FIVEHANDS

FiveHands, also known as HelloKitty, is a sophisticated form of malware that primarily targets financial institutions. It was first reported by Mandiant in April 2021 as part of a cyber threat posed by the UNC2447 group. The ransomware is typically delivered through Encryptor.exe, a loader that initiates the malicious software on the victim's device. FiveHands has been associated with other notorious ransomware strains such as Abyss Locker and DeathRansom, demonstrating its evolution and adaptability to exploit various vulnerabilities. In November 2021, the FBI issued a flash alert warning private organizations about the evolution of the FiveHands ransomware. This followed incidents where SonicWall appliances, often used by businesses for network security, were targeted by FiveHands and other ransomware gangs. The malware has also been linked to significant disruptions, including the compromise of VMware ESXi instances and CD Projekt Red, highlighting its potential for large-scale damage. PQ Hosting, a web hosting service, has been implicated in hosting infamous ransomware like FiveHands and DarkSide. Notably, DarkSide was responsible for the high-profile attack on US energy company Colonial Pipeline in 2021, leading to a shutdown of critical energy infrastructure. This incident underscores the severe real-world implications of ransomware attacks and the importance of robust cybersecurity measures to protect against threats like FiveHands.