Microsoft warns of ‘Prestige’ ransomware targeting business in Ukraine, Poland

Microsoft has warned of a new strain of ransomware, acknowledged as ‘Prestige’, that appears to be functioning independently of recognised teams to focus on organisations throughout Ukraine and Poland.

Microsoft Risk Intelligence Centre (MSTIC) initially recognized the novel ransomware on October 11, in attacks on businesses within the transportation and logistics market, all having spot inside an hour of each individual other. In its ransom notes, the malware is merely identified as ‘Prestige ranusomware[sic].’

Compared with other ransomware strategies targeting Ukrainian authorities and community expert services, Status appears to be only directed in the direction of businesses The threat actor at the rear of the ransomware has not yet been discovered, but Microsoft have mentioned similarities concerning its operations and individuals of Russian state-sponsored risk actors, together with a shared pool of victims with the HermeticWiper malware strain.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Specific attack vectors for Status are being investigated, but in all situations observed in the wild hence significantly, its operators currently had privileged credentials inside of their victim’s network.

Across the attacks, a few unique methodologies were being applied to deploy Prestige. In the 1st, its payload was copied to the ADMIN$ share of a method and remotely executed through a Windows Scheduled Process using Impacket.

The 2nd was mainly identical help save for the use of a PowerShell command to execute the payload, with the 3rd looking at the payload copied to an Energetic Listing Domain Controller, which then immediately deployed the ransomware to related methods.

“It appears that the destructive actors have included the bodily offer chain to their targets, quite possibly signalling that immediate cyber-attacks aimed at the Ukrainian and Polish critical infrastructure have failed,” said Avishai Avivi, CISO at SafeBreach.

Like numerous other strains of malware, Status takes advantage of highly developed encryption conventional (AES) encryption to obfuscate the data files of its victims, affecting all information ending in any file extension contained within a really hard-coded listing. Nevertheless, it also differs from modern exotic malware strains created in the programming language Rust, or Go, as Prestige takes advantage of the far more traditional C++, specifically the absolutely free cryptography library CryptoPP.

In its site post on the discovery, Microsoft released a hardcoded RSA X509 general public essential utilised to encrypt each and every of the afflicted data files. It is probably that each individual edition of Status will come with its have unique essential, but this has not but been verified.

In advance of encryption, Prestige leverages manage above the victim’s System32 directory to delete the features involved with file redirection. It then deletes the system’s backup catalogue and all the volume shadow copies, which are backups and snapshots of information on a method that Windows automatically generates to safeguard details.

As is the case with most ransomware, a text file is then developed on the victim’s product at path C:UsersPublicREADME, made up of a warning not to attempt to recuperate misplaced knowledge and recommendations on how to fork out the threat actors for documents to be returned. All encrypted info is appended with the extension ‘.enc’, which is registered beneath a customized file extension handler so that if any file is opened, the ransom take note is instead opened. Tailor made file extensions have also been applied in ransomware these types of as Gwisin, which has been uncovered attacking pharmaceutical corporations in South Korea.

MSTIC has encouraged organisations to adhere to finest practice towards ransomware, assure excellent use of multi-factor authentication (MFA), and to watch out for a sequence of indicators of compromise (IoCs) inside of network environments. The not known id or ambitions of the strain, which has not been aligned with any of MSTIC’s 94 tracked teams within just the area, make it 1 of unique issue.