As Kaspersky revealed that it detected approximately 6.5 million web-based cyber threats and 9.19 million local threats in Korea last year, the need to manage not only online access environments but also the possibility of offline infection via removable storage media has been highlighted once again. Analysis suggests that threat pathways are diversifying, with intrusion through browsers and spread through physical media occurring simultaneously.

Kaspersky released the '2025 Cyber Threat Status in Korea' report in Seoul on April 6. This report was compiled based on domestic data collected from January to December 2025 through the Kaspersky Security Network (KSN). KSN is a cloud-based system that analyzes threat information collected from personal and enterprise security products.

According to the report, web browsers remained a major channel for malware distribution. Web-based threats detected on the computers of KSN participants in Korea totaled 6,509,471, and it was found that 17.5% of all users were exposed to related threats. Korea ranked 129th in the world based on web surfing risk.

Representative web attack methods cited included drive-by downloads, where malware is installed simply by visiting an infected website, and social engineering, which involves disguising itself as a legitimate program to trick users into downloading malicious files. In particular, fileless malware, which remains in the system via the registry or WMI subscriptions without leaving files on the disk, was presented as a type that is difficult to detect using traditional static analysis alone. The company explained that cases of evading analysis and detection through code obfuscation are also increasing recently.

Local threats were also significant. It was found that 9,194,755 cases of local threats, including malware spread through removable media such as USBs, CDs, and DVDs, were detected in Korea last year, exposing 30.9% of all users. Korea ranked 75th globally in terms of exposure to local threats. The report pointed out that these threats require separate management, as they can infiltrate organizations in the form of worms or file viruses even in environments with limited internet connectivity.

Accordingly, it is pointed out that response methods need to go beyond simple malware blocking. Kaspersky explained that machine learning-based detection and behavioral analysis to identify unknown malicious activities, as well as exploit prevention technologies to block the exploitation of vulnerabilities, are crucial. It added that for local threats, a multi-layered security system including firewalls, anti-rootkits, and removable device control is necessary in addition to antivirus software.

Lee Hyo-eun, Country Manager of Kaspersky Korea, stated that in environments with high digital usage like Korea, web-based attacks and mobile media-based threats can occur together, and that security strategies capable of responding to different intrusion methods must be in place.