# KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Software

> AhnLab ASEC reports a Rust-based ransomware family named KRSID being distributed through a fake Home Trading System (HTS) application called "UBP Asset" that impersonates Swiss private bank Union Bancaire Privée. Operators lure victims into an overseas futures-trading investment fraud scheme via Telegram and Band group chats, then push a malicious "update" that deploys the ransomware, which encrypts files with AES-256/RSA-2048, appends the .krsid extension, and drops an AI-generated, Korean-language ransom note.

- **Published:** 2026-09-17T00:00:00Z
- **Last reviewed:** 2026-09-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2555
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-krsid-ransomware-ubp-trading-scam-tl-2026-2555.webp?v=f5fe9bfa (Threadlinqs threat intel: KRSID Ransomware via Fake Trading App: Detection & IOCs (TL-2026-2555) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-2555
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

KRSID is a Rust-compiled ransomware family disclosed by AhnLab ASEC on 2026-09-16, notable for a distribution vector that fuses investment fraud with ransomware deployment rather than a typical phishing or exploit-driven chain. Fraud operators impersonate Union Bancaire Privée (UBP), a real Swiss private bank, through a fake Home Trading System (HTS) application branded "UBP Asset," installed into a "UBP-Asset" folder at the drive root. Victims are recruited through Telegram and Naver Band group chats with promises of overseas futures trading requiring only a minimal deposit — a fraud pattern with clear Korean precedent: ASEC disclosed on 2024-07-17 a separate compromised private HTS ('HPlus') whose legitimate updater (Asset.exe) was reconfigured via a hijacked config.ini/FTP update channel to deliver Quasar RAT (via StockProh.exe / Socketmanager240714.exe) — an almost identical fake-updater delivery pattern to the one used here; a Korean law firm publicly warned about the UBP Asset scheme specifically in approximately September 2025; and unrelated Korean law-enforcement operations (Operation Midas, 2024; a $19.6M Incheon futures-gambling ring, 2025) show the fake-HTS-as-malware/fraud-vector pattern is well established in the Korean threat landscape. The infection chain: a desktop shortcut launches "UBPUpdater.Exe", which executes "UBPPatch.Psh" (an executable disguised with a non-executable .psh extension); UBPPatch connects to the actor-controlled HTS update server at phf-ubp[.]com and downloads a configuration file, "Update.Lst", whose contents trigger download and execution of the KRSID payload, "HTSPnew.Exe". Separately, the legitimate-looking application component "UBP.Dll" (invoked by "UBP.Exe") is modified by the operators to add a command that also executes HTSPnew.Exe from the same install path, giving the actors a second execution path into the ransomware. The ransomware encrypts 150+ targeted file extensions (documents, source code, databases, media, archives, certificates/keys, and web/app source such as .php/.aspx/.jsp/.sql/.pem/.key/.crt) using AES-256 for file data and RSA-2048 to protect the AES keys, appends the .krsid extension to encrypted files, and drops a Korean-language ransom note (README_KRSID.Txt) that ASEC assesses was likely generated with AI assistance, directing victims to contact the operators via Telegram (handle Bratteam88). The binary supports operator-facing command-line flags (-Path, -Batch, -Pause, -Dry-run, -H/--help) and writes a local execution log (ransomware-silent.Log). It explicitly excludes a defined list of Windows system, recovery, and development folders (Windows, Program Files/Program Files (x86), ProgramData, $Recycle.Bin, System Volume Information, WinRE/Recovery/EFI/Boot, WindowsApps, AccountPictures, node_modules, target, .git, .cargo, .rustup, AppData) from encryption — avoiding an unbootable system — and does NOT delete Volume Shadow Copies, unlike many mainstream ransomware families — a detail relevant to recovery prioritization. No CVE, exploited vulnerability, or confirmed nation-state/named threat-actor attribution is present in the source reporting; the only actor-identifying artifact is the Telegram handle used for victim contact.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1608.001 Upload Malware
- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1554 Compromise Host Software Binary
- T1036.005 Match Legitimate Resource Name or Location
- T1036.008 Masquerade File Type
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**KRSID Malicious HTS Update-Chain Execution (UBPUpdater.Exe → UBPPatch.Psh → HTSPnew.Exe)** (`TL-2026-2555-SPL-001`)

Detects execution of the fraudulent 'UBP Asset' HTS update chain that delivers the KRSID ransomware payload: UBPUpdater.Exe launching UBPPatch.Psh (an executable disguised with a non-executable .psh extension), the UBP-Asset install path or Update.Lst configuration file appearing on the command line, execution of the HTSPnew.Exe payload, or a process matching one of the three published KRSID sample MD5 hashes. This is the exploitation-stage trigger for the entire investment-fraud-to-ransomware chain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036.008, T1105, T1566.003
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon OR index=endpoint OR index=edr sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(Image="*\\UBPUpdater.Exe" OR Image="*\\UBPPatch.Psh" OR Image="*\\HTSPnew.Exe" OR ParentImage="*\\UBPUpdater.Exe" OR ParentImage="*\\UBPPatch.Psh" OR CommandLine="*UBP-Asset*" OR CommandLine="*Update.Lst*" OR Hash="6d2cd65dbd0df30404b08ff007359e54" OR Hash="a9cce44c4d42b07f114dd2b340f0046a" OR Hash="f86b2ece324cfd36e832a3b48cc3719b")
| eval detection_reason=case(
    match(Image,"(?i)UBPUpdater\.Exe$"), "fake_hts_updater_execution",
    match(Image,"(?i)UBPPatch\.Psh$"), "disguised_psh_executable_execution",
    match(Image,"(?i)HTSPnew\.Exe$"), "krsid_payload_execution",
    match(Hash,"6d2cd65dbd0df30404b08ff007359e54|a9cce44c4d42b07f114dd2b340f0046a|f86b2ece324cfd36e832a3b48cc3719b"), "known_krsid_sample_hash",
    1=1, "ubp_asset_path_or_updatelst_reference")
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, User, Image, ParentImage, CommandLine, Hash, detection_reason
| where count > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("UBPUpdater.exe", "UBPPatch.psh", "HTSPnew.exe")
   or InitiatingProcessFileName in~ ("UBPUpdater.exe", "UBPPatch.psh")
   or ProcessCommandLine has_any ("UBP-Asset", "Update.Lst")
   or MD5 in ("6d2cd65dbd0df30404b08ff007359e54", "a9cce44c4d42b07f114dd2b340f0046a", "f86b2ece324cfd36e832a3b48cc3719b")
| extend DetectionReason = case(
    FileName =~ "UBPUpdater.exe", "fake_hts_updater_execution",
    FileName =~ "UBPPatch.psh", "disguised_psh_executable_execution",
    FileName =~ "HTSPnew.exe", "krsid_payload_execution",
    isnotempty(MD5) and MD5 in ("6d2cd65dbd0df30404b08ff007359e54", "a9cce44c4d42b07f114dd2b340f0046a", "f86b2ece324cfd36e832a3b48cc3719b"), "known_krsid_sample_hash",
    "ubp_asset_path_or_updatelst_reference")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, MD5, DetectionReason
```

### Sigma

```yaml
title: KRSID Malicious HTS Update-Chain Execution (UBP Asset Fake Trading App)
id: 8f3d2b1a-6c4e-4a1f-9d2b-7e5c1a9f3b02
status: experimental
description: Detects execution of the fraudulent UBP Asset HTS update chain (UBPUpdater.Exe, UBPPatch.Psh, HTSPnew.Exe) or known KRSID ransomware sample hashes, delivered via Telegram/Band investment-fraud lures impersonating Union Bancaire Privée.
references:
    - https://asec.ahnlab.com/en/95469/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/17
tags:
    - attack.resource-development
    - attack.t1608.001
    - attack.initial-access
    - attack.t1566.003
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.008
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_names:
        Image|endswith:
            - '\UBPUpdater.Exe'
            - '\UBPPatch.Psh'
            - '\HTSPnew.Exe'
    selection_parent:
        ParentImage|endswith:
            - '\UBPUpdater.Exe'
            - '\UBPPatch.Psh'
    selection_cmdline:
        CommandLine|contains:
            - 'UBP-Asset'
            - 'Update.Lst'
    selection_hash:
        Hashes|contains:
            - '6D2CD65DBD0DF30404B08FF007359E54'
            - 'A9CCE44C4D42B07F114DD2B340F0046A'
            - 'F86B2ECE324CFD36E832A3B48CC3719B'
    condition: selection_names or selection_parent or selection_cmdline or selection_hash
falsepositives:
    - Legitimate internal software renamed with non-standard extensions during QA/test packaging (rare, verify hash)
level: critical
```

**Known false positives:**

- Legitimate internal software renamed with non-standard extensions during QA/test packaging (rare; verify against the published hash list)
- Unrelated third-party trading-software updaters that happen to use similarly generic 'Updater.exe'/'Patch' binary names but a different vendor/install path

**Tuning notes:** Baseline legitimate HTS/trading-software updater process names in the environment and exclude signed, allow-listed vendor binaries by hash; extend the MD5/SHA256 hash list as ASEC or other vendors publish additional KRSID sample hashes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- KRSID Malicious HTS Update-Chain Execution ([indicator] → [indicator] → [indicator]) (locked: unlock with TL Creds)
- KRSID Second Execution Path via Compromised [indicator] & Operator CLI Flags (locked: unlock with TL Creds)
- KRSID Ransomware C2 Domain Contact, Mass File Encryption ([indicator]) & Ransom Note Drop (locked: unlock with TL Creds)
- KRSID Malicious HTS Update-Chain Execution ([indicator] → [indicator] → [indicator]) (locked: unlock with TL Creds)
- KRSID Second Execution Path via Compromised [indicator] & Operator CLI Flags (locked: unlock with TL Creds)
- KRSID Ransomware C2 Domain Contact, Mass File Encryption ([indicator]) & Ransom Note Drop (locked: unlock with TL Creds)
- KRSID Second Execution Path via Compromised [indicator] & Operator CLI Flags (locked: unlock with TL Creds)
- KRSID Ransomware C2 Domain Contact, Mass File Encryption ([indicator]) & Ransom Note Drop (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- Domain: `phf-ubp[.]com`
- File hash: `6d2cd65dbd0df30404b08ff007359e54`
- File hash: `a9cce44c4d42b07f114dd2b340f0046a`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware Distributed Through Fraudulent Private HTS Program](https://asec.ahnlab.com/en/95469/)
- [Private HTS Program Continuously Used in Attacks](https://asec.ahnlab.com/en/79805/)
- [CSA Investor Alert: Fraudsters impersonate Union Bancaire Privée, UBP SA to target Canadian investors](https://www.investright.org/news-and-insights/investor-alerts/csa-investor-alert-fraudsters-impersonate-union-bancaire-privee-ubp-sa-to-target-canadian-investors/)
- [South Korea Takes Down Fraudulent Online Trading Network (Operation Midas)](https://www.infosecurity-magazine.com/news/south-korea-takes-down-fraudulent/)
- [Korean Police Crack Down on Major Illegal Gambling Operation Involving Fake Trading Software](https://www.newsnet5.com/news/korean-police-crack-down-illegal-gambling-operation-fake-trading-software/)
- [South Korean retail investors lost US$250mil from scams during stock swing](https://www.thestar.com.my/aseanplus/aseanplus-news/2026/09/16/south-korean-retail-investors-lost-us250mil-from-scams-during-stock-swing)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2555