Defray Ransomware – Hitting Healthcare and Educational Sectors

What is Defray Ransomware?

The ransomware used in the campaign against education and healthcare organizations is named Defray, which has the base on the command and control (C&C) server hostname used for the first observed attack: defrayable-listings[.]000webhostapp[.]com. The ransomware is being distributed through Microsoft Word document attachments in email.

Researchers have observed two targeted attack on Aug. 15, and on Aug. 22, and both appeared to be intended for specific organizations. The second attack on August 22, primarily aimed at Healthcare and Education involving messages with a Microsoft Word document containing an embedded executable (specifically, an OLE packager shell object). The attachment used a lure referencing a UK-based aquarium purported to be from a representative of the aquarium.

How Does Defray Ransomware works?

The attackers behind the Defray ransomware ask for $5,000, but researchers believe that the ransom note contains several email addresses, presumably from cybercriminal Igor Glushkov, this allows the victims to “negotiate a smaller ransom or ask questions. “The Defray ransomware targets a hardcoded list of file types but doesn’t change the file extension names. After encryption is complete, the Defray ransomware may cause other general havoc on the system by disabling startup recovery and deleting volume shadow copies. Once the victim clicks on the attachment, the ransomware is activated and encryption takes place. Defray, however, may also restrict startup recovery and delete shadow copy volumes, as well, according to Proofpoint. The researchers suspect Defray is not for sale like other ransomware strains and instead is being used by certain threat cyber criminals for their personal use.