AnswersPublished20 sources
Kaspersky’s Q1 2026 ransomware rates for Southeast Asian SMBs
Kaspersky’s figures show ransomware targeting rose from 2.92% to 3.51% of SMBs in Southeast Asia between Q1 2025 and Q1 2026. Clop led Kaspersky’s Q1 2026 ransomware group ranking at 14.42% of victims listed on dedicated leak sites, followed by Qilin at 12.34%.[15]
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Kaspersky’s figures show ransomware targeting rose from 2.92% to 3.51% of SMBs in Southeast Asia between Q1 2025 and Q1 2026.
- Clop led Kaspersky’s Q1 2026 ransomware group ranking at 14.42% of victims listed on dedicated leak sites, followed by Qilin at 12.34%.[15]
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did Kaspersky’s Q1 2026 reports reveal about year-on-year changes in the proportion of SMBs targeted by ransomware in Singapore, Southe. Article summary: Kaspersky’s Q1 2026 findings showed a year-on-year increase in the proportion of Southeast Asian SMBs targeted by ransomware, while Singapore retained the lowest rate among the Southeast Asian markets tracked.[12][16] Ho. Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
Kaspersky’s Q1 2026 figures show that the share of small and medium-sized businesses (SMBs) targeted by ransomware increased across Southeast Asia compared with the same quarter a year earlier. The regional rate reached 3.51%, up from 2.92%; Singapore remained the lowest-rate market among the seven Southeast Asian markets tracked.5
9
Year-on-year rates by market
The figures below compare Q1 2025 with Q1 2026. Percentage-point changes are calculated from the reported rates.
| Market | Q1 2025 | Q1 2026 | Change |
|---|---|---|---|
| Southeast Asia overall | 2.92% | 3.51% | +0.59 percentage points |
| Singapore | 0.57% | 0.69% | +0.12 percentage points |
| Malaysia | 2.09% | 2.74% | +0.65 percentage points |
| Indonesia | 2.83% | 4.01% | +1.18 percentage points |
| Vietnam | 2.91% | 2.56% | −0.35 percentage points |
| India, comparison market | 3.18% | 4.07% | +0.89 percentage points |
| Philippines | Exact rates not available in the cited excerpts | Exact rates not available in the cited excerpts | Reported as a year-on-year decline |
| Thailand | Exact rates not available in the cited excerpts | Exact rates not available in the cited excerpts | Reported as a year-on-year decline |
Singapore’s rate increased, but it was still the lowest among the Southeast Asian markets covered by the report.9 Indonesia had the largest increase among the listed markets with exact paired rates: 2.83% to 4.01%.
3
4 Vietnam moved in the opposite direction, falling from 2.91% to 2.56%.
8 The available excerpt reports declines for the Philippines and Thailand but does not provide their exact rates.
12
How to read the figures
These percentages describe the proportion of SMBs targeted within Kaspersky’s ecosystem, not the total number of ransomware incidents in each country.5
6 They are therefore best read as comparative rates from Kaspersky’s data, rather than a complete count of attacks across all businesses.
Ransomware groups: a separate measure
Kaspersky’s Q1 2026 report ranked Clop first, accounting for 14.42% of victims published on dedicated leak sites; Qilin followed at 12.34%.15 Those shares describe groups’ presence among leak-site victims, not the percentage of SMBs targeted in the country table above.
Kaspersky research also described custom tools used by The Gentlemen, including a backdoor designed to gather information before ransomware deployment and maintain control over compromised systems.39 The cited material does not establish the group’s precise ranking in the Q1 2026 list or confirm suspected use of Initial Access Brokers.
What the available evidence does not establish
The cited excerpts do not specify which attack stages Kaspersky excludes from its ransomware-detection statistics. They also do not verify Fedor Sinitsyn’s specific explanation of backup limitations against double extortion or Adrian Hia’s precise advice for SMBs with limited cybersecurity teams and patch-management capacity. Those details should not be inferred from the rate comparisons or the group rankings.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Kaspersky’s Q1 2026 ransomware rates for Southeast Asian SMBs"?
Kaspersky’s figures show ransomware targeting rose from 2.92% to 3.51% of SMBs in Southeast Asia between Q1 2025 and Q1 2026.
What are the key points to validate first?
Kaspersky’s figures show ransomware targeting rose from 2.92% to 3.51% of SMBs in Southeast Asia between Q1 2025 and Q1 2026. Clop led Kaspersky’s Q1 2026 ransomware group ranking at 14.42% of victims listed on dedicated leak sites, followed by Qilin at 12.34%.[15]