What Is Cyber Warfare? How Thai Organizations Can Tell If They Are a Target, Check, Defend, and Where Claude Helps (2026)

1. What Cyber Warfare Is, and How It Differs from Cybercrime

Cyber warfare is the use of computer operations by a state, or by groups a state supports, for political or military goals rather than direct financial gain. There are four main objectives: espionage, disruption and sabotage, influence operations, and pre-positioning, which means quietly planting access in a system and waiting for the right moment. Ordinary cybercrime differs in motive, but in practice the line is thin. Criminal groups treat wartime as an opportunity, and states use criminal and hacktivist groups as proxies.

For any organization that is not a military, the question is therefore not "who is shooting at whom" but "whose path are our systems in". The table below summarizes the four kinds of actors you can actually meet in 2026.

Actor	What they want	Confirmed example, 2026	How a Thai organization meets them
State agencies / APT groups APT = Advanced Persistent Threat	Secrets, long-term access, and a switch they can flip when they choose	CISA, the US Cybersecurity and Infrastructure Security Agency, issued advisory AA26-097A (April 7, updated July 22) on Iranian-affiliated actors reaching internet-facing PLCs (Programmable Logic Controllers) with weak access controls at water, energy and local-government sites, then altering control logic and SCADA (Supervisory Control and Data Acquisition) screen data. The devices named in the advisory are from Rockwell Automation, Schneider Electric and Siemens, and CISA says other brands may also be affected	Thai factories and utilities run the same PLC brands. Any unit exposed directly to the internet and still on default passwords is in the same category, whatever the brand
Hacktivists and proxy groups	Headlines, outages and defacements timed to a conflict	Late on November 1, Ukraine's air-raid alert app sent false warnings of a nuclear threat. About two hours later, Russia's emergencies-ministry app was used to push false information too. It happened the night the local Kherson ceasefire (October 27 to November 1) expired. No attribution has been made	Thailand already saw this in 2025 during the border conflict: a pro-Cambodian group claimed 73 DDoS (Distributed Denial of Service) attacks on Thai targets in two weeks (May 28 to June 10), about 30% government websites, 26% military, the rest private companies
Unattributed infrastructure saboteurs	Physical damage without announcing themselves	In October, freezers in hundreds of French supermarkets were switched into defrost mode remotely. The French prime minister ordered ANSSI, France's national cybersecurity agency, to investigate on October 11. On November 2 the same thing spread to Ireland, Belgium, Luxembourg, Sweden, the Netherlands, Finland and Estonia, with temperatures reaching 50°C. Nobody has claimed responsibility	Refrigeration, building management and machinery that a vendor maintains remotely are exactly the entry point used here
Mercenary spyware vendors	Specific people's phones, on behalf of state or corporate customers	Around October 30, Apple sent a new round of threat notifications to users in 99 countries, bringing the total to more than 150 countries across all rounds. In Thailand, the leaders of two political parties said publicly that they had received the alerts (November 2 to 3). The Ministry of Digital Economy and Society (DE) is still verifying that the messages came from Apple, and the NSC called agencies to a meeting on November 4. This article does not name a spyware product, because no technical findings have been published	Executives, legal counsel and anyone holding negotiation details are this group's targets, not the organization's servers

The big picture in 2026 is the Iran war that began on February 28 with cyber operations that cut communications and sensor networks ahead of the air strikes, followed by Iranian retaliation that reached beyond the war zone. The first recorded case was Stryker, a US medical-device company (March 12), where the Handala group, which researchers link to Iran, wiped devices remotely through the company's own device-management system and put Australian hospitals on alert. In July, about 30 US water systems were attacked with methods consistent with the CyberAv3ngers group. The Russia-Ukraine war is in its fifth year. ESET's APT report of October 28 (covering April to September 2026) found Russia-aligned groups still focused on governments and the defense industry in Europe, Iran-aligned groups expanding to companies in Israel and the United States, and North Korea concentrating on technology, crypto and developer ecosystems.

2. How to Tell Whether Your Organization Is a Target

Nobody sends a letter in advance, but three layers of signals answer the question. The first is what your organization is. The second is what others send to warn you. The third is what your own systems show.

Layer 1: which organizations are on the list

The Microsoft Digital Defense Report 2026 (data from July 2025 to June 2026) found government the most attacked sector at 27% of all observed activity, up from 17% the year before, followed by IT at 17% and research and academia at 14%. Among attacks on critical infrastructure, local government and education (November 2025 to April 2026), research and academia took 38% and transportation 22%, and 78% of the techniques used against critical infrastructure involved cloud identity abuse rather than breaking into machines.

In Thailand, Section 49 of the Cybersecurity Act B.E. 2562 (2019) defines Critical Information Infrastructure (CII) in seven sectors: national security, essential government services, banking and finance, information technology and telecommunications, transport and logistics, energy and utilities, and public health, plus any sector the committee adds. If your organization is in those seven sectors, or supplies services to one that is, treat yourself as a target by position.

Organization profile	Who is interested	Evidence from 2026	Level
Government agencies, the seven CII sectors, and their service providers	States, proxies, hacktivists	Government 27% of all activity (Microsoft) · The 2025 self-assessment run by the National Cyber Security Agency (NCSA): Thai government agencies averaged 59%, down from 65% (as reported by Thairath); top findings were exploitation of internal vulnerabilities, unauthorized access, and DDoS	High
Operational Technology (OT) or PLCs reachable from the internet: water, power, building systems, cold storage, production lines	States seeking physical effects, unattributed groups	AA26-097A · supermarket freezers in 8 countries · Stryker	High
Universities, research institutes, companies with specialized technology (drones, semiconductors, biotech)	States (long-term espionage)	38% of activity in the infrastructure-and-education group (Microsoft) · espionage operation targeting the drone supply chain (Anthropic)	High
Companies trading with or located in countries party to a conflict, or supplying such companies	Proxies, hacktivists	ESET: Iran-aligned groups expanding to companies in Israel and the US	Medium
Executives, politicians, journalists, lawyers and anyone holding negotiation details (as individuals)	Customers of spyware vendors	Apple alerts in 99 countries · two Thai politicians said they were notified	Medium
Any organization with internet-facing systems and customer data	Opportunistic ransomware criminals	Mandiant M-Trends 2026: exploitation of internet-facing systems is the number-one entry vector (32%) for the sixth year running	Baseline

Layer 2: signals sent to you

• Apple threat notifications arrive through three channels at once: the iPhone lock screen and Settings app, an email from threat-notifications@email.apple.com, and a banner at the top of account.apple.com after sign-in. The way to verify one is to sign in at account.apple.com yourself. Apple states that genuine notifications never ask for a password or verification code and never ask you to click a link or install anything. In the Thai cases of November 2 to 3, the Ministry of Digital Economy and Society asked recipients to submit the messages so it could confirm they came from Apple, which is the step Apple itself recommends.
• Account-provider warnings. Google and Microsoft also warn users targeted by state-backed groups. If an employee receives one, it goes to the IT team immediately, not into the trash.
• Letters from ThaiCERT or a sectoral CERT. NCSA's Thailand Computer Emergency Response Team (ThaiCERT) alerts government agencies and CII operators about serious vulnerabilities. In the PHP2Shell case of October 22, 2026 it issued alerts, surveyed exposure, monitored and tracked patching within a single day. If your organization is not on its distribution list, subscribe at thaicert.or.th yourself.
• Vendor advisories. Rockwell Automation, Schneider Electric and Siemens each published their own guidance after AA26-097A. If you run their equipment and have never received an email from them, you are not registered for advisories.
• Your organization appearing in breach data. Services such as Have I Been Pwned support domain-wide monitoring. If several employees' addresses appear in the same breach set, that is the raw material for the next attack.

Layer 3: traces in your systems

Two numbers to remember: 14 and 122. Mandiant's M-Trends 2026 (2025 data) found attackers stayed undetected for a median of 14 days, up from 11, and in state espionage and North Korean IT-worker cases the median was 122 days. "No symptoms" does not mean "not compromised". Traces worth looking for: successful logins from foreign hosting-provider IPs (AA26-097A notes the actors rented third-party servers as their base), device-code authentications the employee did not perform (the method used in the espionage operation in Anthropic's report), traffic on OT ports 44818, 2222, 102 and 502 from outside, PLC project files that changed without a work order, and DNS (Domain Name System) records that changed without anyone ordering it.

3. How to Check: A 10-Point Checklist

In the order you should do them. Items 1 to 5 can be done by the IT team alone in the first week. Items 6 to 10 need an executive or process owner in the room. The commands are examples for macOS/Linux; substitute your own domain and IPs.

1. Inventory everything that faces the internet

Include public IPs, subdomains, VPN (Virtual Private Network), vendor portals, cameras, building systems and the PLC someone connected "temporarily" and forgot. The cheapest way is to look from outside, the way an attacker does. Scan only IPs and domains your organization owns or has written permission to test. Scanning someone else's systems without permission can be an offense under Thailand's Computer Crime Act.

# Scan the ports attackers look for, including the OT ports from AA26-097A (44818, 2222, 102, 502)
nmap -Pn -p 21,22,23,80,102,443,502,1433,2222,3389,5432,5900,8080,44818 <your-public-ip>

# Find subdomains the team does not know about
curl -s "https://crt.sh/?q=%25.example.co.th&output=json" | python3 -c "import sys,json;print('\n'.join(sorted({r['name_value'] for r in json.load(sys.stdin)})))"

Compare the result with the list the team believes it has. The difference is your first risk. Search your organization's name in Shodan or Censys as well, because those two services are where attackers find untargeted victims.

2. Compare what you found against vulnerabilities being exploited right now

CISA publishes its KEV (Known Exploited Vulnerabilities) catalog as a free JSON feed. Microsoft projects a record 72,000 CVEs (Common Vulnerabilities and Exposures) disclosed in 2026, and some are weaponized in well under 24 hours after disclosure. You cannot patch everything in time, so start with what is already being used.

# Pull KEV and filter for the vendors you run (edit the grep list)
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | python3 -c "import sys,json;[print(v['dateAdded'],v['cveID'],v['vendorProject'],v['product']) for v in json.load(sys.stdin)['vulnerabilities']]" \
  | grep -iE 'fortinet|ivanti|cisco|microsoft|rockwell|siemens|schneider|php' | sort -r | head -40

PHP2Shell in October showed how one vulnerability forces every agency in the country to check at once. The steps for finding hidden PHP are in our PHP2Shell article.

3. Read authentication logs going back at least 90 days

Microsoft found that 52.2% of intrusions using valid accounts led to further credential theft, and phishing made up 23% of intrusions this year, up from 7%. In Microsoft 365, Google Workspace, VPN and ERP logs, look for successful logins from countries or hosting providers where you have no staff, device-code authentications, repeated MFA (Multi-Factor Authentication) approvals in a short window, and admin accounts signing in outside working hours. If your systems keep less than 90 days of logs, fix that first, because espionage cases sit in a network for a median of 122 days.

4. Check OT and PLCs against AA26-097A

Four questions you must be able to answer for every unit: can this PLC be reached directly from the internet, is the mode switch at RUN or REMOTE, does the running project file match a known-good copy, and is the password still the factory default. CISA recommends comparing running logic against a trusted copy with the vendor's integrity tools, and checking Rockwell Add-On Instructions in particular, because that is where real incidents were modified.

5. Check domains, DNS and email authentication

The espionage operation in Anthropic's report used DNS hijacking of hotel Wi-Fi vendors as an entry point, and phishing that impersonates your organization is far easier if your domain has no DMARC (see What Are SPF, DKIM and DMARC).

dig +short TXT example.co.th            # must contain v=spf1 ... -all
dig +short TXT _dmarc.example.co.th     # must contain v=DMARC1; p=quarantine or p=reject
dig +short NS example.co.th             # must match what is on file at the registrar

Turn on registrar lock and MFA on the registrar account too, because that account controls both your website and your email.

6. Check the devices of people who are targets by position

Executives, legal, finance, and anyone negotiating with foreign partners: check three things. One, sign in at account.apple.com and look for a threat-notification banner. Two, enable Lockdown Mode on this group's iPhones, which is Apple's first recommendation and what one Thai recipient said they did immediately. Three, Android users enable Google's Advanced Protection. If a notification does arrive, Apple recommends contacting the Access Now Digital Security Helpline, which operates around the clock.

7. Check outsiders who have a way in

Vendors who maintain refrigeration, lifts, cameras and machinery, and external IT providers, often hold VPN accounts or remote tools the organization forgot. The European freezer incidents came in through vendor-maintained systems, and M-Trends reports third-party compromise at 17% of cloud incidents. List who can get in, how, and whether it is still used, then close what is not.

8. Check that backups are off the network and actually restore

NCSA's 2026 risk report recommends segregating backups from the main network to counter ransomware, and CISA warns to verify PLC backups contain no malicious logic before restoring. If you have never rehearsed a real restore, start with the ERP restore drill checklist and the Disaster Recovery plan.

9. Treat AI and agent credentials like admin credentials

The first recommendation Anthropic gave organizations in its September 2026 report is to treat AI API keys and agent integrations as production-grade credentials, because attackers target them directly, and to buy AI access only through authorized channels, because discounted offers routed through unknown intermediaries carry serious risk. The trojanized Claude Code extension on Cursor in late October is the latest example. The device checks are in our 12-point checklist for Claude users.

10. Check that people know their roles when it happens

Ask three questions in the executive meeting: who has the authority to shut a system down at 2 a.m., who calls ThaiCERT, and can we file the legally required incident report within the deadline. If the answers take more than a minute, the organization is not ready, whatever tools it owns.

#	What to check	Who	Time	Tools
1	Inventory of internet-facing systems	IT	1 day	nmap, crt.sh, Shodan
2	Compare with KEV and ThaiCERT alerts	IT	Half a day, then weekly	CISA KEV JSON
3	90 days of authentication logs	IT	1–2 days	M365/Workspace audit log, VPN log
4	OT/PLC four questions	IT + OT engineer	1 day per site	Vendor tools
5	DNS, SPF, DMARC, registrar	IT	1 hour	dig
6	Executive devices	IT + the person	30 min per person	account.apple.com, Lockdown Mode
7	Vendor and outsider access	IT + procurement	2–3 days	Contract list, VPN user list
8	Off-network backup + restore drill	IT + system owner	1-day drill	Restore drill checklist
9	AI and agent keys	IT + every team using AI	Half a day	Each service's admin console
10	Roles during an incident	Executives	1 meeting	One-page IR (Incident Response) plan

4. How to Defend: What Comes First

This year's guidance from NCSA, CISA and Microsoft agrees. All three put the weight on identity and entry points, not on buying more tools. Ordered by value, it falls into three tiers.

Tier 1: this month, no purchase needed

• Phishing-resistant MFA (passkeys or hardware keys) for every admin, VPN, email and cloud account. NCSA's 2026 report lists MFA with Zero Trust as its first recommendation. The basics are in What Is 2FA.
• Take admin interfaces and PLCs off the internet. Put them behind a VPN or jump host, with firewall rules defining who may talk to a PLC, and block hosting-provider IP ranges that have no reason to connect.
• Patch internet-facing systems within a day for anything in KEV. Internal systems can wait for the normal cycle.
• 3-2-1 backups: three copies, two media, one off the network, and rehearse the restore.
• Reduce privilege. Separate admin accounts from daily accounts, and remove standing access that is not used.

Tier 2: this quarter

• Segment IT from OT so the office network can go down without stopping the production line.
• EDR (Endpoint Detection and Response) on admin machines and machines that reach OT first, then expand.
• Retain logs for at least 6 to 12 months so you can look back across the 122 days of an espionage case.
• Control vendor access. Accounts expire, and open only while a work order is active.
• Disable unused services on OT. CISA names Telnet, FTP, RDP, VNC and web services on controllers.

Tier 3: make it a system

• A one-page incident response plan and two tabletop exercises a year. Microsoft urges governments at every level to exercise regularly and to plan on the assumption that an incident will spread to suppliers.
• Know ThaiCERT before you need it. Phone 02-114-3531, 24 hours, email thaicert@ncsa.or.th, or LINE @thaicert.
• Follow the standards already in force. Government agencies and CII operators are subject to NCSA's Cloud Security and Website Security standards, effective since September 2026, summarized in our NCSA standards article.

5. What Claude Can and Cannot Do

This has to be said plainly, because Anthropic's own report states that attackers used Claude Haiku, Sonnet and Opus in the espionage operations it detected, and that no case in the report involved a Fable- or Mythos-class model, apart from one illicit-distillation case. For defenders the meaning is simple: assume the adversary has automation, and use the same kind of tool to make your own team faster where it is short of people.

Task	How Claude helps	Limits to know
Reading logs and triaging events	Paste VPN or audit logs and ask for logins from foreign hosting providers, device-code flows or abnormal repeated MFA; write SIEM (Security Information and Event Management) queries; compare IPs against the AA26-097A lists; turn a 20-page English advisory into a Thai checklist for the OT team in minutes	Strip personal data and secrets first. Use a Team or Enterprise plan, which does not train on your data by default. See Claude Data Governance
Incident plans and exercises	Draft a one-page IR plan from your real org chart; build tabletop scenarios from this year's actual incidents, such as freezers forced into defrost or an alert app pushing fake messages; play the exercise facilitator	Deciding who may shut a system down stays with executives. Claude makes sure the questions are complete; it does not answer them for you
Reviewing code and configuration	The /security-review command in Claude Code checks code before merge; it reads nginx, firewall or vendor scripts and points out what is open wider than needed	It reviews only what it is shown. It does not see your real network and does not replace a penetration test
Legal paperwork	Assemble an incident timeline from scattered notes, draft the NCSA incident report in the prescribed format, and draft the 72-hour PDPC notification	The facts must come from the people who saw the incident. Claude formats and checks completeness
Training people	Produce training material on real versus fake Apple notifications, write sample phishing emails for a management-approved internal drill, and answer staff questions at any hour	Under Anthropic's usage policy, Claude refuses to write malware or exploit code even when told it is for testing, unless the user has been verified through Anthropic's program for security professionals
Anthropic's own programs	Cyber Mission (October 8, 2026, following Project Glasswing in April) includes a critical-infrastructure defense program with 11 partners, among them CrowdStrike, Dragos, Nozomi Networks, Palo Alto Networks and Rockwell Automation, and OSS Scanner, a free opt-in service that scans open-source code. On November 3, 2026 a beta let EDR tools from CrowdStrike, SentinelOne, Palo Alto Networks, Tanium and three others see the commands Claude Cowork runs inside its local virtual machine, for Team and Enterprise plans	The infrastructure program started with a small group in the US. Thai organizations can reach it through OSS Scanner (if they maintain an open-source project) and the Cyber Verification Program, which requires an application and review

Four things Claude cannot do for you belong on the wall. One, it does not replace EDR, SIEM or a firewall, because it cannot see your network. Two, it should not receive raw logs containing personal data or CII information through an employee's personal account. Three, it will not attribute the attacker; attribution is the job of government agencies and intelligence firms with far more data. Four, it will not write attack tools, and even a red team must pass Anthropic's identity verification first.

Conclusion

Cyber warfare in 2026 does not stop at the borders of the countries fighting. It travels along shared PLC brands, along vendors who maintain systems remotely, and along the data other states want. Whether a Thai organization is a target can be answered in three layers: what we are, who has warned us, and what the logs say.

• Know what kind of target you are. Government agencies, the seven CII sectors and their service providers, organizations with internet-connected OT, and research institutions are high by position.
• Run the 10 checks. The first half can be done by the IT team in a week with free tools. The second half needs an executive in the room.
• Defend identity and entry points first. Phishing-resistant MFA, admin screens and PLCs off the internet, KEV patches within a day, off-network backups, before buying new tools.
• Use Claude where you lack people. Reading logs, translating advisories, drafting plans, running tabletops, reviewing code and preparing legal paperwork, with humans making the decisions and holding the raw data.

If you have only one day, do items 1, 3 and 10: know what is exposed, know whether someone is already inside, and know who calls whom.

No symptoms does not mean not compromised. Espionage cases sit in a network for a median of 122 days, so the first executive question is not "are we safe" but "how many days of logs can we look back through"

- Grand Linux team, drawing on M-Trends 2026 and the Microsoft Digital Defense Report 2026

References

All facts were checked on November 3, 2026 against government notices (CISA, NCSA, ThaiCERT, the Thai government), annual reports from security firms (Microsoft, Mandiant, ESET, Anthropic), Apple documentation, and news outlets that confirmed details with the parties involved. Several incidents still have no official attribution, including the European freezer attacks and the Ukrainian and Russian alert apps; the article says "not attributed" as the sources do and draws no inference. In the Thai Apple-notification cases, the Ministry of Digital Economy and Society was still verifying that the messages came from Apple, so the article names neither the recipients nor any spyware product, even where news headlines do. The NCSA 2026 incident-reporting guide is cited from a local-government page that republished it; readers should obtain the official copy from NCSA directly.

• ABC News — In an unstable world super-charged by AI, hacking is the new war front (Nov 1, 2026)
• CISA / FBI / NSA / EPA / DOE — AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (Apr 7, updated Jul 22, 2026)
• Wikipedia — Cyberwarfare during the 2026 Iran war (timeline overview only) (checked Nov 3, 2026)
• CNBC — Fake nuclear warnings in Ukraine as Moscow, Kyiv report separate cyberattacks on emergency apps (Nov 2, 2026)
• Euronews — Ukraine and Russia say air raid alert apps hit by cyberattacks after truce ends (Nov 2, 2026)
• CNBC — New cyberattack on supermarket fridges sweeps across Europe (Nov 2, 2026)
• ESET Research — APT Activity Report Q2–Q3 2026: Iran-aligned groups' targeting expands; Belarus-aligned APT activity converges with Russia's war priorities (Oct 28, 2026)
• 9to5Mac — Apple recently notified users in 99 countries of potential mercenary spyware attacks (Nov 2, 2026)
• Apple Support — About Apple threat notifications and protecting against mercenary spyware (updated Aug 13, 2026)
• PPTV HD36 — Two opposition party leaders warned of spyware attacks; National Security Council to meet (Thai) (Nov 3, 2026)
• Siamrath — NSC Secretary-General confirms a cyber-attack response plan, agencies called to rehearse (Thai) (Nov 3, 2026)
• Royal Thai Government — Minister orders NCSA response to PHP2Shell; ThaiCERT takes four measures (Thai) (Oct 22, 2026)
• Brickinfo TV — NCSA releases the Thailand National Cyber Risk Assessment Report 2026 (235 respondents, 134 agencies) (Thai) (Oct 4, 2026)
• Thairath — Government agencies' cybersecurity self-assessment average falls to 59% (Thai) (Sep 30, 2025)
• ThaiCERT (NCSA) — 24-hour cyber incident reporting channels (checked Nov 3, 2026)
• NCSA (copy republished by Chiang Rai PAO) — Guide to the 2026 cyber incident reporting procedure for CII operators and government agencies (Thai) (2026)
• The Record — Pro-Cambodian hacktivists launch attacks on Thai government sites amid border dispute (Radware data) (June 2025)
• Microsoft On the Issues — Preparing governments for an era of interconnected cyber risk (Digital Defense Report 2026) (Oct 1, 2026)
• Microsoft — Digital Defense Report 2026 (Oct 2026)
• Google Cloud / Mandiant — M-Trends 2026 Executive Edition (Mar 2026)
• Anthropic — Detecting and countering misuse of AI: September 2026 (Sep 10, 2026)
• CyberScoop — Anthropic launches cybersecurity program for critical infrastructure and open source (Cyber Mission, OSS Scanner) (Oct 8, 2026)
• Cyber Security News — Anthropic enables EDR monitoring for Claude Cowork (beta) (Nov 3, 2026)
• Anthropic Help Center — Automated security reviews in Claude Code (checked Nov 3, 2026)
• CISA — Known Exploited Vulnerabilities Catalog (checked Nov 3, 2026)