Ransomware menace grips Southeast Asian businesses

Experts from the global cybersecurity company insist on organisations, regardless of shape and size, to beef up their IT security posture as ransomware, especially the targeted type, continues to be a damaging menace for organisations in the region.

“The era of widespread mass attacks by encryptors on both individuals and businesses is gradually fading away. Instead, we are witnessing a shift towards organised groups that execute hacks involving data theft and encryption, commonly referred to as double extortion. The rationale behind this evolution lies in the perpetrators' ability to operate with greater efficiency, thereby enabling them to demand significantly higher ransom sums,” says Fedor Sinitsyn, Lead Malware Analyst at Kaspersky.

Ransomware targeting businesses in SEA last year was highest in Thailand with 109,315 incidents blocked by Kaspersky. Indonesia trails closely with 97,226 ransomware attacks and Vietnam with 59,837. The Philippines came fourth with 15,312 malicious encryptors, followed by Malaysia with 4,982, and Singapore with 741.

Ransomware targeting businesses in Southeast Asia in 2023

Indonesia    97,226

Malaysia    4,982

Philippines    15,312

Singapore    741

Thailand    109,315

Vietnam    59,837

SEA Total    287,413

Last year, ransomware became a constant subject of news headlines across SEA. High-profile incidents involve a bank in Indonesia, a public health insurer in the Philippines, a public train transportation system in Malaysia, a famous hotel and casino in Singapore, the largest media conglomerate in Thailand, and an energy company in Vietnam.

“It’s evident that the threat actors behind ransomware attacks target all sectors in Southeast Asia. The total number of attempts may be lower, but organisations need to realise the real impact of each successful ransomware infection, both on the financial and reputation fronts. Businesses here must look into cybersecurity technologies that provide absolute anti-ransomware effectiveness in third-party exams. Because not all cybersecurity solutions are created equal,” Yeo Siang Tiong, General Manager for Southeast Asia at Kaspersky.

Kaspersky Endpoint Security for Business, Kaspersky Small Office Security and Kaspersky Standard demonstrated complete protection against ransomware in 10 different real-life attack scenarios during regular Advanced Threat Protection assessments held by AV-TEST. 

To combat ransomware and assist those affected, Kaspersky, alongside Europol, the Dutch National Police, and others has the No More Ransom initiative, launched in 2016. On the official website, participants provide decryption tools, guidelines, and instructions to report cybercrimes, irrespective of the location of the incident. 
By the end of 2023, Kaspersky marked the seventh anniversary as a key contributor to the No More Ransom initiative. This period witnessed expanded access to Kaspersky’s free decryption tools, in line with its commitment to combating ransomware. These tools, targeting 39 ransomware families, have been integral in assisting nearly 2 million victims globally, as reported by Europol, underscoring the profound impact of the No More Ransom initiative supported by Kaspersky.

To protect yourself and your business from ransomware attacks, consider following the rules proposed by Kaspersky experts:

•    Do not expose remote desktop/management services (such as RDP, MSSQL, etc.) to public networks unless necessary and always use strong passwords, two-factor authentication and firewall rules for them.

•    Promptly install available patches for commercial VPN solutions providing access for remote employees and acting as gateways in your network.

•    Always keep software updated on all the devices you use to prevent ransomware from exploiting vulnerabilities.

•    Focus your defence strategy on detecting lateral movements and data exfiltration to the Internet. Pay special attention to the outgoing traffic to detect cybercriminals' connections.

•    Back up data regularly with special attention to offline backup strategies. Make sure you can quickly access it in an emergency when needed. 

•    Avoid downloading and installing pirated software or software from unknown sources.

•    Assess and audit your supply chain and managed services’ access to your environment.

•    Prepare an action plan for the reputational risk of your data exposure in the unfortunate event of data theft.

•    Use solutions like Kaspersky Endpoint Detection and Response Expert and Kaspersky Managed Detection and Response service which help to identify and stop the attack in the early stages, before attackers reach their final goals.

•    To protect the corporate environment, educate your employees. Dedicated training courses can help, such as the ones provided by the Kaspersky Automated Security Awareness Platform.

•    Use the latest Threat Intelligence information to stay aware of actual TTPs used by threat actors. The Kaspersky Threat Intelligence Portal is a single point of access for Kaspersky’s TI, providing cyberattack data and insights gathered by our team for over 26 years.