A new variant of the Vega ransomware which is named Buran. The ransomware is being delivered using the RIG exploit kit. Once installed on to the victim system, the ransomware is written to a file (ctfmon.exe), then executes and begins the encryption process. As is typical of ransomware, there is a list of certain directories, files and file extensions which are not to be encrypted. Files that are encrypted have the victim’s unique ID appended as the file extension and the word “Buran” prepended to the head of the file.
Indicators of Compromise
Malware Hash (MD5/SHA1/SH256)
Block all threat indicators at your respective controls.