Ransomware Ransomware as a distraction HermeticRansom cryptor was used as a distraction to support HermeticWiper attacks. Editorial Team March 1, 2022 Our researchers analyzed the HermeticRansom malware also known as Elections GoRansom. By and large, this is a fairly simple cryptor. What is interesting in this case is the purpose for which attackers are using it. HermeticRansom goals HermeticRansom attacked computers at the same time as another malware known as HermeticWiper, and based on publicly available information from security community, it was used in recent cyberattacks in Ukraine. According to our experts, the relative simplicity and questionable malware workflow implementation suggests that HermeticRansom was used as a smokescreen for HermeticWiper attacks. What HermeticRansom is capable of Once infecting the victim’s computer, the malware first identifies hard drives and collects a list of directories and files located everywhere except for the Windows and Program Files folders. It then encrypts certain categories of files and renames them adding а .encrypted tag and the email address of the ransomware operators. The malware also creates a read_me.html file in the Desktop folder containing a ransom note with the attackers’ contacts. The note looks like this: Ransom note left by HermeticRansom malware HermeticRansom encrypts files with following extensions: .inf, .acl, .avi, .bat, .bmp, .cab, .cfg, .chm, .cmd, .com, .crt, .css, .dat, .dip, .dll, .doc, .dot, .exe, .gif, .htm, .ico, .iso, .jpg, .mp3, .msi and odt. HermeticRansom peculiarities HermeticRansom is written in Golang. It does not use any obfuscation mechanisms, and the encryption method itself is rather cumbersome and inefficient. Judging by these and some other signs, our experts think that this malware was created in a hurry. You can find a more detailed technical analysis of the malware along with indicators of compromise on our Securelist blog. How to stay safe Kaspersky Lab security solutions successfully detect HermeticRansom malware and similar threats. We have a range of tools to protect both home computers and corporate infrastructure, including: Kaspersky Internet Security: our multi-platform security solution for home users; Kaspersky Endpoint Security Cloud: our solution for business protection; Kaspersky Anti-Ransomware Tool: our free corporate solution that can work as an additional layer of protection in parallel with products from other vendors.
Read next Password reset notification scam Anti-phishing lessons: what company employees should know about fake notifications about account security.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.