Sunday, May 19, 2024

New “Prestige” Ransomware Uses Remote Execution Utilities to Launch Destructive Attacks

Microsoft Threat Intelligence Center (MSTIC) found a new ransomware named “Prestige” ransomware targeting organizations in the transportation and associated logistics industries in Ukraine and Poland.

Researchers say this novel ransomware campaign was first deployed on October 11 in attacks occurring within an hour of each other across all victims.

Important Features of Prestige Ransomware

In this case, attackers’ were seen deploying the ransomware payloads across their victims’ enterprise networks which is not common in Ukraine.

“The activity shares victimology with recent Russian state-aligned activity, specifically on affected geographies and countries, and overlaps with previous victims of the FoxBlade malware (also known as HermeticWiper)”, says Microsoft 

MSTIC has not connected this campaign to any known threat group and the investigations are still going on. This activity included the use of the following two remote execution utilities:

  • RemoteExec – a commercially available tool for agentless remote code execution
  • Impacket WMIexec – an open-source script-based solution for remote code execution

Tools used for privilege escalation and credential extraction:

  • winPEAS – an open-source collection of scripts to perform privilege escalation on Windows
  • comsvcs.dll – used to dump the memory of the LSASS process and steal credentials
  • ntdsutil.exe – used to back up the Active Directory database, likely for later use credentials

Based on the observation, researchers say the attacker had already gained access to highly privileged credentials, like Domain Admin, to assist the ransomware deployment.

Methods Used For Ransomware Deployment

Method 1: 

In the first method, the ransomware payload is copied to the ADMIN$ share of a remote system and Impacket is used to remotely create a Windows Scheduled Task on target systems to execute the payload.

Method 2: 

Subsequently, in this method the ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely invoke an encoded PowerShell command on target systems to execute the payload

Method 3:

The ransomware payload is copied to an Active Directory Domain Controller and deployed to systems using the Default Domain Group Policy Object.

Researchers say “Prestige” ransomware works by encrypting a victims’ data and leaving a ransom note that says the data can only be unlocked with the purchase of a decryption tool.

Customers Should Act On These Alerts

  • Ongoing hands-on-keyboard attack via Impacket toolkit
  • WinPEAS tool detected
  • Sensitive credential memory read
  • Password hashes dumped from LSASS memory
  • Suspicious scheduled task activity
  • System recovery setting tampering
  • File backups were deleted

Also Read: Download Secure Web Filtering – Free E-book


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles