High
A new ransomware called TFlower Ransomware is being used to target corporate environments. The ransomware is installed on networks after attackers hack into exposed Remote Desktop services. Once the attackers gain access to the machine, they will infect it and may attempt to traverse the network through tools such as PowerShell Empire, PSExec, etc. When executed, the ransomware will display a console that shows the activity being performed by the ransomware.
Once the encryption begins, connection to C2 server is made, which is located on a hacked WordPress site with the following URL.
https[:]//www[.]domain[.]com/wp-includes/wp-merge[.]php?name=[computer_name]&state=start
It will then proceed to encrypt the data on the computer, skipping any files in the Windows or Sample Music folders. When encrypting files, it will not add an extension, but will prepend the *tflower marker and what appears to be the encrypted encryption key for the file.
Ransom note file named “!_Notice_!.txt” is found throughout the computer and on the Windows Desktop, which looks like this:
URLs
Filename
chilli.exe
Email Address
Malware Hash (MD5/SHA1/SH256)