Prestige Ransomware

In October 2022, a new strain of ransomware known as Prestige was reported by Microsoft. This malware had not been observed by Microsoft prior to its deployment and was found targeting transportation and logistics organizations in Ukraine and Poland. Prestige ransomware infects systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can disrupt operations, steal personal information, or hold data hostage for ransom. The file hashes associated with the Prestige ransomware payload were identified and are now detectable by Microsoft Defender Antivirus. The deployment of Prestige ransomware coincided with the activities of Kapeka and GreyEnergy, which have shown overlaps in their attack patterns. Security firm WithSecure noted these similarities and suggested that the novel backdoor used in these intrusions likely led to the deployment of Prestige ransomware in late 2022. The attacks have been attributed to the Russia-linked Sandworm APT group, which is known for its cyberoffensive activities. Although attributing the Prestige ransomware attacks to Russian state-sponsored hackers might seem obvious, evidence-based attribution remains challenging. However, it is noteworthy that the threat actor may also have been testing additional ransomware-style capabilities that could be used in destructive attacks on organizations outside Ukraine serving key functions in Ukraine's supply lines. This was evidenced by the Prestige ransomware operation against a Polish firm in late 2022, setting a precedent for such attacks.