Microsoft recently issued a security advisory about a new strain of ransomware that’s been cropping up with increasing frequency in India, Iran, and the US.
Called PonyFinal, one of the things that differentiate this strain from the pack is that it’s deployed in what the company describes as human-operated ransomware attacks.
Most of the ransomware attacks we see are bot-driven or highly automated affairs. Other than the initial kickoff, very little human intervention is required. This variant is different. Hackers breach a target network and then deploy the ransomware themselves, by hand.
Based on Microsoft’s research into the new strain, where it’s used and exactly how it is deployed, it seems that the hacker group behind the malware relies mostly on brute force attacks to guess weak passwords.
Once they gain a foothold, a member of the gang deploys a Visual Basic script that runs a PowerShell reverse shell to collect and exfiltrate local data. The hackers also utilize a remote manipulator system which allows them to bypass event logging, making their work that much more difficult to track.
After penetrating the network as deeply as they can and making off with the data they want, their last step is to deploy the ransomware, encrypt all the files on the infected systems, and demand payment.
It should be noted that although somewhat rarer than conventional ransomware, several different strains rely on human-operated campaigns. While these are not as elegant and high tech as their more automated counterparts, they nonetheless pose a genuine threat and should not be taken lightly.
Unfortunately, guarding against these kinds of attacks is tricky. Conventional attacks that rely on an email recipient to click on a link or open a poisoned attachment can be shut down with better training and increased awareness. Here, the success or failure of the hackers is entirely dependent on how robust your network security is, and how sharp-eyed your IT folk are in terms of watching for suspicious network activity. If PonyFinal isn’t yet on your threat radar, it should be. Stay vigilant.
