FiveHands Ransomware Steals and Encrypts Files, Threatens to Leak them Online
The FiveHands Ransomware is a file-encryption Trojan, which is far different from the regular file-lockers users have to deal with. Typically, ransomware attacks are rather chaotic, and their perpetrators focus on quantity over quality. Sometimes, however, more advanced threat actors go after a specific set of victims that is far more likely to consider paying the ransom fee. This is the case of the newly identified FiveHands Ransomware. This threat shares similarities with the DeathRansom and HelloKitty Ransomware families, but researchers are unable to tell for sure whether the same group is behind all of these ransomware families.
Another interesting fact about the FiveHands Ransomware is the infection vector it uses. Instead of relying on phishing emails, the perpetrators exploited a zero-day vulnerability in SonicWall SMA 100 Series VPN hardware. The security hole was patched in February, but clients who have not yet applied the update are at risk of having their system's security compromised. The vulnerability in question allows attackers to execute arbitrary code, which could enable them to manually plant malware on compromised systems. It is important to note that the FiveHands Ransomware was usually the last threat to be dropped – beforehand, the criminals relied on the Cobalt Strike beacon, as well as the SombRAT Trojan.
Just like typical ransomware attacks, this one also ends up with a message for the victim. The note says that users need to use the embedded message client to chat with the attackers and find out how to recover their data. The criminals not only threaten to purge the decryption key, but they also warn their victims that their data may be published online if they do not agree to pay.
Unfortunately, FiveHands Ransomware's encryption is not flawed, and free decryption is not an option – restoring from a backup is the best way to undo the damage. Campaigns like this one are a good reminder of why both system administrators and home users should make sure to keep all of their software up-to-date.
