{"id":4470,"date":"2024-07-16T10:58:34","date_gmt":"2024-07-16T15:58:34","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/shadowroot-ransomware-turkish-victims-phishing"},"modified":"2024-07-16T10:58:34","modified_gmt":"2024-07-16T15:58:34","slug":"shadowroot-ransomware-lures-turkish-victims-via-phishing-attacks","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/07\/16\/shadowroot-ransomware-lures-turkish-victims-via-phishing-attacks\/","title":{"rendered":"Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

A ransomware strain coined “ShadowRoot” has been found targeting Turkish businesses through <\/span>phishing attacks<\/a><\/span>.<\/span><\/p>\n

The phishing emails contain a PDF attachment disguised as an invoice with embedded malicious links. Upon user interaction, this triggers a download of a RootDesign.exe file hosted on a compromised GitHub account.<\/span><\/p>\n

The downloaded file is a Delphi binary and, according to researchers at Forcepoint who analyzed the exe, it drops further payloads: “C:\\TheDream\\RootDesign.exe,” “C:\\TheDream\\Uninstall.exe\u201d and \u201cC:\\TheDream\\Uninstall.ini”.<\/span><\/p>\n

“We have observed recursive self-process creation by RootDesign.exe, which causes the files to get encrypted multiple times, resulting in higher memory consumption,” <\/span>the researchers said<\/a><\/span>. “It also drops many copies of encrypted files on the root.”<\/span><\/p>\n

They add that the ransomware appears “rudimentary” and likely the work belonging to an inexperienced developer.<\/span><\/p>\n

In addition to user awareness for defense, the researchers recommend blocking the following email addresses to prevent being targeted by the Shadowroot threat actors:<\/span><\/p>\n

\n