Things You Should Know About Emerging Prometheus Ransomware Strain

Cybersecurity researchers revealed a new emerging player in the threat landscape. This new emerging Prometheus Ransomware Strain has claimed that it had been compromised 30 business just in four months of time. Let’s see what things research has disclosed about this newly emerging Prometheus Ransomware Strain.

Prometheus ransomware was first observed in February 2021. Studies say that this new ransomware strain has been developed on a ransomware veteran Thanos. However, the Prometheus Ransomware group claims that it is a part of the notorious ransomware gang REvil. Researches don’t see any link between the two ransomware in any way. It is just an attempt to exploit REvil’s name to expand the ransomware business.

Victims Of Prometheus Ransomware

Prometheus Ransomware climes that it has compromised several businesses under different sectors in government, financial, manufacturing, logistics, consulting, agriculture, healthcare, insurance agencies, energy, and law firms in various countries around the globe, including United States, United Kingdom, and some countries in Asia, Europe, the Middle East, and South America.

There are 30 names of victims published on their leak site. According to the data found on the Prometheus Ransomware group’s leak site, it claims that four victims have paid the ransom. A Peruvian agricultural company, a Brazilian healthcare services provider and a transportation and a logistics organization from Austria and Singapore have paid ransoms. You can see the below two pictures from the report, which tells about the number of compromised organizations by the country and by industry sector. 

Fig #1: Countries impacted by new Prometheus ransomware strain.

Fig #2: Industries impacted by new Prometheus ransomware strain.

The leak site displays the status of each victim. As per the information found on the leak site, four victims have made their payments and recovered their data, Eight victims’ data has been sold out to unknown third parties, and there are 17 victims’ data put on sale on the dark web.

Fig #3: Victim status for Prometheus ransomware.

Things You Should Know About Prometheus Ransomware Strain

As of the date, it is unknown that how Prometheus ransomware is being delivered to the victim’s network.

Fig #4: Ransom note

Prometheus Ransomware group operats like a professional enterprise. It refers to its victims as “customers”. It uses a ticketing tool for tracking the status. A ticket includes a tracking ID, created date, resolution status and priority. And, the ticket system allows the victims to open a ticket for issues.

Ransome amounts may vary depending on the victim. It starts from $6000 to as high as up to $100,000. And ransom amount will be doubled if victims didn’t respond within the timeframe.

What Should You Do If infected With Prometheus Ransomware?

There are several intelligence services that are offering assistance. Please contact them.

There are many other services available. Try connecting with them.

IOCs Of Prometheus Ransomware Strain

Ransome Notes:

Two text files RESTORE_FILES_INFO.TXT & RESTORE_FILES_INFO.TXT.hta with same note.

File Fingerprints:

11aebdff8c064c160c2b21f3a844bacaecd581d9dc2e4224d31903d2a56e2dd3
52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b
A0e20c580e8a82f4103af90d290f762bd847fadd4eba1f5cd90e465bb9f810b7
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5
e1c46a96effc5df063cea2fae83306ae1f0e2f898b0d2ada86c48052be5fe8d3
f90d4b7491d9f365748dbc3d2379ab20520421ab57790e9a934bb5cf2ecb2404
A090bb0e9118d7460c448304ccf47333ea64b90576230b8b4b5dee96f702ecf6
9bf0633f41d2962ba5e2895ece2ef9fa7b546ada311ca30f330f0d261a7fb184
779db1c725f71e54d4f31452763784abe783afa6a78cc222e17796b0045f33fc