Why Malaysia's ransomware cases start on a home PC

Several Malaysian organisations — a water utility, a jewellery retailer, a mall, a manufacturer — appeared on ransomware leak sites this month. Each listing is a claim by a criminal group, not a confirmed finding; most of the companies named have said nothing publicly. But the pattern behind them is worth understanding, because the way in is usually boring.

The chain is almost always the same

1. A person, not a firewall. Someone on a work laptop installs a cracked program, or clicks a fake installer.
2. An infostealer runs quietly. It copies saved passwords and browser session cookies, and uploads them.
3. The credentials are sold. They appear in logs that threat-intelligence firms then index — the same logs that precede most ransomware claims.
4. The attacker logs in normally. No exploit, no alarm: a valid username and password, sometimes through the company VPN.
5. Encryption, then a demand. Data is copied out first, then locked.

Security researchers tracking these cases repeatedly point to stolen credentials showing up weeks before the ransom note. That is the part a home user can actually interrupt.

Why "home" matters

Work no longer stops at an office door. The laptop that joined a corporate VPN this morning also browsed on a home network last night, and probably shares that network with a phone, a smart TV and a router that has never had its firmware updated.

Three habits do most of the damage:

• Reused passwords. One leak from a forum in 2019 still unlocks an account in 2026.
• Passwords saved in the browser, with no master password. Anyone with access to the machine — or to the malware running on it — reads them in plain text.
• Cracked software. The "free" version of an expensive program is the most common delivery vehicle for infostealers.

What to do tonight, in order

1. Install a password manager and set one strong master password. Then change the three accounts that matter: email, bank, work. One password per account, not one password everywhere.
2. Turn on two-factor authentication on those same three. Prefer an authenticator app over SMS.
3. Delete cracked software. If a program was "activated" by a patch, assume the machine is compromised and change passwords from a different device.
4. Check what is already exposed. Search your email on a breach-notification service; if it appears, change that password.
5. Update the router firmware and change its admin password from the default. A router is a computer, and it is the one most people never patch.

If you run a small business

The same list, plus three things: multi-factor on the VPN and email, an offline backup you have actually restored from once, and a rule that finance staff do not approve payment changes from an email alone.

Most breaches are not clever. They are a password someone reused, on a machine someone else could reach.