Rorschach Ransomware Hits the Middle East

Researchers at Check Point have identified a new ransomware variant called Rorschach, which has the fastest encryption speed among known ransomware threats. The malware has been detected in Asia, Europe, and the Middle East and was deployed by exploiting a vulnerability in a threat detection and incident response tool. The attackers used the DLL side-loading technique through a signed component in Palo Alto Networks’ Cortex XDR product. They leveraged the Cortex XDR Dump Service Tool (cy.exe) version 7.3.0.16740 to deploy the Rorschach loader and injector (winutils.dll), which launched the ransomware payload named "config.ini" into a Notepad process. Upon execution, the malware creates a Group Policy to propagate to other hosts on the domain. However, it has been confirmed by Palo Alto Networks that Cortex XDR agent version 7.7 and later along with content update version and later updates have the ability to detect and block the spread of the ransomware.