Prestige Ransomware

The Prestige ransomware is a type of malware that had not been observed by Microsoft prior to its deployment. It is a malicious software designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. Once inside a system, it can steal personal information, disrupt operations, or hold data hostage for ransom. The Prestige ransomware was first detected in the fall of 2022, when it was deployed against logistics companies in Ukraine and Poland. Unlike traditional ransomware attacks, the attackers did not aim to provide a key to decrypt the encrypted data, suggesting a more destructive intent. Microsoft Defender Antivirus has identified known Prestige ransomware payloads using specific file hashes associated with this malware. Security firm WithSecure noticed overlaps between Kapeka and GreyEnergy attacks and the Prestige ransomware attacks, attributing them to the Russia-linked Sandworm APT group. This connection was further supported when Kapeka's deployment coincided with reported instances of Prestige ransomware attacks in Poland and Ukraine, incidents that Microsoft also attributed to Sandworm. While pointing the finger at Russian cyberoffensive groups as the culprits behind the Prestige ransomware might seem the obvious choice, attribution based on evidence is a different beast. Nevertheless, security experts have noted that Sandworm changed tactics in the fall of 2022 and began using Prestige ransomware to infect Polish and Ukrainian logistics firms, in an attempt to disguise itself as a non-government hacking team. These destructive attacks are likely to continue and could extend to organizations from countries that provide military and logistics support to Ukraine.