AttackSystem Ransomware Targets Large Entities

During our investigation of newly submitted programs to the VirusTotal website, our research team uncovered a ransomware-type program called AttackSystem that belongs to the MedusaLocker ransomware family. We tested this program on our machine and found that it encrypts data and appends a ".attacksystem" extension to the affected filenames. Additionally, AttackSystem creates a ransom note titled "How_to_back_files.html" that indicates the ransomware targets larger entities rather than home users.

The ransom note informs the victim that their company network has been compromised, resulting in the encryption of inaccessible files and the theft of confidential or personal data. The attackers warn that any attempts to modify or recover the encrypted files using third-party tools will lead to permanent data corruption. The only way to decrypt the locked files is to pay a ransom that will increase in size if the victim delays contacting the attackers for more than 72 hours. The note also offers to decrypt up to three non-important files as proof that data recovery is possible. If the victim refuses to pay, the message threatens to leak or sell their sensitive information.

AttackSystem Ransom Note is Usual MedusaLocker Fare

The full text of the AttackSystem ransom note reads as follows:

YOUR PERSONAL ID:

YOUR COMPANY NETWORK HAS BEEN PENETRATED
All your important files have been encrypted!

Your files are safe! Only modified. (RSA+AES)

ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.

No software available on internet can help you. We are the only ones able to
solve your problem.

We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..

We only seek money and our goal is not to damage your reputation or prevent
your business from running.

You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.

Contact us for price and get decryption software.

email:
uncrypt-official@outlook.com
uncryptofficial@yahoo.com

• To contact us, create a new free email account on the site: protonmail.com
  IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

What Attack Vectors Can Ransomware Use?

Ransomware can use a variety of attack vectors to infect a system or network. One common method is through email phishing scams, where attackers trick users into downloading or executing malicious attachments or links that infect their system with ransomware. Another method is through the exploitation of vulnerabilities in software, operating systems, or network devices.

Ransomware can also spread through infected websites, malicious advertisements, and social engineering tactics. Additionally, ransomware can be delivered through a supply chain attack, where attackers target and infect a trusted vendor or supplier and spread their malware to other organizations that use their products or services. Overall, it is essential to implement strong security measures, including software updates, regular backups, and user training, to protect against ransomware attacks.