Digital criminals tried to impersonate oil and gas companies in a recent attack campaign distributing Shade ransomware.

Between January and February, Yoroi observed an attack campaign leveraging email as an infection vector. Each of the emails came with an attached ZIP file called slavneft.zakaz.zip. The name of this file means “Slavneft order” in English, which includes a direct reference to the Russian oil and gas company PAO NGK Slavneft. Building on this disguise, the ZIP file contained a JavaScript file named «ПАО «НГК «Славнефть» подробности заказа, which translates to “PAO NGK Slavneft order details” in English.

Clicking on the JavaScript file activated a downloader that pulls Shade from one of several compromised websites. At that point, the ransomware payload, which had a VirusTotal detection rate of just 24 out of 69 tools at the time of discovery, encrypted all of the infected machine’s files using Advanced Encryption Standard (AES). It then created a ransom note, which included instructions for victims to visit a dark web site so they could receive payment instructions from the attackers.

A Busy 2019 for Shade

Yoroi isn’t the only digital defense company that recently detected a new Shade ransomware campaign. In January 2019, ESET witnessed a large uptick in emails containing malicious JavaScript attachments, including those responsible for downloading Shade. In February, Carbon Black observed a similar campaign also leveraging JavaScript attachments to target primarily Russian speakers.

These attacks come at a time when targeted ransomware remains one of the most prominent threats targeting organizations. Europol said as much in 2018 after it observed threat actors turning to targeted ransomware, not banking Trojans, as their preferred payload in financially motivated cyberattacks. This preference contributed to Cybersecurity Ventures‘ estimate that ransomware damages would surpass $8 billion by the end of 2018.

How to Protect Against Shade Ransomware

Security professionals can help defend their organizations against Shade ransomware and similar malware by making sure their endpoint software is up-to-date and all applications are updated to their most secure versions. Organizations should also make sure to isolate their data backup systems so that attackers can’t encrypt these copies in the event of a successful ransomware infection.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…