X-Industry

A new ransomware strain called PXJ ransomware (also known as XVFXGW ransomware) was first discovered in late February 2020.[1]  Half of the known samples were uploaded from Korea, and it uses a Korean website for a C2, showing predominantly Asian targeting.

Details

The earliest PXJ ransomware sample is from 24 February 2020.  It received its name for the .pxj extension that it adds to the files it encrypts.  Its alternative name, XVFXGW, refers to the strings in two contact emails (xvfxgw3929@protonmail.com, xvfxgw213@decoymail.com) and in the mutex that it creates (See the Indicators table below).

Prior to encryption, PXJ empties the Recycle Bin, deletes volume shadow copies and disables the Windows Error Recovery service.  Then PXJ uses both AES and RSA algorithms to lock data down.[2]

Figure 1. PXJ ransom note stored in LOOK.txt [3]

Red Sky Alliance detected C2 communication with a Korean site (pediitn[.]co[.]kr) co-hosted on a Korean IP.  Hackers likely temporarily compromised this domain, belonging to a Korean pedicure company, and secretly hosted a malicious .php page within the site. 

Half of the samples were submitted from Korea, as well as one from China, and one from France.  Red Sky Alliance will continue to monitor if PXJ ransomware will become a larger threat.

Indicators

Red Sky Alliance partners with Cysurance to protect you from the PXJ ransomware and other cyber risks by supplementing security technology with robust cyber insurance.

Red Sky Alliance is in New Boston, NH.  We are a Cyber Threat Analysis and Intelligence Service organization.  For questions, comments or assistance, please contact the lab directly at 1-844-492-7225, or feedback@wapacklabs.com

Serial: IR-20-078-001

Country: KR, CN, FR

Report Date: 20200318

Industries: All

[1] Primary analysis from IBM X-Force IRIS

[2] securityintelligence.com/posts/pxj-ransomware-campaign-identified-by-x-force-iris/

[3] twitter.com/Amigo_A_/status/1232221881002057728