A new ransomware, VHD, was seen being delivered by the Lazarus group’s multiplatform malware platform, MATA. The VHD ransomware is not a commercial off-the-shelf product. A spreading utility contained a list of administrative credentials and IP addresses specific to the victim, and leveraged them to brute-force the SMB service on every discovered machine. Whenever a successful connection was made, a network share was mounted, and the VHD ransomware was copied and executed through WMI calls. This stood out as an uncharacteristic technique for cybercrime groups. Criminals usually leverage widespread botnet infections (for instance, the infamous Emotet and Trickbot malware families) to spread into the network of promising victims, and license ransomware ‘products’ from third-party developers. When the attackers have a good understanding of the target’s finances and IT processes, they deploy the ransomware on all the company’s assets and enter the negotiation phase.