• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    KRSID Ransomware Deployment via UBPPatch.Psh Downloading Update.Lst

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Sep 20, 2026•0•0•5

    Detects malicious activity involving the HTS software update mechanism, where the legitimate updater or patch processes are leveraged to download and execute the HTSPnew.exe ransomware payload.

    Sigma

    Tags

    T1195.002 - Compromise Software Supply ChainT1486 - Data Encrypted for ImpactTA0040 - ImpactProcess CreationFile Executable DetectedWindowsWindows Sysmonattack.t1195.002attack.t1486

    Found in

    • KRSID Ransomware Distributed via Fraudulent Private HTSLast updated Sep 20, 2026
    • KRSID Ransomware Distributed via Fraudulent Private HTSLast updated Sep 20, 2026
    • KRSID Ransomware Distributed via Fraudulent Private HTSLast updated Sep 20, 2026
    • KRSID Ransomware Distributed via Fraudulent Private HTSLast updated Sep 20, 2026
    • KRSID Ransomware Distributed via Fraudulent Private HTSLast updated Sep 20, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?