Ransomware Guide for Korean SMEs: Prevention, Response, and Recovery

South Korea recorded 56 ransomware attacks in 2025 — the highest number in five years. 93% of victims were small and medium enterprises. While large corporations have dedicated security teams, SMEs are easy targets due to limited resources.

Key Stats (2025)

Metric	Number
Annual attacks	56 (5-year high)
SME victims	93%
Average downtime	16 days
Recovery rate after payment	~65%

Attack Vectors

Vector	Share
Email attachments	35%
Remote Desktop (RDP)	25%
Software vulnerabilities	20%
Supply chain	10%
Other (USB, websites)	10%

Prevention: 3-2-1 Backup Rule

• 3 copies of your data
• 2 different storage types (NAS + external drive)
• 1 offline copy (air-gapped from network)

Security Basics Checklist

• Update all software to latest versions
• Disable RDP or move behind VPN
• Strengthen admin passwords (12+ characters)
• Enable multi-factor authentication (MFA)
• Train employees on phishing recognition
• Install antivirus with real-time monitoring

KISIA Free Protection Program

KISA provides free security services to 41 SMEs: vulnerability assessments, ransomware response solutions, and security training. Apply at boho.or.kr.

During an Attack

Never Do This

Don't	Why
Pay the ransom	No guarantee; makes you a repeat target
Keep working on infected PC	Spreads encryption
Delete encrypted files	Blocks future decryption

Immediate Actions

1. Disconnect from network — unplug LAN, disable Wi-Fi
2. Report to KISA 118
3. Preserve evidence — screenshot ransom notes
4. Verify offline backups
5. Contact security professionals

Recovery: No More Ransom

nomoreransom.org offers free decryption tools. Use "Crypto Sheriff" to identify your ransomware type. Never delete encrypted files — a decryptor may become available later.

Sharing Backup Credentials Safely

SMEs need to share backup admin passwords among team members. Sending via iMessage or email risks exposure.

Use LOCK.PUB to create password-protected links:

1. Write backup credentials as a secure memo
2. Set access password + expiration time
3. Share the link with authorized personnel
4. Send the password via phone call

Auto-deletes after expiration — no sensitive data left in chat history.

Summary

Phase	Key Actions
Prevention	3-2-1 backup, updates, MFA, KISIA
During attack	Disconnect, KISA 118, never pay
Recovery	nomoreransom.org, restore from backup
Credentials	LOCK.PUB for safe sharing

Prevention is the best defense. Never pay the ransom.