Executive Summary
AhnLab SEcurity intelligence Center (ASEC) has identified a campaign where fraudulent investment groups, specifically those impersonating Union Bancaire Privee (UBP) as 'UBP Asset,' are distributing ransomware through private Home Trading Systems (HTS). Historically used to steal investment funds, these platforms now deliver KRSID ransomware, a Rust-based threat, and have previously delivered Quasar RAT.
The attack chain involves luring victims to install unlicensed HTS software via Telegram or KakaoTalk. Once installed, the HTS updater (UBPUpdater.exe) downloads a malicious configuration file that triggers the download and execution of ransomware. This shift from pure financial fraud to ransomware deployment indicates an escalation in the threat landscape for retail investors using unauthorized platforms.
This activity predominantly impacts individual investors in Korea. The use of private HTS software bypasses traditional financial security controls, and the inclusion of remote access tools like Quasar RAT allows for long-term system control and credential theft alongside file encryption.