SK Shielders Publishes Analysis Report on Ransomware Attack Trends

The arrow of ransomware attacks is pointing toward 'shared infrastructure.' Security firm SK Shielders published the 'KARA (Korea Anti Ransomware Alliance) Ransomware Trend Report' on the 21st, which analyzes global ransomware attack trends and major cases from the first half of 2026. According to the report, a total of 4,744 ransomware damages were recorded worldwide in the first half of 2026, with damage scale in the second quarter increasing approximately 48% year-on-year. The report also includes analysis that attack targets are spreading from individual companies to 'shared infrastructure' used by multiple firms.

Recent attack patterns are characterized by a growing tendency to exploit security vulnerabilities in VPNs, business platforms, and management systems, or use compromised accounts as initial intrusion vectors rather than directly distributing malware. After accessing systems essential to business operations, attackers expand their scope by escalating privileges and stealing data from within.

The Qilin ransomware group exploited VPN vulnerabilities to attack a global automaker and a UK medical testing service company. The report analyzes that the ShinyHunters and Cllop groups also targeted business platforms and management systems used by multiple organizations. Domestically, cases have been confirmed where multiple companies were attacked simultaneously through Managed Service Providers (MSPs).

Kim Byung-moo, Head of the Cyber Business Division at SK Shielders (Executive Vice President), stated, "Since a single vulnerability or account breach can lead to cascading damage, companies must proactively inspect their external exposure assets and account management systems, and enhance real-time detection and response capabilities to secure cyber resilience."