March 30, 2016 By Douglas Bonderud 2 min read

Ransomware is a growing threat for businesses — enough of a threat that the FBI wants help from U.S. organizations to fight new strains like MSIL/Samas.A, according to Fortune.

But this isn’t the only new code causing problems for companies; variants such as PETYA and PowerWare are ramping up the risk to critical system processes.

PETYA Ransomware Attacks

As noted by Trend Micro, the RANSOM_PETYA.A strain isn’t just locking down files and demanding a 0.99 bitcoin payment. It’s taking things a step further by overwriting a system’s master boot record (MBR), which locks out users as soon as the system is turned on and before the OS loads. Instead of the usual boot process, victims receive a red skull-and-crossbones screen that informs them they’ve been compromised and provides detailed instructions on how to make payment.

The initial attack vector is commonplace: Business users receive an email from an applicant seeking employment. The email links to a legitimate Dropbox folder, which contains a malicious executable masquerading as a CV and a stock photo that is likely used without permission. Once infected, PCs suffer a blue screen of death, which forces a reboot.

Next, the malicious MBR code claims a Windows check disk operation is running, while in reality, PETYA is busy encrypting the master file table. So far, the infection is localized to Germany and Dropbox quickly removed the compromised folder. But in this case, function matters more than form; circumventing the OS gives malware users an entirely new level of control.

Pow Pow PowerShell

According to SecurityWeek, meanwhile, key Windows utility PowerShell is also under attack from a new strain of ransomware called PowerWare. Infection starts via a macro-enabled Word document, but instead of copying malicious files to users’ hard disks, the malware calls for PowerShell to handle the dirty work in hopes of being passed over as a legitimate system process.

The embedded macros create and run CMD.exe, which calls two instances of PowerShell to first download and then run the ransomware script. Files are then encrypted, and an HTML file containing instructions for payment is included in every folder. The ransom starts at $500 and bumps up to $1,000 after two weeks.

Researchers have detected a weakness: Data sent to the command-and-control server is in plaintext, meaning it’s possible to analyze traffic with a full packet capture solution, find the right IP and domain and grab the encryption key.

This is the next logical step for ransomware — why attack files or build hidden processes when it’s possible to lock down systems before they boot and leverage common system infrastructure? This new class of malware isn’t unbeatable but signals the need for an evolution in InfoSec thinking: Core components are becoming the new carriers of system compromise.

More from

FYSA — VMware Critical Vulnerabilities Patched

< 1 min read - SummaryBroadcom has released a security bulletin, VMSA-2025-0004, addressing and remediating three vulnerabilities that, if exploited, could lead to system compromise. Products affected include vCenter Server, vRealize Operations Manager, and vCloud Director.Threat TopographyThreat Type: Critical VulnerabilitiesIndustry: VirtualizationGeolocation: GlobalOverviewX-Force Incident Command is monitoring activity surrounding Broadcom’s Security Bulletin (VMSA-2025-0004) for three potentially critical vulnerabilities in VMware products. These vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, have reportedly been exploited in attacks. X-Force has not been able to validate those claims. The vulnerabilities…

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today