer look at how cyber activity is being used. After the April attack in Pahalgam, a Pakistan-linked group used phishing documents disguised as incident reports to target Indian defence personnel. The malware deployed allowed access to credentials and internal systems.
By May, as tensions escalated along the Line of Control, cyber activity increased alongside physical exchanges.
How are chip and hardware sectors becoming cyber targets
Globally, the hardware and semiconductor sector saw a 34 per cent rise in attacks globally. In
Asia-Pacific, the sector was hit the hardest, with an average of over 4,000 weekly attacks, which was more than three times the levels seen in other regions. The most targeted countries were Taiwan and China.
As semiconductor manufacturing sits at the centre of global supply chains and countries compete to build domestic capacity, these ecosystems are drawing more attention from attackers.
The same trend is visible in the West as well. Europe saw a 75 per cent jump in attacks, while North America recorded a 24 per cent increase, the report said. These regions are investing heavily in chip production, making companies, suppliers and research centres more exposed.
Telecom and energy networks under growing cyber attacks
Telecom networks are seeing sustained targeting across regions. In Asia-Pacific, attacks on telecom firms rose by 53 per cent, with increases also recorded in Europe and North America. Several recent incidents ranging from data breaches to service disruptions, point to a consistent focus on accessing core systems and subscriber data.
Energy and utilities are also facing higher levels of activity. Attacks rose by 88 per cent in North America and 59 per cent in Europe.
Cyber conflict used to shape public narrative
One of the quieter shifts is the growing role of control over public narratives. Cyber operations are increasingly being used to influence how events are seen, the report cautioned. Data leaks, defacements and public claims of responsibility are becoming common tools, as it happened during the 2025
Iran-Israel conflict.
In some cases, the impact lies less in what is disrupted and more in how the disruption is perceived. This is particularly visible in larger conflicts, where messaging, attribution and public reaction can matter as much as technical damage, the report said.
