CISA Publishes Analysis on New 'FiveHands' Ransomware

Attackers used publicly available tools, FiveHands ransomware, and SombRAT to successfully target an organization, officials report.

Dark Reading Staff, Dark Reading

May 7, 2021

1 Min Read

Attackers used publicly available penetration testing and exploitation tools, the FiveHands ransomware, and the SombRAT remote access Trojan to steal information, obfuscate files, and demand ransom, officials report. They also used publicly available tools for network discovery and credential access.

The initial access vector in these attacks was a zero-day vulnerability in a virtual private network (VPN). In its recommendations to organizations, the CISA advises using multifactor authentication, particularly on all VPN connections, external-facing services, and privileged accounts. It also advises decommissioning unused VPN servers, which could be an entry point.

Analysis of the FiveHands ransomware is still ongoing; CISA plans to update its report as new information becomes available.

Read the full Analysis Report and Malware Analysis Report for more details.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights