Private HTS programs that spread ransomware
Fraudulent investment platforms distribute KRSID ransomware via fake HTS software, encrypting user drives and demanding Telegram contact for ransom. Threat actors use fake Home Trading System (HTS) software named UBP Asset to distribute KRSID ransomware. The malware, written in Rust, encrypts files using AES-256 and RSA-2048, excluding system folders, and drops a Korean ransom note. The attack chain involves modifying the HTS update process to download and execute the ransomware payload.
Detection / Hunteropenrouter
Immediate Actions
- Block network traffic to phf-ubp.com and associated IOCs.
- Isolate systems with UBP-Asset folder installed.
- Hunt for README_KRSID.Txt and .Krsid file extensions.
Key Takeaways
- KRSID ransomware is written in Rust and uses the .Krsid extension.
- Encryption uses AES-256 and RSA-2048, excluding standard Windows system folders.
- Ransom note is in Korean and directs victims to contact Bratteam88 on Telegram.
- UBP Asset HTS impersonates the legitimate Swiss financial institution Union Bancaire Privee.
- Previous HTS malware cases distributed Quasar RAT via a platform named HPlus.
Attack Chain
- Initial Access: Fraudulent investment groups lure users via social media to install private HTS software.
- Execution: UBPUpdater.Exe runs UBPPatch.Psh, which downloads Update.Lst from the HTS server.
- Persistence: Modified UBP.Dll contains commands to execute HTSPnew.Exe from the same directory.
- Impact: HTSPnew.Exe (KRSID ransomware) encrypts files on the drive using specified extensions.
- Exfiltration: Ransom note README_KRSID.Txt directs victim to contact attackers via Telegram.
Affected Systems
- Windows systems running private HTS software
- Users targeted by fraudulent investment schemes
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process executions and DLL modifications are visible to EDR. |
| Network Visibility | Medium | Connections to phf-ubp.com are visible, but payload may use HTTPS. |
| Detection Difficulty | Moderate | Requires distinguishing legitimate HTS updates from malicious ones. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Look for executables with non-standard extensions (.Psh) being executed as binaries (T1204.002). | Process creation, command line logs | Execution | Low — .Psh extension is non-standard for executables. |
| Look for HTSPnew.Exe or similar binaries creating README_KRSID.Txt and encrypting files (T1486). | File creation, process monitoring | Impact | Low — specific ransomware behavior. |
Required Log Sources
- Process creation logs (EDR/Sysmon)
- DNS resolution logs
- HTTP/HTTPS proxy logs
- File creation and modification logs
Key Behavioral Indicators
- Execution of files with .Psh extension
- Creation of README_KRSID.Txt ransom note
- Mass file modification with .Krsid extension
- Network connections to phf-ubp.com
- Execution of HTSPnew.Exe from UBP-Asset folder
Control Gaps
- Network filtering may not block HTTPS connections to fraudulent domains
- Endpoint controls may miss DLL side-loading or modification
False Positive Assessment
Low — The combination of UBP-Asset folder, .Psh extension execution, and KRSID ransom note is highly specific to this campaign.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block phf-ubp.com at DNS and proxy layers.
- Implement network-level blocking for known fraudulent HTS update servers.
User Protection
- Educate users on fraudulent investment platforms and fake HTS software.
- Instruct users to only install trading software from official financial institution websites.
Security Awareness
- Warn users about investment scams promoted via social media messaging apps.
MITRE ATT&CK Mapping
Stealth
Command and Control
Plain-Language Summary
Cybercriminals are using fake investment software called UBP Asset HTS to spread ransomware. The software looks like a real trading platform but secretly downloads ransomware that locks files on the victim's computer. The attackers then demand payment through Telegram. Users should only install trading software from official, regulated financial institutions and avoid links from social media or messaging apps.
Additional IOCs
- File Paths:
C:\UBP-Asset\UBPUpdater.Exe- HTS updater executable launching patch processC:\UBP-Asset\UBPPatch.Psh- Executable disguised with .Psh extensionC:\UBP-Asset\Update.Lst- Configuration file specifying ransomware downloadC:\UBP-Asset\HTSPnew.Exe- KRSID ransomware payload executableC:\UBP-Asset\UBP.Dll- HTS main DLL modified to execute ransomwareC:\UBP-Asset\ransomware-silent.Log- Log file generated by KRSID ransomwareC:\UBP-Asset\README_KRSID.Txt- Ransom note dropped by KRSID ransomware
- Command Lines:
- Purpose: Execute ransomware with directory and batch parameters | Tools:
HTSPnew.Exe| Stage: Execution |HTSPnew.Exe --Path <directory> --Batch <num> - Purpose: Dry run to list target files without encrypting | Tools:
HTSPnew.Exe| Stage: Discovery |HTSPnew.Exe --Dry-run
- Purpose: Execute ransomware with directory and batch parameters | Tools:
- Other:
Bratteam88- Telegram username for ransom contact
- domainphf-ubp[.]comDomain hosting fraudulent UBP Asset HTS
- file_pathC:\UBP-Asset\HTSPnew.ExeKRSID ransomware payload executable
- file_pathC:\UBP-Asset\ransomware-silent.LogLog file generated by KRSID ransomware
- file_pathC:\UBP-Asset\README_KRSID.TxtRansom note dropped by KRSID ransomware
- file_pathC:\UBP-Asset\UBP.DllHTS main DLL modified to execute ransomware
- file_pathC:\UBP-Asset\UBPPatch.PshExecutable disguised with .Psh extension
- file_pathC:\UBP-Asset\UBPUpdater.ExeHTS updater executable launching patch process
- file_pathC:\UBP-Asset\Update.LstConfiguration file specifying ransomware download
- urlhxxps://phf-ubp[.]com/UBPA/_hts_tv/userHTS update server distributing ransomware