Threat-Trend-Report-on-Region-Specific-Ransomware.pdf (10 MB)

ASEC's trend report explains how ransomware operators tailor activity to specific regions to maximize profit and reduce pressure from local law enforcement. It distinguishes criminal ransomware gangs and RaaS affiliates, including initial access brokers, from individuals and some state-supported groups that may use destructive wipers disguised as ransomware. The source says localized ransomware activity is visible but not yet mainstream, and it does not attribute the trend to a DPRK actor.