KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Software

Key facts for KRSID ransomware UBP trading scam

Detection coverage for KRSID ransomware UBP trading scam

As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2555 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: KRSID Malicious HTS Update-Chain Execution (UBPUpdater.Exe → UBPPatch.Psh → HTSPnew.Exe)

Detects execution of the fraudulent 'UBP Asset' HTS update chain that delivers the KRSID ransomware payload: UBPUpdater.Exe launching UBPPatch.Psh (an executable disguised with a non-executable .psh extension), the UBP-Asset install path or Update.Lst configuration file appearing on the command line, execution of the HTSPnew.Exe payload, or a process matching one of the three published KRSID sample MD5 hashes. This is the exploitation-stage trigger for the entire investment-fraud-to-ransomware chain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1036.008, T1105, T1566.003
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon OR index=endpoint OR index=edr sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(Image="*\\UBPUpdater.Exe" OR Image="*\\UBPPatch.Psh" OR Image="*\\HTSPnew.Exe" OR ParentImage="*\\UBPUpdater.Exe" OR ParentImage="*\\UBPPatch.Psh" OR CommandLine="*UBP-Asset*" OR CommandLine="*Update.Lst*" OR Hash="6d2cd65dbd0df30404b08ff007359e54" OR Hash="a9cce44c4d42b07f114dd2b340f0046a" OR Hash="f86b2ece324cfd36e832a3b48cc3719b")
| eval detection_reason=case(
    match(Image,"(?i)UBPUpdater\.Exe$"), "fake_hts_updater_execution",
    match(Image,"(?i)UBPPatch\.Psh$"), "disguised_psh_executable_execution",
    match(Image,"(?i)HTSPnew\.Exe$"), "krsid_payload_execution",
    match(Hash,"6d2cd65dbd0df30404b08ff007359e54|a9cce44c4d42b07f114dd2b340f0046a|f86b2ece324cfd36e832a3b48cc3719b"), "known_krsid_sample_hash",
    1=1, "ubp_asset_path_or_updatelst_reference")
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Image, ParentImage, CommandLine, Hash, detection_reason
| where count > 0

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("UBPUpdater.exe", "UBPPatch.psh", "HTSPnew.exe")
   or InitiatingProcessFileName in~ ("UBPUpdater.exe", "UBPPatch.psh")
   or ProcessCommandLine has_any ("UBP-Asset", "Update.Lst")
   or MD5 in ("6d2cd65dbd0df30404b08ff007359e54", "a9cce44c4d42b07f114dd2b340f0046a", "f86b2ece324cfd36e832a3b48cc3719b")
| extend DetectionReason = case(
    FileName =~ "UBPUpdater.exe", "fake_hts_updater_execution",
    FileName =~ "UBPPatch.psh", "disguised_psh_executable_execution",
    FileName =~ "HTSPnew.exe", "krsid_payload_execution",
    isnotempty(MD5) and MD5 in ("6d2cd65dbd0df30404b08ff007359e54", "a9cce44c4d42b07f114dd2b340f0046a", "f86b2ece324cfd36e832a3b48cc3719b"), "known_krsid_sample_hash",
    "ubp_asset_path_or_updatelst_reference")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, MD5, DetectionReason

Sigma

title: KRSID Malicious HTS Update-Chain Execution (UBP Asset Fake Trading App)
id: 8f3d2b1a-6c4e-4a1f-9d2b-7e5c1a9f3b02
status: experimental
description: Detects execution of the fraudulent UBP Asset HTS update chain (UBPUpdater.Exe, UBPPatch.Psh, HTSPnew.Exe) or known KRSID ransomware sample hashes, delivered via Telegram/Band investment-fraud lures impersonating Union Bancaire Privée.
references:
    - https://asec.ahnlab.com/en/95469/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/17
tags:
    - attack.resource-development
    - attack.t1608.001
    - attack.initial-access
    - attack.t1566.003
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.008
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_names:
        Image|endswith:
            - '\UBPUpdater.Exe'
            - '\UBPPatch.Psh'
            - '\HTSPnew.Exe'
    selection_parent:
        ParentImage|endswith:
            - '\UBPUpdater.Exe'
            - '\UBPPatch.Psh'
    selection_cmdline:
        CommandLine|contains:
            - 'UBP-Asset'
            - 'Update.Lst'
    selection_hash:
        Hashes|contains:
            - '6D2CD65DBD0DF30404B08FF007359E54'
            - 'A9CCE44C4D42B07F114DD2B340F0046A'
            - 'F86B2ECE324CFD36E832A3B48CC3719B'
    condition: selection_names or selection_parent or selection_cmdline or selection_hash
falsepositives:
    - Legitimate internal software renamed with non-standard extensions during QA/test packaging (rare, verify hash)
level: critical

Known false positives:

• Legitimate internal software renamed with non-standard extensions during QA/test packaging (rare; verify against the published hash list)
• Unrelated third-party trading-software updaters that happen to use similarly generic 'Updater.exe'/'Patch' binary names but a different vendor/install path

Tuning notes: Baseline legitimate HTS/trading-software updater process names in the environment and exclude signed, allow-listed vendor binaries by hash; extend the MD5/SHA256 hash list as ASEC or other vendors publish additional KRSID sample hashes.

• 🔒 KRSID Malicious HTS Update-Chain Execution ([indicator] → [indicator] → [indicator]) · unlock with TL Creds
• 🔒 KRSID Second Execution Path via Compromised [indicator] & Operator CLI Flags · unlock with TL Creds
• 🔒 KRSID Ransomware C2 Domain Contact, Mass File Encryption ([indicator]) & Ransom Note Drop · unlock with TL Creds
• 🔒 KRSID Malicious HTS Update-Chain Execution ([indicator] → [indicator] → [indicator]) · unlock with TL Creds
• 🔒 KRSID Second Execution Path via Compromised [indicator] & Operator CLI Flags · unlock with TL Creds
• 🔒 KRSID Ransomware C2 Domain Contact, Mass File Encryption ([indicator]) & Ransom Note Drop · unlock with TL Creds
• 🔒 KRSID Second Execution Path via Compromised [indicator] & Operator CLI Flags · unlock with TL Creds
• 🔒 KRSID Ransomware C2 Domain Contact, Mass File Encryption ([indicator]) & Ransom Note Drop · unlock with TL Creds

Indicators of compromise for KRSID ransomware UBP trading scam

As of 2026-09-17, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-2555.

Sample indicators (3 of 21)

• Domain: phf-ubp[.]com
• File hash: 6d2cd65dbd0df30404b08ff007359e54
• File hash: a9cce44c4d42b07f114dd2b340f0046a

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

How KRSID ransomware UBP trading scam works

KRSID is a Rust-compiled ransomware family disclosed by AhnLab ASEC on 2026-09-16, notable for a distribution vector that fuses investment fraud with ransomware deployment rather than a typical phishing or exploit-driven chain. Fraud operators impersonate Union Bancaire Privée (UBP), a real Swiss private bank, through a fake Home Trading System (HTS) application branded "UBP Asset," installed into a "UBP-Asset" folder at the drive root. Victims are recruited through Telegram and Naver Band group chats with promises of overseas futures trading requiring only a minimal deposit — a fraud pattern with clear Korean precedent: ASEC disclosed on 2024-07-17 a separate compromised private HTS ('HPlus') whose legitimate updater (Asset.exe) was reconfigured via a hijacked config.ini/FTP update channel to deliver Quasar RAT (via StockProh.exe / Socketmanager240714.exe) — an almost identical fake-updater delivery pattern to the one used here; a Korean law firm publicly warned about the UBP Asset scheme specifically in approximately September 2025; and unrelated Korean law-enforcement operations (Operation Midas, 2024; a $19.6M Incheon futures-gambling ring, 2025) show the fake-HTS-as-malware/fraud-vector pattern is well established in the Korean threat landscape. The infection chain: a desktop shortcut launches "UBPUpdater.Exe", which executes "UBPPatch.Psh" (an executable disguised with a non-executable .psh extension); UBPPatch connects to the actor-controlled HTS update server at phf-ubp[.]com and downloads a configuration file, "Update.Lst", whose contents trigger download and execution of the KRSID payload, "HTSPnew.Exe". Separately, the legitimate-looking application component "UBP.Dll" (invoked by "UBP.Exe") is modified by the operators to add a command that also executes HTSPnew.Exe from the same install path, giving the actors a second execution path into the ransomware. The ransomware encrypts 150+ targeted file extensions (documents, source code, databases, media, archives, certificates/keys, and web/app source such as .php/.aspx/.jsp/.sql/.pem/.key/.crt) using AES-256 for file data and RSA-2048 to protect the AES keys, appends the .krsid extension to encrypted files, and drops a Korean-language ransom note (README_KRSID.Txt) that ASEC assesses was likely generated with AI assistance, directing victims to contact the operators via Telegram (handle Bratteam88). The binary supports operator-facing command-line flags (-Path, -Batch, -Pause, -Dry-run, -H/--help) and writes a local execution log (ransomware-silent.Log). It explicitly excludes a defined list of Windows system, recovery, and development folders (Windows, Program Files/Program Files (x86), ProgramData, $Recycle.Bin, System Volume Information, WinRE/Recovery/EFI/Boot, WindowsApps, AccountPictures, node_modules, target, .git, .cargo, .rustup, AppData) from encryption — avoiding an unbootable system — and does NOT delete Volume Shadow Copies, unlike many mainstream ransomware families — a detail relevant to recovery prioritization. No CVE, exploited vulnerability, or confirmed nation-state/named threat-actor attribution is present in the source reporting; the only actor-identifying artifact is the Telegram handle used for victim contact.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type

Command and Control

T1071.001 Web Protocols

Execution

T1204.002 Malicious File

Persistence

T1554 Compromise Host Software Binary

Initial Access

T1566.003 Spearphishing via Service

Resource Development

T1583.001 Domains; T1585.001 Social Media Accounts; T1608.001 Upload Malware

Impact

T1657 Financial Theft

Remediation for KRSID ransomware UBP trading scam

Immediate actions

• Block the domain phf-ubp[.]com and the URL path phf-ubp[.]com/UBPA/_hts_tv/user at DNS/web proxy and email/messaging gateways
• Hunt for and quarantine the identified MD5 hashes (6d2cd65dbd0df30404b08ff007359e54, a9cce44c4d42b07f114dd2b340f0046a, f86b2ece324cfd36e832a3b48cc3719b) via EDR/AV
• Hunt for file artifacts HTSPnew.Exe, UBPUpdater.Exe, UBPPatch.Psh, README_KRSID.Txt, and ransomware-silent.Log across endpoints
• Isolate any host presenting .krsid-extension files immediately to limit lateral spread
• Advise employees/customers who use any HTS/trading software of unknown provenance, especially any solicited via Telegram or Band group chats, not to install 'updates' outside official vendor channels

Workarounds

• Since KRSID does not delete Volume Shadow Copies, attempt Shadow Copy-based file recovery (vssadmin/System Restore) on affected hosts before considering the data unrecoverable

Longer-term hardening

• Deploy application allowlisting to prevent execution of unsigned/unknown trading-software binaries
• Deploy EDR with behavioral detection for mass file-rename/encryption activity and for RSA/AES bulk file operations by non-standard processes
• User awareness training specifically on investment-fraud recruitment via messaging apps (Telegram, Band, KakaoTalk) impersonating financial institutions
• Maintain offline/immutable backups given this family does not delete Volume Shadow Copies but future variants may add that capability

Affected and fixed versions

• N/A (fraudulent third-party application; not a legitimate vendor product) — "UBP Asset" fake Home Trading System (HTS) application impersonating Union Bancaire Privée
  Vulnerable versions: All versions/builds distributed via phf-ubp[.]com and its UBPUpdater.Exe/UBPPatch.Psh update mechanism

Timeline of KRSID ransomware UBP trading scam

• 2024-07-17 ASEC disclosed a compromised private HTS ('HPlus') whose legitimate updater (Asset.exe) was reconfigured via a hijacked config.ini/FTP update channel to deliver Quasar RAT (StockProh.exe / Socketmanager240714.exe) — establishing the fake-updater-as-malware-vector pattern that the locked-ioc-16/locked-ioc-21 campaign closely follows.
• 2024-12-11 South Korean authorities publicly disclosed the results of Operation Midas, a year-long takedown of 125 fake HTS trading platforms impersonating five financial companies, resulting in 32 arrests — establishing fake-HTS fraud as a recognized, recurring Korean threat pattern.
• 2025-09-01 A Korean law firm published a blog post warning specifically about the 'locked-ioc-16' investment fraud scheme (impersonating Union Bancaire Privée), predating public disclosure of the associated ransomware.
• 2025-11-06 Incheon Metropolitan Police arrested seven suspects operating a separate $19.6M illegal futures-gambling ring built on counterfeit HTS trading software, reinforcing that fake-HTS fraud infrastructure is an active, monetized Korean criminal ecosystem.
• 2026-08-11 Canadian Securities Administrators issued an investor alert on a separate, unrelated scheme impersonating Union Bancaire Privée to charge fraudulent fund-recovery fees, showing the UBP brand is being actively exploited by multiple independent fraud operations.
• 2026-09-16 ASEC publishes three MD5 file hashes, the distribution/C2 domain locked-ioc-11 and its download URL path, and the locked-ioc-17 contact handle (locked-ioc-14) used for ransom communication.
• 2026-09-16 ASEC's analysis details the malicious update chain (locked-ioc-8 -> locked-ioc-9 -> locked-ioc-13 config -> locked-ioc-12), a second execution path via a modified locked-ioc-19, the AI-generated Korean-language ransom note (locked-ioc-7), the 150+ targeted file-extension list and system-folder exclusion list, and confirms Volume Shadow Copies are not deleted.
• 2026-09-16 AhnLab ASEC publishes the first public report identifying locked-ioc-21, a Rust-based ransomware distributed via the fraudulent 'locked-ioc-16' HTS application, encrypting files with AES-256/RSA-2048 and appending the locked-ioc-20 extension.

Sources cited for KRSID ransomware UBP trading scam

• CSA Investor Alert: Fraudsters impersonate Union Bancaire Privée, UBP SA to target Canadian investors investright.org · Advisory · 2026-08-11
• Ransomware Distributed Through Fraudulent Private HTS Program asec.ahnlab.com · Research · 2026-09-16
• Private HTS Program Continuously Used in Attacks asec.ahnlab.com · Research · 2024-07-17
• South Korea Takes Down Fraudulent Online Trading Network (Operation Midas) infosecurity-magazine.com · News · 2024-12-11
• Korean Police Crack Down on Major Illegal Gambling Operation Involving Fake Trading Software newsnet5.com · News · 2025-11-06
• South Korean retail investors lost US$250mil from scams during stock swing thestar.com.my · News · 2026-09-16

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

Previous and next in ransomware

• Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed Previous report
• Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas Next report