Security News > 2021 > May > CISA Analyzes FiveHands Ransomware

The U.S. Cybersecurity and Infrastructure Security Agency has published an analysis of the FiveHands ransomware, roughly one week after FireEye's Mandiant security researchers reported seeing the malware in recent attacks.

Written in C++, the FiveHands ransomware appears to be the successor of DeathRansom, based on code similarities between the two.

This week, CISA revealed that it received a total of 18 malicious files associated with a FiveHands attack, including eight open-source penetration testing and exploitation tools, the ransomware itself, and nine files associated with the SombRAT remote access Trojan.

A security flaw in a virtual private network product was exploited as the initial attack vector, with publicly available tools then used for network discovery and the ransomware executed at a later stage of the attack.

In its malware analysis report and accompanying analysis report, CISA provides not only detailed technical information on the malware itself, but also recommendations on how organizations can mitigate similar attacks.

Last week, the Institute for Security and Technology published a set of 48 recommendations to combat ransomware, roughly two months after the National Cyber Investigative Joint Task Force published a joint-sealed ransomware factsheet that contains information on attack techniques and prevention methods.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/jdLBBt1oJNs/cisa-analyzes-fivehands-ransomware