Thailand braces for a cyber emergency. Daily attacks threaten banks, government networks and essential services. Anutin orders stronger defences as AI sharpens hackers’ capabilities. Russia, China, Iran and North Korea dominate international security concerns.
Thailand faces daily cyberattacks, with AI-powered hackers targeting banks, government networks, and critical infrastructure. National Security Council Secretary-General General Chaiyapruk Duangprapat confirmed the threat on Monday, November 9. Meanwhile, Prime Minister Anutin Charnvirakul has ordered heightened defences and preparations for a national cyber emergency. Russia, China, Iran and North Korea are identified as major global cyber threats, although Thailand has named no perpetrators. Banks have been ordered to protect depositors as authorities prepare for possible attacks on electricity, transport and healthcare systems. Despite official assurances that defences are holding, the government is preparing for a major cyber crisis.
Thailand is facing daily cyberattacks against government networks, banks and essential public services, the National Security Council confirmed on Monday. Hackers are increasingly using artificial intelligence to identify security weaknesses and penetrate protected systems.
In response, Prime Minister Anutin Charnvirakul has ordered stronger defences and preparations for a national cyber emergency. The government insists its systems remain secure despite the continuing attacks.
National Security Council (NSC) Secretary-General General Chaiyapruk Duangprapat disclosed the threat following a high-level meeting at Government House. The seventh NSC meeting of 2026 took place on November 9 under Prime Minister Anutin’s chairmanship.
Thailand faces daily AI-powered cyberattacks as security agencies defend banks and public networks
Officials examined Thailand’s exposure to international cyber threats and its ability to protect essential infrastructure. Notably, the meeting brought together security agencies, financial regulators and representatives of the country’s banking sector.
General Chaiyapruk confirmed that hackers were attempting to penetrate Thai computer systems every day. Government agencies, commercial banks and public utilities were among the targets.
However, he maintained that responsible agencies were successfully defending critical networks and preventing serious disruption. The NSC described a persistent threat requiring continuous monitoring, stronger security measures and effective emergency arrangements.
Artificial intelligence has become a particular concern for Thailand’s security authorities. According to General Chaiyapruk, attackers are using AI to scan networks, analyse vulnerabilities and identify potential entry points.
These methods allow criminals to search for weaknesses in protected systems. Consequently, government cybersecurity teams face increasingly sophisticated attacks against networks supporting essential national operations.
Anutin orders stronger cyber defences as European attacks expose risks to essential Thai services
The Prime Minister has instructed relevant agencies to raise cybersecurity protection to the highest level. Furthermore, he ordered contingency plans for serious incidents capable of threatening public services or developing into national emergencies.
Officials must also examine weaknesses in existing security arrangements and prepare immediate responses to abnormal activity.
The NSC meeting followed reports of cyberattacks against digital networks in several European countries. Separately, officials reviewed wider international security developments, particularly the continuing conflict in the Middle East.
Thailand is studying lessons from countries that have experienced serious cyber incidents. The findings will inform improvements to prevention, protection and crisis-management arrangements.
The government’s concerns extend beyond conventional computer networks and stolen information. Industrial control systems, connected machinery and equipment operating essential infrastructure are also receiving attention.
These systems support electricity supplies, transport networks, healthcare facilities and other public services. As a result, cyberattacks against them could disrupt operations far beyond the affected computer networks.
Critical infrastructure and banking systems face mounting pressure from persistent cyber intrusions
The NSC identified financial services, government systems and critical infrastructure as priority areas. In addition, food supplies, energy systems, transport and healthcare were identified as requiring particular protection.
The council is seeking cooperation from private companies operating essential equipment and connected systems. These businesses form part of Thailand’s wider national security preparations.
Despite the continuing attacks, General Chaiyapruk maintained that existing cybersecurity defences remained reliable. He said responsible agencies were protecting essential networks and maintaining normal operations.
Nevertheless, attackers were continually searching for vulnerabilities and developing new techniques. The NSC therefore wants protective measures strengthened before serious incidents overwhelm existing arrangements.
The banking sector received particular scrutiny during Monday’s meeting. Representatives from the Bank of Thailand attended to explain existing safeguards and preparations for possible emergencies.
General Chaiyapruk said the central bank had consulted commercial financial institutions about the continuing threat. According to its assessment, Thailand’s banking systems remained protected and fully operational.
Banks ordered to protect depositors as Thailand strengthens financial networks against cyber threats
Prime Minister Anutin nevertheless instructed banks to prepare for unexpected incidents. Financial institutions must respond immediately to suspicious activity and prevent disruptions affecting customers.
Above all, the government wants depositors protected from any interruption to banking services. The Prime Minister emphasised that serious incidents must be contained before they interfere with customers’ access to their money.
Deputy Prime Minister and Finance Minister Ekniti Nitithanprapas confirmed coordination with Bank of Thailand Governor Vitai Ratanakorn. The Thai Bankers’ Association is also involved in strengthening cybersecurity arrangements.
One particular concern involves third-party technology providers connected to financial networks. These external systems can introduce additional vulnerabilities requiring coordinated protection.
In parallel, Thailand’s banking industry is addressing cyber threats through TB-CERT, its established cybersecurity information-sharing mechanism. Participating institutions use the system to exchange threat information and coordinate defensive measures.
Representatives from the Stock Exchange of Thailand also attended the NSC meeting. They received policy directions concerning cybersecurity and the protection of financial infrastructure.
NSC maintains banking defences are holding while preparing agencies for major national cyber emergencies
General Chaiyapruk faced questions about whether Thailand’s banking system could be considered completely secure. He referred to assurances from the central bank following consultations with commercial banks.
However, he acknowledged that attempted attacks occurred daily whenever perpetrators identified opportunities. The NSC chief maintained that existing protective arrangements remained capable of managing the continuing threat.
The government has also ordered preparations for circumstances in which existing defences might prove insufficient. Banks must have arrangements to identify abnormal activity and respond immediately.
Likewise, government agencies responsible for essential infrastructure must prepare for incidents affecting connected systems. The objective is to maintain operations while preventing serious disruptions to public services.
The NSC reviewed Thailand’s national preparedness and crisis-management framework during the meeting. Cybersecurity responses are organised into three levels, with responsibilities changing according to the seriousness of an incident.
Thailand sets three-level cyber crisis response as National Security Council prepares to take control
Under normal conditions, the National Cyber Security Agency and Ministry of Digital Economy and Society monitor threats. They also coordinate routine cybersecurity operations and implement preventive measures.
A major national cyber crisis would activate a different management structure. At that stage, the National Security Council would assume responsibility for coordinating the wider government response.
This arrangement connects technical cybersecurity agencies with authorities responsible for managing national emergencies. Accordingly, a serious incident could trigger coordinated action across several government departments.
The Prime Minister has ordered officials to strengthen contingency arrangements for severe cyberattacks. Agencies must prepare responses capable of containing problems before they disrupt essential services. Meanwhile, the Ministry of Digital Economy and Society is organising a cybersecurity workshop involving relevant agencies and stakeholders. The exercise will assess existing resources, staffing levels and technical capabilities.
Cybersecurity workshop and new operations centre planned as hackers exploit AI-powered techniques
General Chaiyapruk said the workshop would identify areas requiring further development or improvement. Personnel, technology and cybersecurity systems will all come under examination.
Although existing defences were considered capable of managing current threats, officials acknowledged that security requirements were changing. Hackers were continually developing new techniques and searching for weaknesses in protected networks.
Artificial intelligence was making that challenge more demanding. Attackers can use the technology to analyse computer systems and identify possible vulnerabilities.
In turn, cybersecurity teams must continually review their protective arrangements and adapt to changing attack methods. The government has instructed agencies to maintain their existing protection while preparing for more serious incidents.
On another front, the NSC is preparing plans for a dedicated national security operations centre. The proposed facility would collect information and monitor developments across normal, emergency and crisis conditions.
It would also coordinate responses involving government agencies, private businesses and academic institutions. The centre forms part of broader preparations for managing threats requiring action across several sectors.
Thailand prepares 2027–2032 security framework and separate national counter-drone control centre
The proposal emerged during discussions about Thailand’s future national security framework. Officials examined a draft policy and planning structure covering the period from 2027 to 2032.
The existing national security plan is scheduled to expire in 2027. Consequently, the government is preparing replacement arrangements addressing current and emerging security threats.
Cybersecurity forms one component of this broader national security review. The council also considered other threats requiring specialist agencies and coordinated government responses. Among them was a proposal to establish a national counter-drone control centre. The Royal Thai Air Force has been designated as the principal agency responsible for the proposed facility.
The counter-drone proposal is expected to reach the Cabinet for consideration. Separately, the Ministry of Commerce explained proposed regulations governing the import and export of unmanned aerial vehicles.
These discussions formed another part of the council’s national security agenda. The immediate cybersecurity warning, however, concerned persistent attacks against government systems, banks and essential infrastructure.
Russia, China, Iran and North Korea named as global cyber threats but Thailand identifies no attackers
The NSC has not publicly identified the organisations responsible for the daily cyberattacks. Crucially, it has not attributed the attempted intrusions to any particular foreign government. Russia, China, Iran and North Korea have been identified internationally as major sources of state-sponsored cyber threats.
Their documented activities include espionage, financial theft, disruptive operations and attacks against critical infrastructure.
The 2026 United States Annual Threat Assessment identifies all four countries as significant cyber threats. It also describes selective cooperation between them, although their operations and objectives differ.
Russian-linked operations have targeted government networks, energy infrastructure and political organisations. Chinese-linked groups have been associated with cyberespionage, intellectual property theft and intrusions into telecommunications systems.
North Korean operations have included cryptocurrency theft, banking attacks and intelligence gathering. According to US intelligence estimates, cryptocurrency theft linked to North Korea probably reached $2 billion during 2025.
Iranian-linked groups have also conducted cyberespionage and disruptive operations. Their activities have included attacks involving Israel, the United States and regional adversaries.
Western cyber operations and criminal networks complicate attribution as Thailand reports no breaches
State-sponsored cyber operations are not confined to countries aligned with Moscow and Beijing. The United States, Britain and Israel also possess offensive cyber capabilities. These countries conduct operations involving intelligence collection, military objectives and disruption of hostile networks. Additionally, financially motivated criminal organisations conduct cyberattacks without established government direction.
None of these international activities establishes responsibility for the attacks reported by Thailand’s National Security Council. Thai authorities have released no evidence identifying a particular foreign intelligence service or criminal organisation.
Nor has the government disclosed verified figures for successful intrusions or compromised financial institutions. It has also provided no financial loss estimates directly linked to the daily attacks.
The distinction between attempted intrusions and successful attacks remains central to the official account. The NSC confirmed continuous hostile activity but maintained that essential systems were still being protected.
Furthermore, the Bank of Thailand assured the government that commercial banking services remained operational. No nationwide cybersecurity breakdown was reported following Monday’s meeting.
Anutin distinguishes 72-hour disaster guidance from NSC decisions while ordering stronger defences
Prime Minister Anutin separately addressed reports concerning a proposed 72-hour national crisis response plan. He said the NSC meeting had not formally considered the proposal. Instead, he described the guidance as preparations developed by the Department of Disaster Prevention and Mitigation. He maintained that Thailand had already undertaken the necessary emergency preparations.
The Prime Minister also said members of the public could continue their normal activities. His comments followed assurances that banking services and essential computer networks remained operational.
Even so, he reaffirmed instructions for security agencies and the digital ministry to strengthen cybersecurity measures. Officials must also develop effective responses for potentially serious incidents.
General Chaiyapruk said the government’s immediate priority was maintaining protection while preparing for changing threats. The NSC would continue examining international incidents and assessing Thailand’s readiness.
Thailand maintains cyber defences despite daily attacks and unanswered questions about perpetrators
At the same time, financial institutions must maintain their security arrangements and respond immediately to abnormal activity. The digital ministry will assess whether additional personnel, technology and resources are required.
The November 9 meeting confirmed that Thailand is experiencing daily attempted cyberattacks against essential systems. Despite this, authorities maintain that existing defences are preventing serious disruption.
Two opposition leaders received warnings about spyware on their phones as ministers deny involvement
Chinese cyber theft car drivers with mobile network transmitters touring Bangkok arrested by police
The government is strengthening emergency arrangements while reviewing resources available to cybersecurity agencies. Artificial intelligence, financial network vulnerabilities and threats to critical infrastructure remain central concerns.
No compromised bank has been publicly identified in connection with the latest NSC warning. Equally, authorities have not disclosed evidence linking the attacks to a particular country.
Thailand’s highest security body maintains that its defences are holding against continuous attacks. The Prime Minister has nevertheless ordered stronger protection and crisis preparations across agencies responsible for essential national operations.
Join the Thai News forum, follow Thai Examiner on Facebook here
Follow Thai Examiner on Google here
Receive all our stories as they come out on Telegram here
Follow Thai Examiner here
Further reading:
Two opposition leaders received warnings about spyware on their phones as ministers deny involvement
Licenced online gambling site abroad linked to the husband of a government MP raises legal quandary
House Committee chair Rome to call Bhumjaithai MP and Australian husband on Wednesday over wealth
Bhumjaithai MP files police report against People’s Party’s Rangsiman Rome over scammer link remarks
Former cabinet minister and Pheu Thai highflyer clarifies Ben Smith and luxury Gulfstream jet story
PM Paetongtarn suspended from duties while Deputy Prime Minister Suriya Jungrungruangkit takes power
