Hong Kong records nearly 18% rise in ransomware cases amid drop in tech crime

Hong Kong has recorded a nearly 18 per cent rise in ransomware cases in the first three quarters of this year despite an overall drop in technology crime, with police attributing the rise to artificial intelligence-aided attacks.

Chief Superintendent Raymond Lam Cheuk-ho of the cybersecurity and technology crime bureau said police had recorded cases of AI agents and other forms of artificial intelligence being used in cyberattacks as recently as last month.

“We understand that the use of AI obviously increases the speed of attacks, the volume and intrusiveness. The attacks will be more effective,” Lam warned.

In response to the growing threat, police have also developed an AI-powered system to speed up the detection of suspected fraudulent websites. It was used in a year-long joint operation with Interpol from last July to this June to remove more than 51,000 phishing links.

From January to September, Hong Kong recorded 21,573 cases of technology crime, an 11.5 per cent drop from 24,370 reported over the same period last year. Losses also dropped from HK$4.59 billion to HK$3.9 billion, marking a 15.1 per cent decrease.

Two categories of cybercrime which target companies – ransomware and hacking cases – showed different trends.

Ransomware cases rose by 17.6 per cent to 40 in the first three quarters of this year, compared with 34 over the same period last year. Hacking cases dropped 21.6 per cent from 37 to 29.

Lam attributed the rise in ransomware cases to hackers’ use of various kinds of the technology, including AI, to probe corporate computer systems for vulnerabilities. He added that AI had also greatly reduced the costs of attacks.

“They use generative AI, agentic AI and automated AI to power the attack chain, so everything is just automated,” Lam said.

The chief superintendent urged companies to secure their computer systems by ensuring they were up to date, to prevent operational disruptions from cyberattacks.

“This situation reminds us that even though overall technology crime cases seem to have dropped, it doesn’t mean every single online threat has reduced correspondingly,” he warned.

In addition to local exercises to detect and neutralise cyberthreats, the force also deployed its own AI analysis engine, named Rapid, for the year-long operation with Interpol.

The engine analysed source codes, websites and web domain indicators to identify suspected fraudulent online entities.

The operation investigated more than 57,000 phishing links, removed over 51,000 of them and shared intelligence with 47 jurisdictions across over 10 Asian countries and at least two European states. Around 1,700 victims were identified.

Enrique Hernandez-Gonzalez, assistant director of cybercrime operations at Interpol, said the operation marked the first time the organisation had used an AI-powered system to identify and crack down on cybercrime.

“Our ultimate aim remains the rapid disruption of malicious infrastructure,” Hernandez-Gonzalez said.

The force also detected around 1.3 million instances of online hazards targeting the city in the first three quarters of this year, a 32 per cent jump from 1 million over the same period last year.

Among these detected threats, 350,599 were online phishing hazards, which accounted for the largest proportion at 27.6 per cent. This was followed by 321,393 instances of system scanning threats, at 25.3 per cent, and 210,211 instances of malware, at 16.5 per cent.

Lam attributed the rise in threats targeting the city to a global increase in cyberthreats, as well as heightened detection by the force.

Superintendent Rachel Hui Yee-wai, also of the cybersecurity and technology crime bureau, said the force reported more than 44,000 high-risk cybersecurity loopholes to relevant organisations for immediate fixes.

Among them were 37,950 loopholes concerning remote desktop protocol, which allows users to operate a computer system remotely, while another 6,083 concerned the PHP programming language, used in various e-commerce and enterprise portals.

The Digital Policy Office ordered all government bureaus, departments and public bodies to review their systems to see if they had been affected by a global discovery of vulnerabilities in the PHP programming language last month.

“Online infrastructure with unfixed loopholes tends to become a gateway for hackers to attack. Once a device is attacked, it could become a botnet,” Hui warned.

A botnet is a network of private computers, servers or devices infected with malware and controlled remotely by a single attacking party.