Malware: Prestige

Description

[Prestige](https://attack.mitre.org/software/S1058) ransomware has been used by [Sandworm Team](https://attack.mitre.org/groups/G0034) since at least March 2022, including against transportation and related logistics industries in Ukraine and Poland in October 2022.(Citation: Microsoft Prestige ransomware October 2022)

External References

• mitre-attack
• Microsoft Prestige ransomware October 2022

Techniques Used by This Malware

• T1053.005 — Scheduled Task
• T1059.001 — PowerShell
• T1083 — File and Directory Discovery
• T1106 — Native API
• T1112 — Modify Registry
• T1484.001 — Group Policy Modification
• T1486 — Data Encrypted for Impact
• T1489 — Service Stop
• T1490 — Inhibit System Recovery

APT Groups Using This Malware

• Sandworm Team