The Underground Ransomware Gang Is Back with a Vicious New Global Campaign

The Underground ransomware gang is intensifying its operations, launching continuous attacks against companies worldwide, including high‑profile victims in South Korea, as highlighted in a new analysis dated 27 August 2025.

According to AhnLab, the group’s victim pool spans multinational corporations in the United Arab Emirates, the United States, France, Spain, Australia, Germany, Slovakia, Taiwan, Singapore, Canada, and Korea, with industries from construction and manufacturing to IT and interior design and company revenues ranging from $20 million to $650 million.

The malware employs a sophisticated multi‑layered encryption process, with a unique AES key for each file and RSA‑encrypted information appended to the file, while no network communication occurs after encryption. AhnLab notes that threat actors conduct thorough reconnaissance to select a specific PC and distribute modified ransomware tailored to the target, indicating surgical, customised attacks rather than broad spam campaigns.

After encryption, the malware deletes system event logs and can restrict remote desktop connections, aiming to maximise damage and hinder incident response.