FiveHands
FiveHands is a type of ransomware that emerged in early 2021. It is known for encrypting files on infected systems and demanding a ransom for decryption. FiveHands is part of a ransomware family that includes other variants such as HelloKitty and DeathRansom. The malware has been used in targeted attacks against various sectors, including healthcare and education. As of October 2023, cybersecurity researchers continue to study FiveHands to understand its evolving tactics, techniques, and procedures.
Overview
FiveHands is a ransomware variant that encrypts files on a victim's computer, rendering them inaccessible. The attackers then demand a ransom payment, typically in cryptocurrency, in exchange for a decryption key. FiveHands is part of a broader ransomware family that includes HelloKitty and DeathRansom. This malware has been observed in targeted attacks against organizations in various sectors, including healthcare and education. FiveHands is known for its sophisticated encryption techniques and its ability to evade detection by traditional antivirus software.
History
FiveHands was first identified in early 2021. It is believed to be a successor to the HelloKitty ransomware, sharing similar code and operational tactics. The emergence of FiveHands coincided with a rise in ransomware attacks globally, as cybercriminals increasingly targeted organizations with critical data. Researchers have noted that FiveHands has been used in targeted attacks, often exploiting vulnerabilities in remote desktop protocols (RDP) and virtual private networks (VPNs) to gain initial access to victim networks.
Technical characteristics
FiveHands is written in C++ and employs advanced encryption techniques to lock files on infected systems. It uses a combination of RSA and AES encryption algorithms, which are standard in modern ransomware. The malware is designed to evade detection by disabling security tools and deleting system backups. FiveHands also features a self-propagation mechanism, allowing it to spread laterally across a network. This capability makes it particularly dangerous in environments with interconnected systems.
Infection vector
FiveHands typically gains access to victim networks through compromised RDP credentials or by exploiting vulnerabilities in VPNs. Once inside a network, the malware uses [lateral movement] techniques to spread to other systems. Attackers often employ phishing emails to deliver the initial payload, tricking users into downloading and executing malicious files. In some cases, FiveHands has been observed exploiting known vulnerabilities in software to gain a foothold in targeted networks.
Notable campaigns
FiveHands has been involved in several high-profile ransomware attacks. One notable campaign targeted a healthcare organization, disrupting operations and compromising sensitive patient data. In another instance, FiveHands was used against an educational institution, to the temporary closure of the campus network. These attacks highlight the threat posed by FiveHands to organizations with critical data and limited cybersecurity resources.
Detection and mitigation
Detecting FiveHands requires a multi-layered approach to cybersecurity. Organizations should implement advanced threat detection tools capable of identifying unusual network activity and potential ransomware indicators. Regularly updating software and applying security patches can help prevent FiveHands from exploiting known vulnerabilities. Additionally, organizations should conduct regular security training for employees to recognize phishing attempts and other social engineering tactics. Backing up data regularly and storing it offline can also mitigate the impact of a ransomware attack.