October 20, 2022
Prestige ransomware was first observed in October 2022. The malware has been tied to multiple targeted attacks affecting entities in Poland and Ukraine. Prestige-centric campaigns have not yet been linked to any other prior, specific, attacks against Ukraine. Initial footholds are often obtained via COTS or LOLBINS (Impacket WMIexec, Remote Exec, ntdsutil.exe, winPEAS) Once launched, the malware will locate files matching the prescribed criteria for encryption. Affected files are noted with a “.enc” extension. The malware also registered a custom file handler (via registry). In addition, the malware will attempt to delete Volume Shadow Copies and the local Backup Catalog (wbadmin.exe).
SentinelOne Singularity™ blocks and prevents Prestige ransomware attacks.
#malware #ransomware #Prestige #ukraine
SentinelOne PartnerOne - America's 2025
⛳️ Last week in Pebble Beach the America's best cybersecurity partners came together for our annual PartnerOne summit. Check out…
Just a Sec: Cybersecurity Unfiltered—Fast, Frank, and From the Front Lines
Welcome to the first-ever Just A Sec, a no-holds-barred, quick-fire monthly livestream. It’s cybersecurity like you’ve never heard it before—unfiltered,…
See how our intelligent, autonomous cybersecurity platform harnesses the power of data and AI to protect your organization now and into the future.