Key Takeaways
- A ransomware attack disrupted flight information displays, check-in counters and baggage handling at Kuala Lumpur International Airport (KLIA) from 23 March 2025; the Qilin group claimed responsibility in April
- Qilin claimed to have stolen 2 terabytes of data, which the airport had not verified at the time; officials said they rejected a US$10 million ransom demand
- Malaysia's Prime Minister Anwar Ibrahim publicly refused payment, stating there was "no way" Malaysia would bow to criminal threats
- Malaysia Airports Holdings Berhad (MAHB) confirmed the attack but provided limited technical disclosure
- March 2025 was the first month on BlackFog's records with more than 100 publicly disclosed ransomware attacks globally (107) — an 81% increase on the same month a year earlier
The Facts
From 23 March 2025, passengers at Kuala Lumpur International Airport encountered something unusual: flight information displays, check-in counters and baggage handling disrupted, and airport staff writing departure times on whiteboards. Behind the scenes, KLIA was in the middle of a ransomware attack that would become one of Malaysia's most publicly visible cybersecurity incidents in years.
In April 2025, Qilin — a Russian-speaking ransomware group that has been escalating aggressively since its emergence in 2022 — claimed responsibility and said it had stolen 2 terabytes of data. The airport had not verified the claim at the time. Airport officials said they had rejected a US$10 million ransom demand, without naming the attacker. Malaysia Airports Holdings Berhad (MAHB), the state-linked company that operates KLIA, runs 38 other airports across Malaysia.
Prime Minister Anwar Ibrahim's response was immediate and unambiguous. Speaking publicly, he stated there was "no way" Malaysia would capitulate to criminal extortion. In a joint statement on 25 March, Malaysia Airports and national cybersecurity authorities said a cybersecurity threat affecting certain computer systems at KLIA had been detected on 23 March, and that NACSA and the Civil Aviation Authority Malaysia had been notified. Neither the company nor the government disclosed whether the 2TB data exfiltration claim was verified or what data categories were involved.
The March timing placed the KLIA attack within the busiest ransomware month on BlackFog's records. BlackFog documented 107 publicly disclosed ransomware attacks in March 2025 — the first month above 100, and an 81% increase on the same month a year earlier. It named Qilin, Clop and Akira as the most active of the 39 variants seen that month.
Technical Deep-Dive: How Qilin Operates
Qilin operates as a Ransomware-as-a-Service (RaaS) platform, meaning its operators sell attack capabilities to affiliates who then conduct the actual intrusions and split ransom proceeds. This business model separates the technical development of the ransomware from its deployment, making attribution and prosecution significantly more difficult.
How the attackers entered the airport's network has not been disclosed. Qilin's documented playbook involves initial access through phishing or exposed remote access services, network reconnaissance and data exfiltration before the ransomware is deployed, and double extortion — threatening both operational disruption and public data exposure — to maximise ransom pressure.
Airport operational technology systems present specific vulnerabilities. Flight information display systems, check-in infrastructure, and baggage handling systems are often running legacy software on network segments that were not designed with modern security controls. The convergence of IT (information technology) and OT (operational technology) systems in modern airports creates attack surfaces that traditional perimeter security does not adequately address.
Comparitech, which tracks ransomware claims, has recorded 926 Qilin attacks since 2022, 168 of them confirmed by the victims. In 2025 alone, as of late October, it counted 701 claimed victims and about 116 terabytes of data claimed stolen, with attacks on government agencies up 344% on 2024.
The ASEAN Perspective
The KLIA attack sits within a broader deterioration of Malaysia's cyber incident environment: according to Kaspersky, Malaysia saw a 153% increase in ransomware incidents in 2024 compared with the previous year.
ASEAN's critical infrastructure sector is increasingly in the crosshairs of sophisticated ransomware groups that previously focused on Western targets. Malaysia's public refusal to pay the KLIA ransom sends an important regional signal: yielding to extortion funds further attacks on ASEAN infrastructure and emboldens groups like Qilin to escalate targeting in the region.
For regional airport and transport operators in Thailand, Indonesia, and the Philippines — all operating infrastructure of comparable complexity to KLIA — the attack provides a practical case study for their own cyber resilience planning.
RECATOOLS Verdict
Anwar Ibrahim's public refusal to pay was the right call, both for Malaysia and for the regional cybersecurity ecosystem. Every ransom payment funds the next attack. Every public refusal raises the expected cost of targeting regional critical infrastructure.
The harder work is the remediation and resilience investment that follows. Documented airport OT security programmes, network segmentation between passenger-facing systems and operational infrastructure, and tabletop exercises that include ransomware scenarios are the practical outcomes that the KLIA incident should drive.
Sources
- BlackFog State of Ransomware March 2025: blackfog.com
- Industrial Cyber — Qilin Ransomware 2025 Analysis: industrialcyber.co
- Security Quotient Malaysia Cyber Threat Landscape 2025: securityquotient.io
- Comparitech — Qilin ransomware statistics and KLIA attack coverage: comparitech.com
FAQ
Did Malaysia pay the KLIA ransom? No. Prime Minister Anwar Ibrahim publicly refused, stating there was "no way" Malaysia would pay criminal extortion demands.
Who is Qilin ransomware? A Russian-speaking Ransomware-as-a-Service group active since 2022, with 926 attacks recorded by Comparitech and a documented focus on critical infrastructure, healthcare, and manufacturing.
What systems were affected at KLIA? Flight information displays, check-in counters and baggage handling were disrupted, according to the airport. MAHB gave limited technical disclosure of the affected systems.
Was passenger data stolen? Qilin claimed to have exfiltrated 2 terabytes of data. MAHB confirmed the attack without verifying or detailing the data exfiltration claim.
How can ASEAN airports protect against ransomware? Network segmentation between IT and OT systems, endpoint detection on all connected devices, offline backup systems for critical operations, and regular ransomware tabletop exercises are the baseline requirements.
Correction, 18 October 2026: An earlier version attributed figures on ransomware growth, SME impact, breach costs and detection times to a CyberSecurity Malaysia annual report; they could not be traced to that body and have been removed. It also stated as fact that Qilin encrypted core systems and made the ransom demand, gave the wrong number of MAHB airports, and misdescribed BlackFog's March 2025 count. Qilin statistics are now attributed to Comparitech.
View author profile → · Editorial policy
