Kaspersky's Global Emergency Response Team has identified a previously unseen ransomware strain in active use, deployed in an attack following the theft of employee credentials.
The ransomware, dubbed "Ymir", employs advanced stealth and encryption methods. It also selectively targets files and attempts to evade detection, says a press release.
Ymir ransomware introduces advanced features that enhance its stealth and control. It uses unique memory manipulation techniques, utilizing malloc, memmove, and memcmp functions to execute code directly in memory, which deviates from typical ransomware tactics and makes detection harder. Additionally, attackers can specify directories for encryption, excluding files on a whitelist for increased control.
In an attack observed by Kaspersky experts on a Colombian organization, threat actors used RustyStealer malware to steal corporate credentials, gaining access for prolonged control to deploy ransomware.
"If the brokers are indeed the same actors who deployed the ransomware, this could signal a new trend, creating additional hijacking options without relying on traditional Ransomware-as-a-Service (RaaS) groups," explains Cristian Souza, Incident Response Specialist at Kaspersky Global Emergency Response Team.
