What is ransomware

Ransomware is malware that infiltrates a system, encrypts every file it can reach, and demands payment for the decryption key. Modern operations run double extortion: they steal the data before encrypting it, then threaten to publish it — so even victims with good backups face pressure to pay.

The 2026 picture

  • Data from Group-IB, Chainalysis and Check Point shows global attack volumes still rising in 2026, while the share of victims who pay has fallen to roughly 23% — organisations increasingly recover from backups instead.
  • Hundreds of confirmed attacks have been recorded worldwide in 2026 so far, with hospitals, factories, financial firms and under-defended SMEs the favourite targets.
  • In Thailand, breach incidents have become frequent enough that the regulator (PDPC) now issues real fines — organisations that leak customer data have been fined millions of baht.

A real Thai case: 3BB

In September 2026, threat-intelligence firm Hunt.io disclosed that it had found an attacker's server operating live inside the network of 3BB, one of Thailand's largest broadband providers. The intruder used MeshCentral — a legitimate remote-management tool — as a backdoor for remote control of internal machines. The primary target was 3BB's RADIUS databases, which store the credentials subscribers use to get online: recovered scripts were built specifically to copy those databases out (the evidence shows they were targeted, not that data was confirmed stolen). Researchers assess the likely entry point was an unpatched FortiGate SSL-VPN vulnerability (CVE-2024-21762), and notified the affected companies and national response team before publishing.

How attackers get in

  • Unpatched vulnerabilities — especially internet-facing VPNs/firewalls, as in the 3BB FortiGate case.
  • Phishing — emails tricking staff into entering credentials or opening attachments; still the world's #1 entry point.
  • Leaked or reused passwords — one leak unlocks every system that shares the password.
  • Public RDP/SSH — remote ports without MFA are scanned and brute-forced around the clock.
  • Living off the land — abusing legitimate tools like MeshCentral or AnyDesk so monitoring sees “normal” activity.

An 8-point protection plan

  1. 1Patch OS, VPN, firewall and all software within 48 hours of critical security updates.
  2. 2Enforce MFA on every external entry point — VPN, email, server control panels.
  3. 3Back up on the 3-2-1 rule: three copies, two media types, one offline/immutable copy — and test restores quarterly.
  4. 4Segment the network — accounting, databases and staff machines should not all see each other.
  5. 5Apply least privilege — nobody uses admin/root as their daily account.
  6. 6Close unused ports, switch SSH to key-based auth, and IP-restrict management ports.
  7. 7Monitor and log with alerts for anomalies — overnight logins, mass file copies.
  8. 8Run phishing training twice a year with real simulated campaigns.

If you get hit

  1. 1Disconnect infected machines from the network immediately (pull cable/Wi-Fi) but do not power off — preserve evidence.
  2. 2Notify your IT team/infrastructure provider and rotate critical credentials from a clean machine.
  3. 3Scope the damage: which systems, and did personal data leak? If so, PDPA requires notifying the PDPC within 72 hours.
  4. 4Restore from clean backups — only after confirming the backdoor is eradicated.
  5. 5Paying the ransom is not recommended — statistics show incomplete recovery and repeat targeting of payers.

Sources