China’s Underground Markets and AI Ransomware Scaling Faster Than Ever

CrowdStrike’s latest 2025 APJ eCrime Landscape Report pulls no punches: cybercrime in Asia Pacific and Japan is scaling faster than ever, thanks to thriving Chinese-language underground markets and a new wave of AI-driven ransomware. Despite government crackdowns, hubs like Chang’an, FreeCity, and Huione Guarantee are still fueling the trade in stolen logins, phishing kits, and laundering services—Huione alone pushed around $27 billion before it was finally disrupted.

What’s changing the game now is AI. Ransomware gangs are leaning on it to spin up more believable phishing emails, build malware on the fly, and run campaigns that look industrial in scale. Fresh crews like KillSec and Funklocker have already hit hundreds of companies, mostly in finance, tech, and manufacturing, leaving their victims’ names plastered across leak sites. India, Japan, and Australia are taking some of the hardest hits.

At the same time, Chinese-speaking attackers are hijacking Japanese trading accounts to pump thinly traded China-based stocks, turning everyday investors into unwilling accomplices in pump-and-dump scams. And with “service providers” like Magical Cat offering phishing kits and CDNCLOUD delivering bulletproof hosting, the barriers to entry for cybercrime have never been lower. Add in remote access tools like ChangemeRAT and ElseRAT spreading through poisoned search results, and the ecosystem looks more like a professionalized industry than a shadowy hobby.

As CrowdStrike’s Adam Meyers warns, cybercriminals are moving at AI speed—and defenders need to catch up before they get steamrolled.