Hermes RaaS

The Hermes RaaS is a file-locker Trojan that uses encryption for blocking media such as documents, pictures or audio. Since this threat uses a Ransomware-as-a-Service business model, different criminals may choose different ways of distributing it and compromising your PC, such as spam e-mails or corrupted Web advertisements. Always have backups for protecting your files from file-locking Trojans and keep your anti-malware programs fully updated for detecting and removing the Hermes RaaS quickly.

The Trickster God Gets Ransom-Greedy

A Ransomware-as-a-Service family with a name referencing an ancient Greek god is updating its encryption features for keeping its victims' files 'safe' from unlocking particularly. Although the Hermes RaaS has been in production since last year, 2018 is showing significant changes in the Trojan, which sells its services to other criminals for an upfront cost of three hundred dollars. The file-locking Trojan can use a conventionally secure encryption feature for blocking different formats of content on your computer before showing an HTML ransom note that markets its premium decryption service.

The Hermes RaaS runs on most Windows platforms and uses both AES and RSA as parts of its file-locking routine, which affects over eight hundred data formats. It creates unique keys for both the infected PCs and each file individually, which it uploads to the threat actor's server. Some of the additional features that malware researchers can confirm with the modern versions of the Hermes RaaS include:

• The Hermes RaaS can erase the Windows Shadow Copies and other data associated with backups.
• The Hermes RaaS uses an additional data-overwriting method of encryption that could prevent advanced data recovery software from retrieving anything that it's locking.
• The authors also are taking steps for preventing the Hermes RaaS from harming PCs residing in Russia, Ukraine, or Belarus, which may be for keeping any local authorities from tracking their operations.

Although early builds of the Hermes RaaS include some vulnerabilities that could help with free decryption attempts, unfortunately, malware analysts are verifying the removal of these loopholes with the latest variants.

Outsmarting a Savvy Deity of a Trojan

While there are multiple reports of the Hermes RaaS's variants in recent distribution, the methods in play may differ between different targets. Against business entities, malware experts are noting a predominance of brute-force attacks (that compromise login credentials by using Black Hat software to 'guess' them) and spam e-mail attachments (such as forged invoice or fax alert documents) at the root of file-locking Trojan infections. Users should be cautious about allowing compromised PCs in contact with the rest of a network due to the high chances of the Hermes RaaS attacking additional files on the other machines.

Strict and well-updated backups are the only complete solution to many file-locker Trojan infections, including ones from the 2018 version of the Hermes RaaS family, which lacks a modern decryption service. Malware experts also are seeing historical tendencies of threat actors using this family to take a ransom payment without giving back a real decryption program, although users, still, may benefit from any offers of a free 'sample.' Anti-malware products of most brands should remove the Hermes RaaS on sight unless a threat actor with remote control disables them beforehand, such as during an RDP-based attack.

The Hermes RaaS's is discriminating in which countries it attacks, which could be of benefit to its authors and affiliates. However, lest Russian PC users believe that they don't need to back up their work, many other examples of file-locking Trojans that do target Belarus, Russia, and Ukraine are just as easy for abusing as the Hermes RaaS.