How Malaysian Manufacturers Can Build
a Ransomware-Resilient Operation
A five-layer defence guide for production businesses: understanding how attacks unfold, what they cost, and the practical steps that keep your operations running.
The Manufacturers That Stay Running Have Something in Common
Manufacturing is the most ransomware-targeted industry in the world for the second consecutive year. Globally, the sector accounted for 1,156 ransomware incidents in 2025, a 32% increase from the previous year, and representing 19.3% of all recorded cases across all industries, according to NordStellar’s 2025 Year-End Ransomware Review. In Malaysia specifically, multiple manufacturing companies were targeted throughout mid-2025 by groups including Qilin, Global Inc Ransom, and Crypto24, causing production downtime and delayed deliveries to both domestic and export markets.
Source: NordStellar
The reason manufacturers are targeted is straightforward. As Corey Nachreiner, Chief Security Officer at WatchGuard Technologies, states directly: ‘To a manufacturer, every minute of uptime translates to money. Cybercriminals and ransomware threat actors realise this. Every hour they can keep a manufacturer down costs the company revenue and profit, so they can really turn the screws with extortion.’
Source: manufacturingdive.com
The manufacturers that recover quickly and keep operating do not have impenetrable defences. No organisation does. What they have is layered preparation: a set of specific, practical measures that contain the damage when an attack comes and make recovery measured in hours rather than weeks. This post explains those five layers.
THE MALAYSIAN MANUFACTURING REALITY IN 2026
Malaysia’s manufacturing sector is deeply integrated with ASEAN and global supply chains. A ransomware compromise at a Malaysian components supplier can ripple immediately to customers in Singapore, Thailand, and Indonesia. The Simply Data Malaysia Cybersecurity Landscape 2026 report documents specific recent incidents: a Selangor manufacturing plant lost two weeks of production to Cl0p ransomware with a demand of RM 2 million, and a Malaysian electronics SME was compromised through firmware updates that deployed malware to more than 200 downstream customers across Asia Pacific, with estimated damage exceeding RM 10 million.
The Qilin ransomware group, which targeted Malaysia Airports Holdings Berhad in March 2025 and multiple Malaysian manufacturers throughout the year, recorded its 700th global attack of 2025 by October, according to Industrial Cyber’s analysis. Ransomware.live data confirms that manufacturing consistently holds the second-highest ransomware victim count across all industries in 2026. The threat is active, growing, and specifically targeting Malaysian operations. Sources: SimplyData and industrialcyber.co
Understanding How a Manufacturing Ransomware Attack Actually Unfolds
Before building a defence, it helps to understand the attack. Modern ransomware against manufacturing operations follows a consistent four-stage pattern. Knowing these stages tells you exactly where your defences need to be strongest.
“Attackers no longer need to break in through the front door. They look for the least protected connection in the wider ecosystem and work from there. Large organisations may feel secure, yet are blindsided by persistent, indirect attacks that occur within the cyber supply chain.”
Jeremy Moke, Senior Director, Ensign InfoSecurity Malaysia | CRN Asia, 2026 | Source: crnasia.com
The 5-Layer Ransomware Defence for Malaysian Manufacturers
AMDT’s 2026 manufacturing security analysis and IT GOAT’s Manufacturing Ransomware Defence Guide both confirm that effective protection is not a single tool. It is a set of layered measures that work together, each one addressing a different stage of the attack timeline. The five layers below are drawn from these frameworks, CISA’s StopRansomware Guide, and the SANS Institute 2025 OT Security Survey.
1. Separate Your Production Network from Your Office Network
In many Malaysian manufacturing facilities, IT systems (email, ERP, finance) and OT systems (factory controls, sensors, production equipment) share the same network. This is one of the most common and most dangerous configurations in 2026. When an attacker enters through a phishing email targeting the finance team, a flat network gives them a direct path to production systems. Network segmentation creates a boundary: attackers who compromise office systems cannot automatically reach the factory floor. AMDT’s 2026 analysis is direct: IT systems should not be able to establish connections to the OT network. OT systems should transmit information to the IT network in one direction only. This single configuration change dramatically limits lateral movement.
Source: amdt.com
Ask your IT team: Are our office IT systems and production floor systems on separate, firewalled network segments? Can someone who compromises an office laptop reach our production controls?
2. Apply Multi-Factor Authentication Everywhere, Especially Remote Access
Remote access is the leading entry vector for manufacturing ransomware, accounting for 50% of incidents according to the SANS Institute 2025 OT Security Survey. Remote desktop tools, VPN connections, and supplier access portals without MFA are open doors. Adam Marrè, Chief Information Security Officer at Arctic Wolf, specifically identifies failure to integrate OT environments into centralised monitoring and failure to use MFA on remote access as the two most common mistakes that increase manufacturer vulnerability. MFA on every remote access point, admin account, and critical system blocks the vast majority of credential-based attacks at negligible cost.
Source: manufacturingdive.com
Ask your IT team: Does every remote access point into our network, including supplier and third-party connections, require multi-factor authentication? Are admin accounts protected with MFA?
3. Deploy Endpoint Detection and Response (EDR) Across All Devices, Including Factory Floor Systems
Traditional antivirus detects known threats. EDR detects behaviour, the unusual patterns of movement, access, and activity that indicate an attacker is inside and moving through your network. In manufacturing environments, this needs to cover not just office laptops but engineering workstations, Human-Machine Interfaces (HMIs), and any device connected to your network. AMDT’s 2026 guide states clearly: manufacturers must maintain continuous visibility into their assets, deployed software, software versions, and the dependencies between IT and OT. This information must be available during day-to-day operations, not compiled for the first time during an incident. EDR combined with 24/7 monitoring shortens detection time from months to hours.
Source: amdt.com
Ask your IT team: Does our security monitoring cover factory floor devices and engineering workstations, not just office computers? Do we have real-time alerts for unusual network activity?
4. Maintain Immutable, Isolated Backups with a Tested Recovery Plan
As covered in our previous post on backup readiness, ransomware attackers specifically destroy backup systems before triggering encryption. The defence is an immutable backup, one that cannot be altered or deleted even by someone with admin access, stored in an environment completely isolated from your main network. For manufacturing businesses, this backup must cover both IT data and OT configuration data: the settings, parameters, and configurations for production equipment that would be needed to restart operations after a shutdown. Without OT configuration backups, restoring production after a ransomware event can take significantly longer than restoring IT systems alone. IT GOAT’s 2026 Manufacturing Defence Guide notes that organisations without tested recovery plans face weeks of disruption, while those with mature programmes restore critical operations within days.
Source: IT GOAT
Ask your IT team: Do our backups include OT system configurations as well as business data? Are our backups isolated from our main network? When was the last time we tested a full restore?
5. Establish and Practise a Written Incident Response Plan That Covers the First 30 Minutes
The first 30 minutes of a ransomware event determine how far it spreads. The critical actions in that window, disconnecting affected systems, identifying the scope, notifying the right people, and beginning containment, must be documented and practiced before an incident occurs, not improvised during one. For Malaysian manufacturers subject to the Cybersecurity Act 2024, NACSA guidelines also require that critical information infrastructure operators maintain active security controls and report significant incidents within defined timeframes. A written plan that names specific people, specific actions, and a clear escalation path is the difference between a contained incident and a full plant shutdown. CISA’s StopRansomware Guide recommends that the plan be reviewed and approved by the CEO in writing, and that it be reviewed and understood across the chain of command.
Source: CISA
Ask your IT team: Does a written incident response plan exist for a ransomware event? Does it name specific people responsible for the first 30 minutes? Has it ever been walked through as a tabletop exercise?
The Financial Anatomy of a Ransomware Attack on a Malaysian Manufacturer
The numbers below are drawn from Simply Data’s Malaysia Cybersecurity Landscape 2026 report and CyberSecurity Malaysia incident data. They represent the typical range for a Malaysian manufacturing SME or mid-market operator. Understanding the full cost makes the investment case for prevention clear.
For context: Simply Data’s analysis shows that investing RM 60,000 to RM 120,000 per year in managed security services reduces breach probability from approximately 70% to 20% for a Malaysian SME. At an average breach cost of RM 3.2 million, the expected value calculation is unambiguous.
Source: simplydata.com.my
YOUR MANUFACTURING RESILIENCE CHECK
5 of 5 layers in place: Your operation has strong foundational resilience. Focus on regular testing and keeping your OT asset inventory current as systems evolve.
3 to 4 layers in place: Good progress. Prioritise network segmentation and MFA first, as these address the most common initial entry and lateral movement vectors.
2 or fewer layers in place: This is the right moment to have a structured conversation with your IT team or security provider. The gaps are addressable, and addressing them now costs a fraction of what a successful attack would.
A Final Word
We encourage every Malaysian manufacturing business owner and operations leader to review their ransomware resilience with their current IT adviser or security provider. Use the five layers above as a practical starting point. Ask specifically about network segmentation between IT and OT. Ask whether your OT system configurations are backed up and tested. Ask what the first 30 minutes of your incident response plan looks like. These are reasonable, professional conversations that any qualified IT security partner should welcome.
If you would like a second perspective, or if you are evaluating your options and want an independent view of your manufacturing operation’s cyber resilience, BigBand is happy to offer a no-obligation conversation. We are not here to replace your current provider. We are here to make sure your production never has to stop because of an attack that could have been prevented.
bigband.net.my/bigband-contact | Office: +60 3 5879 3933 | email: [email protected]