Smart PowerWare Ransomware Uses PowerShell for the Dirty Work
A new ransomware program written in Windows PowerShell is being used in attacks against enterprises, especially healthcare organizations.
The ransomware, dubbed PowerWare, is being distributed to victims via phishing emails containing Word documents with malicious macros, an increasingly common attack technique. The phishing attack is being disguised as an "invoice.”
According to Carbon Black, PowerWare targets organizations via Microsoft Word and PowerShell. PowerShell is the scripting language inherent to Microsoft operating systems.
“PowerWare is a new instance of ransomware utilizing native tools, such as PowerShell on operating systems,” the company said in an advisory. “Traditional ransomware variants typically install new malicious files on the system, which, in some instances, can be easier to detect. PowerWare asks PowerShell, a core utility of current Windows systems, to do the dirty work. By leveraging PowerShell, this ransomware attempts to avoid writing new files to disk and tries to blend in with more legitimate computer activity.”
