Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Targeted Ransomware Attacks Middle Eastern Government Organizations for Political Purposes

Summary: Unit 42 observed attacks against multiple Middle Eastern government organizations using a previously unseen ransomware family it named RanRan, which installs itself as C:\services.exe, persists via an autorun registry key, and encrypts Office, Acrobat, image, web page, SQL, archive and backup files, appending the extension "zXz". Rather than demanding direct payment, the ransom note requires victims to create a subdomain hosting a Ransomware.txt file with a statement of 'Hacked' and an email address, forcing a public political statement against a Middle Eastern political leader.

Bottom line: This actor's objective is not payment but a coerced public statement from a government victim, which reframes ransomware from a financial incident into a political and reputational one. The malware's encryption mistakes - a reused RC4 key and originals left undeleted - let Unit 42 write scripts that decrypt some affected files, but only where an original, its encrypted copy, and the reused key line up.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related