Security Brief: Royal Mail Lures Deliver Open Source Prince Ransomware

SUMMARY :

A campaign impersonating Royal Mail was identified delivering Prince ransomware, an open-source variant available on GitHub. The low-volume attack targeted UK and US organizations in mid-September, often originating from contact forms on target websites. The ransomware lacks decryption mechanisms and data exfiltration capabilities, making it purely destructive. The attack chain involves multiple stages, including PDF lures, ZIP files, shortcuts, and obfuscated scripts, ultimately leading to the execution of the Prince ransomware. The campaign's attribution remains unclear, but the ransomware's creator offers customization services. This activity highlights the ongoing threat of freely available malware and the importance of user awareness in identifying suspicious emails and attachments.

OPENCTI LABELS :

phishing,obfuscation,github,prince ransomware,destructive attack,royal mail,open-source malware,prince,contact forms


Open in NetmanageIT OpenCTI Public Instance with below link!


Use public read only username and password on login page.

NOTE : Use Public READ only user credentials on login page banner.


Security Brief: Royal Mail Lures Deliver Open Source Prince Ransomware