Microsoft Finds New Prestige Ransomware Targeting Polish and Ukrainian Businesses
Microsoft has recently discovered a new ransomware campaign that’s targeting organizations within the transportation and logistics industries across Poland and Ukraine. The novel Prestige ransomware strain was first found on October 11, and the attackers targeted a wide range of systems within an hour.
The Microsoft Threat Intelligence Center (MSTIC) explained that it has been unable to track the hacking group behind the ransomware attacks. The security researchers observed that the ransomware campaign is similar to previous attacks by Russian state-backed threat actors that impacted Ukraine government agencies. However, the Prestige ransomware is explicitly targeting the networks of Ukrainian enterprises.
Microsoft is tracking the ransomware campaign as DEV-0960, a term used for previously unidentified threat actors. The hacking group abused several publicly available tools for remote-code execution to steal highly privileged administrator credentials within the victim’s network.
Specifically, the attackers used three different methods to obtain privileged access to the compromised environment to deploy the Prestige payload. Once deployed, the operators dropped a ransom note called “README.txt” in the root directory of each encrypted drive on the target device.
“For this DEV-0960 activity, the methods used to deploy the ransomware varied across the victim environments, but it does not appear to be due to security configurations preventing the attacker from using the same techniques. This is especially notable as the ransomware deployments all occurred within one hour,” the Microsoft Threat Intelligence Center explained.
Microsoft details indicators of compromise to detect the Prestige ransomware
Microsoft suggests that organizations should follow the best security practices to prevent ransomware attacks. The company advises customers to set up multi-factor authentication (MFA), tamper protection, and cloud-based protection in Microsoft Defender.
Moreover, Microsoft has advised IT admins to look for a series of indicators of compromise (IoCs) within enterprise networks, and you can find more details in Microsoft’s blog post.
More in Security
Microsoft Defender Vulnerability Management Now Supports Firmware Assessments
Nov 29, 2022 | Rabia Noureen
Microsoft Entra Workload Identities Service is Now Generally Available
Nov 29, 2022 | Rabia Noureen
Microsoft Authenticator to Enable Number Matching Security Feature by Default in February 2023
Nov 21, 2022 | Rabia Noureen
Microsoft Defender for Endpoint Adds Network Protection on iOS and Android
Nov 11, 2022 | Rabia Noureen
What is a Software-Defined Perimeter?￼
Nov 11, 2022 | Sukesh Mudrakola
Microsoft Defender for Business Adds Server Protections for SMBs
Nov 10, 2022 | Rabia Noureen
Most popular on petri