New Prestige Ransomware Targeting Polish and Ukrainian Organizations

The Prestige ransomware first appeared in the threat landscape on October 11 in attacks occurring within an hour of each other across all victims.

A notable feature of this campaign is that it is uncommon to observe threat actors attempting to deploy ransomware into the networks of Ukrainian enterprises.

Microsoft noticed that this campaign is distinct from recent destructive attacks leveraging AprilAxe (ArguePatch) or Foxblade (HermeticWiper) that hit several critical infrastructure organizations in Ukraine over the last two weeks.

MSTIC has not yet attributed the attacks to a known threat group, meantime, it is tracking the campaign as DEV-0960.

Before deploying ransomware in the target networks, the threat actors were observed using the following two remote execution utilities:

• RemoteExec – a commercially available tool for agentless remote code execution
• Impacket WMIexec – an open-source script-based solution for remote code execution

MSTIC researchers observed the threat actors using three methods to deploy the Prestige ransomware:

• Method 1: The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely create a Windows Scheduled Task on target systems to execute the payload
• Method 2: The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely invoke an encoded PowerShell command on target systems to execute the payload
• Method 3: The ransomware payload is copied to an Active Directory Domain Controller and deployed to systems using the Default Domain Group Policy Object

Once deployed, the Prestige ransomware drops a ransom note named “README.txt” in the root directory of each drive it encrypts.

Prestige uses the CryptoPP C++ library to AES-encrypt each eligible file, to prevent data recovery the ransomware deletes the backup catalog from the system.

IOCS

Follow Us on: Twitter, Instagram, Facebook to get the latest security news!