New ransomware targets unpatched Microsoft Exchange servers
Vulnerabilities in server software allow Epsilon Red to encrypt data


Security researchers have discovered new ransomware targeting unpatched Microsoft Exchange servers.
Researchers spotter this new malware, called "Epsilon Red," in the wild, and it initially targeted US-based hospitality businesses, according to Sophos. The name derives from a somewhat obscure X-Men villain — a "super-soldier" alleged to be of Russian origin, sporting four mechanical tentacles and a bad attitude.
The malware was the final executable payload to the victim company, while every other early-stage component was a PowerShell script. Researchers said at least one victim had paid a ransom of 4.29 Bitcoins ($158,114) on May 15.
Researchers said the name and tooling were unique to this attacker, but the ransom note left on infected computers resembles the REvil ransomware note with a few grammatical corrections. They added that there were no other obvious similarities between the Epsilon Red ransomware and REvil.
The initial point of entry for the ransomware was an enterprise Microsoft Exchange server.
"It isn't clear whether this was enabled by the ProxyLogon exploit or another vulnerability, but it seems likely that the root cause was an unpatched server," the researchers said.
"From that machine, the attackers used WMI to install other software onto machines inside the network that they could reach from the Exchange server."
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The malware, called RED.exe, is a 64-bit Windows executable programmed in the Go language, compiled using the MinGW tool, and packed with a modified version of the runtime packer UPX.
RELATED RESOURCE
Defend your organisation from evolving ransomware attacks
Learn what it takes to reduce risk and strengthen operational resiliency
Epsilon Red makes no network connections and uses PowerShell scripts to then kill off system processes before deleting Volume Shadow Copies. Most of the scripts are numbered from 1 to 12, but several are named with the same letter. One of them, c.ps1, appears to be a clone of the Copy-VSS penetration-testing tool.
The ransomware then encrypts inside the folder, including other executables and DLLs, which can render programs or the entire system non-functional if the ransomware encrypts the wrong folder path. In each encrypted folder, the malware creates a ransom note with instructions on contacting cyber criminals and paying for decryption.
Researchers said that as the ingress point for this attack appears to have been an Exchange server vulnerable to the ProxyLogon exploit chain, "customers are urged to patch internet-facing Exchange servers as quickly as possible."
Rene Millman is a freelance writer and broadcaster who covers cybersecurity, AI, IoT, and the cloud. He also works as a contributing analyst at GigaOm and has previously worked as an analyst for Gartner covering the infrastructure market. He has made numerous television appearances to give his views and expertise on technology trends and companies that affect and shape our lives. You can follow Rene Millman on Twitter.
-
Helping customers adopt a multi-cloud infrastructure and accelerate their modernization journey
Sponsored Content We outline what shifting to a subscription model means for your business
-
UK firms are 'sleepwalking' into smart building cyber threats
News The convergence of operational technology and IT systems is posing serious risks for property firms.
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operators
News A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attack
News A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?
News The Scattered Spider group has been highly active in recent years
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.