Address by Minister Josephine Teo at the 6th Counter Ransomware Initiative (CRI) Summit on 16 October 2026

Distinguished colleagues and partners,

1. Good morning, and welcome to the 6th International Counter Ransomware Initiative Summit in Singapore.

2. Singapore is very pleased to host the CRI Summit for the second time. When we met here last year, I had said that the CRI should continue to grow stronger, and not just larger. Singapore believes in the work that the CRI is engaging in, the importance of continuing to pay attention to these issues, and we are very appreciative of all the colleagues who have continued to engage in this process.

3. One year on, it is useful to reflect on what growing stronger really means.

Ransomware thrives in the gaps

4. Ransomware remains one of the most persistent cyber threats we face.

a) It can affect anyone, from small businesses to major companies, government systems and essential services.

b) Its consequences can extend beyond the digital domain, disrupting people's lives and businesses.

5. Despite sustained efforts to tackle ransomware, the threat remains significant, much more than we would like it to be.

a) In 2025, more than 8,200 ransomware victims were listed on data leak sites globally, an increase of more than 50 per cent from the year before.

b) Activity has remained elevated in the first half of 2026.

6. Technology is undoubtedly giving ransomware actors new ways to operate.

7. Today, AI is being used at different stages of ransomware operations, from social engineering and gaining initial access, to supporting harmful activities after a system is compromised.

8. We are also beginning to see what greater autonomy of AI systems could mean.

9. In July, researchers documented JadePuffer, where an AI agent carried out a ransomware operation with a high degree of autonomy, including encrypting victims’ data and leaving a ransom demand.

10. The techniques were not new, but AI allowed them to be executed faster and with less direct human intervention.

11. Yet technology alone does not explain why ransomware remains so difficult to tackle.

12. Ransomware actors have become adept at finding and exploiting gaps in our defences and capabilities, and between jurisdictions.

a) They draw on infrastructure and services across borders.

b) Behind them is a wider ecosystem providing access, tools and infrastructure.

13. Ransomware thrives in the gaps. Our task as defenders is to close these gaps. This means making ourselves harder targets, detecting malicious activity earlier, and being ready to withstand and recover from attacks.

14. We must also disrupt what ransomware actors rely on, stop the easy flow of profits, and hold those responsible to account.

15. No single agency or country can do all of this alone. Cybersecurity agencies, law enforcement, financial authorities and industry each hold different parts of the solution.

16. Closing these gaps therefore requires us to bring these capabilities together.

Closing the gaps together

17. For Singapore, this is not an abstract proposition.

a) We are a small and highly connected country. Strong capabilities at home are essential.

b) But many cyber threats do not start or end here, and many of the levers needed to address them lie beyond our jurisdiction.

18. We need both strong capabilities at home and strong partnerships abroad.

19. This is why the CRI matters.

a) Its strength is not simply the number of countries around the table.

b) It is the capabilities we bring to the table, and what we can achieve when we bring all of them together.

20. Industry is important too.

a) Our private sector partners have contributed research and threat insights and supported CRI projects on issues such as bulletproof hosting and initial access vectors.

b) Bringing governments and industry together gives us a fuller picture of how the threat is evolving, where and how we can act.

21. The CRI also demonstrates something important about international cooperation.

a) We live in a more contested world, and countries will not always have the same perspectives or interests.

b) But we do not need to agree on everything before we do something meaningful together.

22. Ransomware is one such area of common ground. None of us benefits when ransomware actors use infrastructure in one country to attack victims in another, or put parts of their operations beyond the reach of any one government.

23. It is therefore encouraging to see CRI members collaborating in this spirit.

a) Earlier this year, Nigeria convened the Africa Regional Collective Action Against Ransomware Conference in Abuja, bringing African countries together to strengthen regional cooperation against ransomware, including through greater threat intelligence sharing and joint response capabilities.

b) This is the kind of regional ownership and practical cooperation that the CRI seeks to encourage.

24. We know what becomes possible when cooperation translates into operational action.

a) In February last year, Singapore was one of 14 countries involved in a coordinated international operation targeting the Phobos and 8Base ransomware networks.

b) By bringing together intelligence and operational capabilities across jurisdictions, the operation led to four arrests, the takedown of 27 servers, and warnings to more than 400 companies worldwide about ongoing or imminent attacks.

25. This is ultimately how we should judge cooperation: not by how often we meet, but by what ransomware actors can no longer do because we joined hands to act against them.

26. For Singapore, effective international cooperation means taking responsibility for building our own capabilities and contributing where we can.

27. In a more fragmented world, our answer to transnational threats cannot be greater fragmentation. It must be stronger, more practical cooperation.

Strong partnerships need capable partners

28. It also goes without saying that strong partnerships need capable partners.

29. CRI members begin from different circumstances and levels of cyber maturity. We should not expect identical systems or approaches. But a country that can better prevent, detect, withstand and respond to ransomware is both better protected and a stronger partner.

30. This is where the Global Standards Framework can help.

a) It gives members a common foundation for strengthening national ransomware resilience, while recognising our different starting points.

b) I congratulate CRI members on its development, and would like to thank our Australian and Canadian colleagues for their leadership in bringing this document about.

31. The goal is not to make every country the same. It is to make every country harder for ransomware actors to exploit — and better able to contribute when we cooperate.

32. The stronger each partner becomes, the stronger our collective response can be.

Conclusion

33. On that note, we must fully expect technology to continue evolving, and that means ransomware actors will also change their tactics.

a) We cannot know exactly what the next campaign will look like.

b) But we do know what they will look for, and essentially they will look for the gaps.

34. And our task is to keep closing these gaps – whether in our defences, our capabilities, or between our jurisdictions.

35. Last year, I said that the CRI should grow stronger, and not just larger.

a) Stronger partners.

b) Fewer gaps.

c) More effective action together.

d) That is what growing stronger must mean.

36. Singapore will continue to do our part. We will invest in our capabilities, contribute to our partnerships, and work with countries and industry to tackle this shared challenge.

37. On that note, I wish you a fruitful Summit. Thank you.