Ukraine, Poland hit by new Ransomware cyberattack from New Hacking Group, Microsoft says

A newly discovered hacker group has attacked transport and logistics companies in Ukraine and Poland with a new type of ransomware, Microsoft said in a blog post on Friday.

The attackers targeted a wide range of systems within an hour on Tuesday, Microsoft said, adding that it had not yet been able to link the attacks to a known group.

It should be noted, however, that the researchers found that the hacks closely mirrored earlier attacks by a cyber outfit linked to the Russian government that breached Ukraine’s government agencies.

Ukraine has been the target of numerous cyberattacks by Russia since the conflict began in late February, according to Western security researchers and senior government officials.

The Russian embassy in Washington did not immediately respond to a request for comment, nor did the cybersecurity agencies of Ukraine or Poland.

The victims of the new ransomware, dubbed “Prestige,” overlap with those of another data-shredding cyberattack that includes the “FoxLoad” or “HermeticWiper” malware, Microsoft said.

This attack hit hundreds of computers in Ukraine, Lithuania and Latvia at the beginning of the Russian invasion of Ukraine.

The “Prestige” ransomware works by encrypting victims’ data and leaving a ransom note saying the data can only be unlocked with the purchase of a decryption tool, Microsoft said.

In several cases, the researchers noted that the hackers gained administrative control over the victims’ systems before deploying the ransomware, suggesting that they had stolen their credentials earlier and were waiting for the right moment.

“Enterprise-wide ransomware deployments are not common in Ukraine, and this activity is not linked to any of the 94 currently active ransomware groups that Microsoft tracks,” the researchers said.

© Thomson Reuters 2022