KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Software
KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home (TL-2026-2555) is a high-severity ransomware operation, first published 2026-09-17. It has no confirmed attribution, affects N/A (fraudulent third-party application; not a legitimate vendor, maps to 10 MITRE ATT&CK techniques (T1036.005, T1036.008, T1071.001), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-2555
- Threat ID
- TL-2026-2555
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-09-17
- Last reviewed
- 2026-09-17
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, individuals retail-investors
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home
Malware and tooling: KRSID
AhnLab ASEC reports a Rust-based ransomware family named KRSID being distributed through a fake Home Trading System (HTS) application called "UBP Asset" that impersonates Swiss private bank Union Bancaire Privée. Operators lure victims into an overseas futures-trading investment fraud scheme via Telegram and Band group chats, then push a malicious "update" that deploys the ransomware, which encrypts files with AES-256/RSA-2048, appends the .krsid extension, and drops an AI-generated, Korean-language ransom note.
How KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home works
KRSID is a Rust-compiled ransomware family disclosed by AhnLab ASEC on 2026-09-16, notable for a distribution vector that fuses investment fraud with ransomware deployment rather than a typical phishing or exploit-driven chain. Fraud operators impersonate Union Bancaire Privée (UBP), a real Swiss private bank, through a fake Home Trading System (HTS) application branded "UBP Asset," installed into a "UBP-Asset" folder at the drive root. Victims are recruited through Telegram and Naver Band group chats with promises of overseas futures trading requiring only a minimal deposit — a fraud pattern with clear Korean precedent: ASEC disclosed on 2024-07-17 a separate compromised private HTS ('HPlus') whose legitimate updater (Asset.exe) was reconfigured via a hijacked config.ini/FTP update channel to deliver Quasar RAT (via StockProh.exe / Socketmanager240714.exe) — an almost identical fake-updater delivery pattern to the one used here; a Korean law firm publicly warned about the UBP Asset scheme specifically in approximately September 2025; and unrelated Korean law-enforcement operations (Operation Midas, 2024; a $19.6M Incheon futures-gambling ring, 2025) show the fake-HTS-as-malware/fraud-vector pattern is well established in the Korean threat landscape. The infection chain: a desktop shortcut launches "UBPUpdater.Exe", which executes "UBPPatch.Psh" (an executable disguised with a non-executable .psh extension); UBPPatch connects to the actor-controlled HTS update server at phf-ubp[.]com and downloads a configuration file, "Update.Lst", whose contents trigger download and execution of the KRSID payload, "HTSPnew.Exe". Separately, the legitimate-looking application component "UBP.Dll" (invoked by "UBP.Exe") is modified by the operators to add a command that also executes HTSPnew.Exe from the same install path, giving the actors a second execution path into the ransomware. The ransomware encrypts 150+ targeted file extensions (documents, source code, databases, media, archives, certificates/keys, and web/app source such as .php/.aspx/.jsp/.sql/.pem/.key/.crt) using AES-256 for file data and RSA-2048 to protect the AES keys, appends the .krsid extension to encrypted files, and drops a Korean-language ransom note (README_KRSID.Txt) that ASEC assesses was likely generated with AI assistance, directing victims to contact the operators via Telegram (handle Bratteam88). The binary supports operator-facing command-line flags (-Path, -Batch, -Pause, -Dry-run, -H/--help) and writes a local execution log (ransomware-silent.Log). It explicitly excludes a defined list of Windows system, recovery, and development folders (Windows, Program Files/Program Files (x86), ProgramData, $Recycle.Bin, System Volume Information, WinRE/Recovery/EFI/Boot, WindowsApps, AccountPictures, node_modules, target, .git, .cargo, .rustup, AppData) from encryption — avoiding an unbootable system — and does NOT delete Volume Shadow Copies, unlike many mainstream ransomware families — a detail relevant to recovery prioritization. No CVE, exploited vulnerability, or confirmed nation-state/named threat-actor attribution is present in the source reporting; the only actor-identifying artifact is the Telegram handle used for victim contact.
MITRE ATT&CK techniques used in TL-2026-2555
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type
Command and Control
Execution
Persistence
T1554 Compromise Host Software Binary
Initial Access
T1566.003 Spearphishing via Service
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1608.001 Upload Malware
Impact
Affected products and versions in KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home
- N/A (fraudulent third-party application; not a legitimate vendor product) — "UBP Asset" fake Home Trading System (HTS) application impersonating Union Bancaire Privée
Vulnerable versions: All versions/builds distributed via phf-ubp[.]com and its UBPUpdater.Exe/UBPPatch.Psh update mechanism
Remediation for KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home
Immediate actions
- Block the domain phf-ubp[.]com and the URL path phf-ubp[.]com/UBPA/_hts_tv/user at DNS/web proxy and email/messaging gateways
- Hunt for and quarantine the identified MD5 hashes (6d2cd65dbd0df30404b08ff007359e54, a9cce44c4d42b07f114dd2b340f0046a, f86b2ece324cfd36e832a3b48cc3719b) via EDR/AV
- Hunt for file artifacts HTSPnew.Exe, UBPUpdater.Exe, UBPPatch.Psh, README_KRSID.Txt, and ransomware-silent.Log across endpoints
- Isolate any host presenting .krsid-extension files immediately to limit lateral spread
- Advise employees/customers who use any HTS/trading software of unknown provenance, especially any solicited via Telegram or Band group chats, not to install 'updates' outside official vendor channels
Workarounds
- Since KRSID does not delete Volume Shadow Copies, attempt Shadow Copy-based file recovery (vssadmin/System Restore) on affected hosts before considering the data unrecoverable
Longer-term hardening
- Deploy application allowlisting to prevent execution of unsigned/unknown trading-software binaries
- Deploy EDR with behavioral detection for mass file-rename/encryption activity and for RSA/AES bulk file operations by non-standard processes
- User awareness training specifically on investment-fraud recruitment via messaging apps (Telegram, Band, KakaoTalk) impersonating financial institutions
- Maintain offline/immutable backups given this family does not delete Volume Shadow Copies but future variants may add that capability
Timeline of KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home
- ASEC disclosed a compromised private HTS ('HPlus') whose legitimate updater (Asset.exe) was reconfigured via a hijacked config.ini/FTP update channel to deliver Quasar RAT (StockProh.exe / Socketmanager240714.exe) — establishing the fake-updater-as-malware-vector pattern that the UBP Asset/KRSID campaign closely follows.
- South Korean authorities publicly disclosed the results of Operation Midas, a year-long takedown of 125 fake HTS trading platforms impersonating five financial companies, resulting in 32 arrests — establishing fake-HTS fraud as a recognized, recurring Korean threat pattern.
- A Korean law firm published a blog post warning specifically about the 'UBP Asset' investment fraud scheme (impersonating Union Bancaire Privée), predating public disclosure of the associated ransomware.
- Incheon Metropolitan Police arrested seven suspects operating a separate $19.6M illegal futures-gambling ring built on counterfeit HTS trading software, reinforcing that fake-HTS fraud infrastructure is an active, monetized Korean criminal ecosystem.
- Canadian Securities Administrators issued an investor alert on a separate, unrelated scheme impersonating Union Bancaire Privée to charge fraudulent fund-recovery fees, showing the UBP brand is being actively exploited by multiple independent fraud operations.
- ASEC publishes three MD5 file hashes, the distribution/C2 domain phf-ubp[.]com and its download URL path, and the Telegram contact handle (Bratteam88) used for ransom communication.
- ASEC's analysis details the malicious update chain (UBPUpdater.Exe -> UBPPatch.Psh -> Update.Lst config -> HTSPnew.Exe), a second execution path via a modified UBP.Dll, the AI-generated Korean-language ransom note (README_KRSID.Txt), the 150+ targeted file-extension list and system-folder exclusion list, and confirms Volume Shadow Copies are not deleted.
- AhnLab ASEC publishes the first public report identifying KRSID, a Rust-based ransomware distributed via the fraudulent 'UBP Asset' HTS application, encrypting files with AES-256/RSA-2048 and appending the .krsid extension.
Sources cited for KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home
- Ransomware Distributed Through Fraudulent Private HTS Program
- Private HTS Program Continuously Used in Attacks
- CSA Investor Alert: Fraudsters impersonate Union Bancaire Privée, UBP SA to target Canadian investors
- South Korea Takes Down Fraudulent Online Trading Network (Operation Midas)
- Korean Police Crack Down on Major Illegal Gambling Operation Involving Fake Trading Software
- South Korean retail investors lost US$250mil from scams during stock swing
More in ransomware
- Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas
- Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed
- Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices
- Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation
- Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass
Detection coverage for TL-2026-2555
As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2555 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.