Sunday, June 16, 2024

HERMES Ransomware Spreading Through Password Protected Word Documents and XPS

A new Email campaign spotted by Trustwave spreading HERMES Ransomware through password protected word document to encrypt the system files and lock the victim’s computer. Hermes Ransomware distributed in wild nowadays with newly updated features and targets various countries.

The attachment named “Invoice.doc” contains the password protected macro if the user has security setting is Low then the macro will be launched automatically.

HERMES Ransomware 2.1

Once the macro is triggered it downloads a file from the Command and control server[hxxp://209[.]141[.]59[.]124/azo.exe] and the downloaded file save to temp folder and executed. The [azo.exe] downloads the final payload which is the HERMES 2.1 Ransomware.

HERMES Ransomware 2.1

Hermes doesn’t append its own file extension as like any other ransomware it used symmetric algorithm AES to encrypt files and RSA to protect AES key. Once the infection completed it launches DECRYPT_INFORMATION.html which shows the ransom note.

Ransom note indicates that the victim’s files are encrypted using an RSA2048 algorithm and asks victim’s to pay through Bitcoin or other cryptocurrencies. Also, attackers added “you can decrypt one file for free” to make victims believe they can decrypt the files.

Trustwave also spotted the same email sample contains attachment as XPS file “invoice.xps” and it has FixedPage.NavigateUri property which directs users to “hxxp://rainbowrealty[.]com/ads/herewego.html” when it was clicked. The page appears to be removed now and it doesn’t exist.

Unfortunately, the decrypter tool is available only for variants of Hermes 1.0 and it is not available for Hermes 2.x variants. The best options are to restore data from the backups.

Also Read

Cyber Criminals Launch Hermes Ransomware Via Password Protected Word Documents

Hermes Ransomware Distributed Through Malicious Office Documents Embedded Flash Exploit

Ryuk Ransomware Attack on various Enterprise Network Around the World & Earned $640,000

Website

Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles