THAILAND – Thai businesses were being singled out by highly targeted ransomware campaigns in 2025, security researchers warned, even as overall infection rates remained low.
Targeted attacks replacing mass infections
Kaspersky reported that just 0.19% of its enterprise users in Thailand were hit by ransomware in the first half of 2025, compared with 0.25% across Southeast Asia. On the surface the figures appeared small, but researchers said they masked a worrying shift in criminal tactics.
Adrian Hia, Managing Director for Asia-Pacific at Kaspersky, said the low share of affected users reflected a broader change in how ransomware operators were working. “Thailand’s small proportion of users hit by ransomware mirrors a global shift in ransomware tactics. Cybercriminals are focusing on highly targeted, precision campaigns against valuable organisations,” he said.
Rather than relying on broad mass-infection methods, attackers had been selecting profitable corporate targets and tailoring their campaigns to maximise disruption and ransom demands.
The most dangerous ransomware families
Kaspersky identified five ransomware families it considered the most active and dangerous in Southeast Asia and threatening to Thai firms:
– Trojan-Ransom.Win32.Wanna – noted for rapid spread
– Trojan-Ransom.Win32.Gen – a flexible and adaptable strain
– Trojan-Ransom.Win32.Crypmod – specialises in encrypting data
– Trojan-Ransom.Win32.Crypren – known for complex encryption routines
– Trojan-Ransom.Win32.Encoder – systematically encrypts files
These trojans were described as modifying or encrypting files on compromised systems, rendering data unusable. Operators then demanded payment in exchange for a promise to restore access to the data.
Implications for Thailand’s digital ambitions
Security experts said the trend posed a direct risk to Thailand’s ambitions to become a regional digital hub. As the country expanded its digital infrastructure and encouraged more organisations online, those assets became more attractive to criminals seeking high-value victims.
Hia warned the evolution of attacks threatened the accelerated digital transformation that Thai authorities and companies had been pursuing. The consequence, he said, was that expanding digital systems could themselves create “more lucrative targets” for attackers unless defensive measures kept pace.
Past scale of the problem
Kaspersky’s telemetry showed the scale of ongoing attempts: in 2024 its solutions in Thailand blocked 13,958 ransomware attacks, an average of about 39 attempts per day. Researchers said the continued frequency of attempts underlined that the threat environment had not eased.
Recommended protections for firms
Kaspersky urged companies to adopt a layered approach to defence. Its recommendations included:
– Enabling ransomware protection on all endpoints, with a basic option available through the free Kaspersky Anti-Ransomware Tool for Business
– Keeping software up to date to close known vulnerabilities
– Maintaining offline, immutable backups so critical data could be restored without paying a ransom
– Deploying Anti-APT and Endpoint Detection and Response (EDR) solutions to detect sophisticated threats
– Using threat intelligence services to stay informed about current attack methods
Experts emphasised that these steps were complementary: backups reduce the leverage of attackers, while EDR and threat intelligence improve detection and response to intrusions.
Outlook for cybersecurity in Thailand
The persistent presence of ransomware and the trend toward precision attacks meant that simply relying on basic safeguards would no longer be sufficient, researchers said. Modern threat detection, rapid incident response capabilities and comprehensive risk management were becoming essential for business resilience.
Thailand’s progress toward a digital economy was being closely watched by cybercriminals, the report concluded, and only organisations that adopted robust, multi-layered security strategies were likely to withstand the evolving threat landscape.
Source: Kaspersky, reported by The Nation.