Skip to main content

PonyFinal Is Another New Ransomware To Watch Out For

By June 8, 2020May 5th, 2022Cybersecurity

Microsoft recently issued a security advisory about a new strain of ransomware that’s been cropping up with increasing frequency in India, Iran and the US.

Called PonyFinal, one of the things that differentiates this strain from the pack is that it’s deployed in what the company describes as human-operated ransomware attacks.

Most of the ransomware attacks we see are bot driven or highly automated affairs. Other than the initial kickoff, very little human intervention is required. This variant is different. Hackers breach a target network and then deploy the ransomware themselves, by hand.

Based on Microsoft’s research into the new strain, where it’s used and exactly how it is deployed, it seems that the hacker group behind the malware relies mostly on brute force attacks to guess weak passwords.

Once they gain a foothold, a member of the gang deploys a Visual Basic script that runs a PowerShell reverse shell to collect and exfiltrate local data. The hackers also utilize a remote manipulator system which allows them to bypass event logging, making their work that much more difficult to track.

After penetrating the network as deeply as they can and making off with the data they want, their last step is to actually deploy the ransomware, encrypt all the files on the infected systems, and demand payment.

It should be noted that although somewhat more rare than conventional ransomware, there are several different strains that rely on human-operated campaigns. While these are not as elegant and high tech as their more automated counterparts, they nonetheless pose a genuine threat and should not be taken lightly.

Unfortunately, guarding against these kinds of attacks is tricky. Conventional attacks that rely on an email recipient to click on a link or open a poisoned attachment can be shut down with better training and increased awareness. Here, the success or failure of the hackers is entirely dependent on how robust your network security is, and how sharp-eyed your IT folk are in terms of watching for suspicious network activity. If PonyFinal isn’t yet on your threat radar, it should be. Stay vigilant.

Jason Manteiga

Jason J. Manteiga, Vice President of Olmec Systems, has been part of the company for over the past 20 years. He believes that having a great work environment and supportive team, is the ultimate key to success. Since being in the IT realm for over 25 years, Jason, along with Olmec Systems, has been on the Inc. 5000 “List of America’s Fastest Growing Private Companies” and Channel Futures MSP 501 “Top Managed Service Providers in North America,” along with other awards and nominations. Jason earned his Bachelor Degree in Information Systems from the New Jersey Institute of Technology. He also holds certifications in Microsoft MCSE, VMWare VCP, and Cisco CCNA. In his spare time, Jason is a contributor for The Center for Social & Legal Research (Privacy Exchange) and a member of the Morris County Chamber of Commerce. His hobbies include cycling and kayaking. He currently lives in New Jersey with his wife, two daughters and son.