Faust

Faust is a variant of the Phobos ransomware family, which has been linked to several other variants such as Elking, Eight, Devos, and Backmydata due to similarities in their tactics, techniques, and procedures (TTPs). The malware, Faust, represents a malicious software designed to exploit and damage computer systems. It can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal information, disrupt operations, or hold data hostage for ransom. Researchers from Fortinet’s FortiGuard Labs have noted that Faust can establish persistence in a compromised IT environment and creates multiple threads to run more efficiently. In March 2024, US CISA, the FBI, and MS-ISAC issued a joint cybersecurity advisory to warn of attacks involving Phobos ransomware variants including Faust. These agencies highlighted the threat against healthcare, education, government, and critical infrastructure entities. The report noted that vulnerable remote desktop protocol ports targeted via phishing campaigns have been leveraged by threat actors to facilitate initial network access and the deployment of remote access tools. The emergence of Faust was discovered when researchers found an Office document containing a VMA script aimed at propagating the FAUST ransomware. The activities of this variant include downloading the payload file from a Microsoft Excel document embedded with VBA script. In addition, the FBI and CISA have stated that “Phobos ransomware operates in conjunction with various open source tools such as Smokeloader, Cobalt Strike, and Bloodhound.”