Microsoft issues warning about new PonyFinal ransomware attacks

PonyFinal attackers “looking for targets of opportunity," says Misner

Ransomware splash screen mockup

Microsoft Security Intelligence posted a series of tweets urging companies to implement protections against PonyFinal, a new ransomware that’s been active for the last two months. 

PonyFinal, according to Microsoft Security Intelligence, is not an automated threat. Rather, it has humans pulling its reins. Hackers must manually propagate the ransomware via an MSI file containing two batch files and the ransomware payload.

Per the experts, PonyFinal uses a secure encryption scheme, meaning that encrypted files can’t be recovered either. Unfortunately, Microsoft says, these attackers have compromised their targets for several months and been patiently waiting for the perfect opportunity to monetize their cyberattacks.  

“PonyFinal is at the tail end of protracted human-operated ransomware campaigns that are known to stay dormant and wait for the most opportune time to deploy the payload,” a tweet from Microsoft Security Intelligence reads.

"These attackers are looking for targets of opportunity," Phillip Misner, Security Program Manager at Microsoft explained in an interview with Dark Reading.

Misner added that PonyFinal operators don’t discriminate when it comes to choosing targets either. PonyFinal has already targeted victims in the U.S., India and Iran. It’s taken aim at the health care and financial sectors specifically. 

“So far, the attacks have affected aid organizations, medical billing companies, manufacturing, transport, government institutions and educational software providers, showing that these ransomware groups give little regard to the critical services they impact, global crisis notwithstanding,” researchers explained in April. “These attacks, however, are not limited to critical services, so organizations should be vigilant for signs of compromise.”

Human-operated ransomware like PonyFinal is nothing new. Ransomware similar to PonyFinal has been growing more popular as attackers try to maximize ransom from individual targets. Other human-operated ransomware campaigns similar to PonyFinal include Bitpaymer, Ryuk, REvil and Samas.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

How can you protect your business from crypto-ransomware?
Security

How can you protect your business from crypto-ransomware?

4 Nov 2019
The Ritz suffers data breach after hackers pose as staff
data breaches

The Ritz suffers data breach after hackers pose as staff

17 Aug 2020
Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020

Most Popular

Windows XP source code allegedly leaked online
Microsoft Windows

Windows XP source code allegedly leaked online

25 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020