![Dark Reading Global Logo Dark Reading Global Logo](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc8a6395802cafad0/654e0d60123f32040a075bab/Dark_Reading_Logo_Global_k.png?width=700&auto=webp&quality=80&disable=upscale)
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa.
Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks
The ransomware is rudimentary with basic functionalities, likely having been created by an inexperienced developer — but it's effective at locking up files and sucking up memory capacity.
![A Turkish flag waving on a pole A Turkish flag waving on a pole](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt244b5464f189bebb/669689c8eb4f37209235d560/turkey(1800)_imageBROKER.com_GmbH_&_Co._KG_alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A ransomware strain coined "ShadowRoot" has been found targeting Turkish businesses through phishing attacks.
The phishing emails contain a PDF attachment disguised as an invoice with embedded malicious links. Upon user interaction, this triggers a download of a RootDesign.exe file hosted on a compromised GitHub account.
The downloaded file is a Delphi binary and, according to researchers at Forcepoint who analyzed the exe, it drops further payloads: "C:\TheDream\RootDesign.exe," "C:\TheDream\Uninstall.exe” and “C:\TheDream\Uninstall.ini".
"We have observed recursive self-process creation by RootDesign.exe, which causes the files to get encrypted multiple times, resulting in higher memory consumption," the researchers said. "It also drops many copies of encrypted files on the root."
They add that the ransomware appears "rudimentary" and likely the work belonging to an inexperienced developer.
In addition to user awareness for defense, the researchers recommend blocking the following email addresses to prevent being targeted by the Shadowroot threat actors:
Kurumsal[.]tasilat[@]internet[.]ru
ran_master_som[@]proton[.]me
lasmuruk[@]mailfence[.]com
Read more about:
DR Global Middle East & AfricaAbout the Author
You May Also Like
Securing Your Cloud Assets
August 27, 2024Determining Exposure and Risk In The Event of a Breach
August 28, 2024Developing a Cyber Risk Assessment for the C-Suite
August 29, 2024Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024