PonyFinal Is Another New Ransomware To Watch Out For

June 8, 2020

Written by wukovits

ponyfinal is another new ransomware to watch out forMicrosoft recently issued a security advisory about a new strain of ransomware that’s been cropping up with increasing frequency in India, Iran and the US.

Called PonyFinal, one of the things that differentiates this strain from the pack is that it’s deployed in what the company describes as human-operated ransomware attacks.

Most of the ransomware attacks we see are bot driven or highly automated affairs. Other than the initial kickoff, very little human intervention is required. This variant is different. Hackers breach a target network and then deploy the ransomware themselves, by hand.

Based on Microsoft’s research into the new strain, where it’s used and exactly how it is deployed, it seems that the hacker group behind the malware relies mostly on brute force attacks to guess weak passwords.

Once they gain a foothold, a member of the gang deploys a Visual Basic script that runs a PowerShell reverse shell to collect and exfiltrate local data. The hackers also utilize a remote manipulator system which allows them to bypass event logging, making their work that much more difficult to track.

After penetrating the network as deeply as they can and making off with the data they want, their last step is to actually deploy the ransomware, encrypt all the files on the infected systems, and demand payment.

It should be noted that although somewhat more rare than conventional ransomware, there are several different strains that rely on human-operated campaigns. While these are not as elegant and high tech as their more automated counterparts, they nonetheless pose a genuine threat and should not be taken lightly.

Unfortunately, guarding against these kinds of attacks is tricky. Conventional attacks that rely on an email recipient to click on a link or open a poisoned attachment can be shut down with better training and increased awareness. Here, the success or failure of the hackers is entirely dependent on how robust your network security is, and how sharp-eyed your IT folk are in terms of watching for suspicious network activity. If PonyFinal isn’t yet on your threat radar, it should be. Stay vigilant.

Used with permission from Article Aggregator

Bayou Tech

We provide solutions for your business. Find out how we can help.

Related Articles

Key Considerations for Effective Cybersecurity Implementation

Consider this: In the realm of cybersecurity, things often get tangled in the web of "you should do it anyway" arguments. Yet, for busy business owners bombarded with daily "must-dos," deciphering the essentials from the fluff can feel like a cyber maze. We aim to...

Unlocking Small Business Success: The Impact of AI in a Digital Era

In the rapidly evolving business landscape, staying competitive necessitates embracing technological advancements. Artificial Intelligence (AI), once perceived as a luxury for larger enterprises, is now accessible to small businesses, offering new opportunities for...