Ransomware Up 48%... SK Shieldus: "Vulnerability and Account Management Essential"

Publication of the 2026 First Half KARA Ransomware Trend Report

On August 21, SK Shieldus announced the publication of the "KARA (Korea Anti Ransomware Alliance) Ransomware Trend Report," which analyzes global ransomware attack trends and major cases from the first half of this year. According to the report, there were a total of 4,744 reported ransomware incidents worldwide in the first half of 2026. Notably, the scale of damage in the second quarter increased by approximately 48% compared to the same period last year.

SK Shieldus analyzed that recent ransomware attacks are increasingly focusing on exploiting security vulnerabilities and compromised accounts of companies, rather than the malicious code itself. Attackers are using essential company infrastructure—such as virtual private networks (VPN), work platforms, and management systems—to gain initial access rights, and then expand their impact.

As VPNs, Software-as-a-Service (SaaS), work platforms, and management systems—widely used by many companies—have become prime targets, a single vulnerability or account breach can lead to the so-called "common infrastructure attack," affecting multiple companies at once. This means when a system used jointly by several organizations is compromised, the resulting damage can rapidly cascade across those companies.

The report specifically highlights the importance of managing internet-exposed systems and accounts in ransomware response. There has been an increasing number of cases where attackers exploit vulnerabilities in internet-connected systems or use stolen accounts to infiltrate the internal networks of companies.

Byungmoo Kim, Head of the Cyber Business Division at SK Shieldus, said, "Because a single vulnerability or account compromise can cause a chain reaction of damage, companies must proactively inspect their externally exposed assets and account management systems. It is also critical to strengthen real-time detection and response capabilities to secure cyber resilience."

This content was produced with the assistance of AI translation services.