Epsilon Red Ransomware Targets Vulnerable Microsoft Exchange Servers

Cybersecurity experts have discovered a new attack, which targets enterprises and companies based in the United States. The criminals are relying on a new piece of ransomware dubbed Epsilon Red. Allegedly, its operators are abusing a vulnerability in Microsoft Exchange servers to get remote access to unpatched systems. Once the Epsilon Red Ransomware is deployed, it execute several actions, which fulfill various purposes - this makes it more dangerous compared to traditional ransomware.

The Epsilon Red Ransomware is written in the Go programming language, which is preferred by malware developers who try to evade antivirus tools. It also has the ability to load PowerShell scripts on compromised systems and uses an interesting set of scripts to weaken the network's security:

• Delete System Restore Points and Shadow Volume Copies.
• Steals hashed passwords from Security Account Manager.
• Disables the Windows Event Log and Windows Defender services.
• Tries to disable various security tools.
• Kills processes related to database management software.

Of course, the Epsilon Red Ransomware's primary purpose is to encrypt the victim's data, and then offer to sell a paid decryption tool. The criminals are using a ransom message to provide their victim with details – it seems that the criminals are using a note, which is very similar to the one used by the REvil Ransomware. All locked files are marked with the '.epsilonred' name suffix. The criminals demand various ransom fees – allegedly, their wallet has already received one payment of 4.28 Bitcoin on May 15, which could be converted to about $210,000 at the time.

Surprisingly, the enterprise-oriented ransomware does not steal files prior to encrypting them, which means that the criminals do not threaten to leak the victim's files online. However, Epsilon Red Ransomware has the ability to be very destructive since it does not target specific types of files – it encrypts any file it can access, which could allow it to fully disable systems and services.

While the Epsilon Red Ransomware does not appear to be on the level of modern ransomware, it is still very dangerous. Victims can stay protected from it by maintaining backups of their data, updating their software, and relying on reputable antivirus software.