Sophos discovered new stripped-down ransomware called Epsilon Red that offloads most of its functionality to a series of PowerShell scripts. It was delivered as the final executable payload in a hand-controlled attack against a US-based business in the hospitality industry in which every other early
minute read
Share this article:
REvil threat actors may be behind a set of PowerShell scripts developed for encryption and weaponized to exploit vulnerabilities in corporate networks, the ransom note suggests.
Threat actors have deployed new ransomware on the back of a set of PowerShell scripts developed for making encryption, exploiting flaws in unpatched Exchange Servers to attack the corporate network, according to recent research.
Researchers from security firm Sophos detected the new ransomware, called Epsilon Red, in an investigation of an attack on a U.S.-based company in the hospitality sector, Sophos Principal Researcher Andrew Brandt wrote in a report published online.