PonyFinal Is Another New Ransomware To Watch Out For


Microsoft recently issued a security advisory about a new strain of ransomware that’s been cropping up with increasing frequency in India, Iran and the US.

Called PonyFinal, one of the things that differentiates this strain from the pack is that it’s deployed in what the company describes as human-operated ransomware attacks.

Most of the ransomware attacks we see are bot driven or highly automated affairs. Other than the initial kickoff, very little human intervention is required. This variant is different. Hackers breach a target network and then deploy the ransomware themselves, by hand.

Based on Microsoft’s research into the new strain, where it’s used and exactly how it is deployed, it seems that the hacker group behind the malware relies mostly on brute force attacks to guess weak passwords.

Once they gain a foothold, a member of the gang deploys a Visual Basic script that runs a PowerShell reverse shell to collect and exfiltrate local data. The hackers also utilize a remote manipulator system which allows them to bypass event logging, making their work that much more difficult to track.

After penetrating the network as deeply as they can and making off with the data they want, their last step is to actually deploy the ransomware, encrypt all the files on the infected systems, and demand payment.

It should be noted that although somewhat more rare than conventional ransomware, there are several different strains that rely on human-operated campaigns. While these are not as elegant and high tech as their more automated counterparts, they nonetheless pose a genuine threat and should not be taken lightly.

Unfortunately, guarding against these kinds of attacks is tricky. Conventional attacks that rely on an email recipient to click on a link or open a poisoned attachment can be shut down with better training and increased awareness. Here, the success or failure of the hackers is entirely dependent on how robust your network security is, and how sharp-eyed your IT folk are in terms of watching for suspicious network activity. If PonyFinal isn’t yet on your threat radar, it should be. Stay vigilant.

Used with permission from Article Aggregator



Don’t even think about calling a computer consultant before you read this!

If you are a small to medium business owner looking for computer support, then it’s critical that you read this business guide about IT services: This Business Advisory Guide Will Arm You With 18 Revealing Questions You Should Ask Any Computer Consultant Before Giving Them Access To Your Company’s Network.

Important! We hate spam as much (or more!) than you and promise to NEVER rent, share, or abuse your e-mail address and contact information in any way.

“Be Your Own Best Defense Against Cybercrime”

Sign Me Up For The Free Assessment

Book My Brief 30 Minute Initial Consultation