Malware

Prestige Ransomware

Prestige ransomware is a Windows ransomware family first observed in October 2022 during attacks against transportation, logistics, and other organizations in Ukraine and Poland. It is a 32-bit Windows executable written in C/C++ that encrypts victim files and appends a new extension to affected data. The malware uses embedded cryptographic material, including a hardcoded RSA public key and references to Crypto++ as well as AES and DES, enabling file encryption without requiring network connectivity.

During execution, Prestige enumerates files, directories, processes, and system information, and modifies the Windows registry. It establishes a custom file association for encrypted files so that opening them displays the ransom note through a standard text editor. It also attempts to impair recovery by deleting backup catalogs and volume shadow copies, and it can stop services such as Microsoft SQL Server prior to encryption. Observed behavior indicates it encrypts data on the compromised host but did not demonstrate autonomous propagation across reachable shared folders in testing.

Prestige has been associated with intrusions in which attackers had already obtained privileged credentials before ransomware deployment, indicating use as a late-stage payload in broader post-compromise operations rather than as a self-spreading worm. Reporting has noted overlap in victimology with earlier disruptive activity affecting Ukrainian organizations, including some entities previously targeted by HermeticWiper, but no confirmed attribution to a specific threat actor or established ransomware group was available at the time of reporting.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

31 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1047Windows Management InstrumentationEvidence1

Windows WMI Process And Service List ... T1047 ... Windows Post-Exploitation, Prestige Ransomware

T1053Scheduled Task/JobEvidence1

Threat actors possibly used remote code execution tools and schedule the activities to run the payload on target systems.

T1059Command and Scripting InterpreterEvidence1

Mitre ATT&CK Tactics and Techniques Sr.no Tactics Technique ID 1 TA0002: Execution T1059: Command and Scripting Interpreter

T1106Native APIEvidence1

Mitre ATT&CK Tactics and Techniques Sr.no Tactics Technique ID 1 TA0002: Execution T1059: Command and Scripting Interpreter T1106: Native API

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

Threat actors possibly used remote code execution tools and schedule the activities to run the payload on target systems.

T1112Modify RegistryEvidence1

Prestige Ransomware uses reg.exe commands to register a custom file extension handler for files with .enc file extension.

T1543Create or Modify System ProcessEvidence1

Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence

T1547.005Security Support ProviderEvidence1

Windows Security Support Provider Reg Query ... Anomaly Endpoint T1547.005 Windows Post-Exploitation, Prestige Ransomware, Sneaky Active Directory Persistence Tricks

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

Threat actors possibly used remote code execution tools and schedule the activities to run the payload on target systems.

T1543Create or Modify System ProcessEvidence1

Annotations ID Technique Tactic T1543 Create or Modify System Process Persistence

T1547.005Security Support ProviderEvidence1

Windows Security Support Provider Reg Query ... Anomaly Endpoint T1547.005 Windows Post-Exploitation, Prestige Ransomware, Sneaky Active Directory Persistence Tricks

Stealth

3 techniques

T1070.004File DeletionEvidence1

Mitre ATT&CK Tactics and Techniques Sr.no Tactics Technique ID ... T1070.004: Indicator Removal on Host: File Deletion

T1202Indirect Command ExecutionEvidence1

Windows Indirect Command Execution Via Series Of Forfiles ... Anomaly Endpoint T1202 Windows Post-Exploitation, Prestige Ransomware

T1497Virtualization/Sandbox EvasionEvidence1

Mitre ATT&CK Tactics and Techniques Sr.no Tactics Technique ID ... T1497: Virtualization/Sandbox Evasion

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

Prestige Ransomware uses reg.exe commands to register a custom file extension handler for files with .enc file extension.

T1222File and Directory Permissions ModificationEvidence1

ICACLS Grant Command ... T1222 ... Modify ACL permission To Files Or Folder ... Excessive Usage Of Cacls App ... Icacls Deny Command

Credential Access

7 techniques

T1003.001LSASS MemoryEvidence1

Related Detections ... Dump LSASS via procdump ... Creation of lsass Dump with Taskmgr ... Access LSASS Memory for Dump Creation ... Detect Credential Dumping through LSASS access ... Dump LSASS via comsvcs DLL ... Windows Credential Dumping LSASS Memory Createdump ... Windows Possible Credential Dumping

T1003.005Cached Domain CredentialsEvidence1

Windows Cached Domain Credentials Reg Query ... Anomaly Endpoint T1003.005 Windows Post-Exploitation, Prestige Ransomware

T1552.002Credentials in RegistryEvidence1

Windows Credentials in Registry Reg Query ... Anomaly Endpoint T1552.002 Windows Post-Exploitation, Prestige Ransomware

T1552.004Private KeysEvidence1

Windows Private Keys Discovery ... Anomaly Endpoint T1552.004 Windows Post-Exploitation, Prestige Ransomware

T1555Credentials from Password StoresEvidence1

Windows Credentials from Password Stores Query ... Anomaly Endpoint T1555 Windows Post-Exploitation, Prestige Ransomware, DarkGate Malware, NetSupport RMM Tool Abuse

T1555.005Password ManagersEvidence1

Windows Password Managers Discovery ... Anomaly Endpoint T1555.005 Windows Post-Exploitation, Prestige Ransomware, Scattered Spider, Scattered Lapsus$ Hunters

T1558Steal or Forge Kerberos TicketsEvidence1

Windows Steal or Forge Kerberos Tickets Klist ... Hunting Endpoint T1558 ... Windows Post-Exploitation, Prestige Ransomware

Discovery

9 techniques

T1012Query RegistryEvidence2

Mitre ATT&CK Tactics and Techniques Sr.no Tactics Technique ID ... T1012: Query Registry

T1016System Network Configuration DiscoveryEvidence1

Windows System Network Config Discovery Display DNS ... Anomaly Endpoint T1016 Medusa Ransomware, Windows Post-Exploitation, Prestige Ransomware, Water Gamayun

T1033System Owner/User DiscoveryEvidence1

Windows System User Discovery Via Quser ... Hunting Endpoint T1033 Prestige Ransomware, Crypto Stealer, Windows Post-Exploitation

T1049System Network Connections DiscoveryEvidence1

Windows System Network Connections Discovery Netsh ... Anomaly Endpoint T1049 Windows Post-Exploitation, Prestige Ransomware, Snake Keylogger

T1057Process DiscoveryEvidence1

The Prestige Ransomware has the following capabilities Gathering System Information. Enumerating through directories, files, and processes.

T1082System Information DiscoveryEvidence2

The Prestige Ransomware has the following capabilities Gathering System Information.

T1083File and Directory DiscoveryEvidence1

Prestige Ransomware traverses the directories, files, and processes to encrypt the content of files that have one of the hardcoded file extensions.

T1497Virtualization/Sandbox EvasionEvidence1

Mitre ATT&CK Tactics and Techniques Sr.no Tactics Technique ID ... T1497: Virtualization/Sandbox Evasion

T1518.001Security Software DiscoveryEvidence1

Mitre ATT&CK Tactics and Techniques Sr.no Tactics Technique ID ... T1518.001: Software Discovery: Security Software Discovery

Collection

1 technique

T1115Clipboard DataEvidence1

Windows ClipBoard Data via Get-ClipBoard ... Anomaly Endpoint T1115 Windows Post-Exploitation, Prestige Ransomware

Impact

4 techniques

T1486Data Encrypted for ImpactEvidence1

Prestige Ransomware sample which Enumerates the directories/files and encrypts the victim’s specific files by renaming them to “.enc” file extension.

T1489Service StopEvidence1

Prestige Ransomware attempts to stop the MSSQL Windows service before encrypting the files using the net.exe command.

T1490Inhibit System RecoveryEvidence1

Prestige Ransomware runs the following command to delete the backup catalog from the system: – C:\Windows\System32\wbadmin.exe delete catalog -quiet Prestige Ransomware also runs the following command to delete volume shadow copies on the system: – C:\Windows\System32\vssadmin.exe delete shadows /all /quiet

T1531Account Access RemovalEvidence1

Windows User Disabled Via Net ... T1531 ... Excessive Usage Of Net App ... Windows User Deletion Via Net

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app3 years ago

email●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

splunk researchNews

Feb 25, 2026

Detection: Excessive Usage Of Cacls App | Splunk Security Content

Associated Analytic Story Azorult ... Crypto Stealer ... Prestige Ransomware ... XMRig

splunk researchNews

Feb 25, 2026

Detection: Schtasks scheduling job on remote system | Splunk Security Content

Associated Analytic Story Active Directory Lateral Movement ... NOBELIUM Group ... Phemedrone Stealer ... Prestige Ransomware ... Quasar RAT ... RedLine Stealer ... Scheduled Tasks

splunk researchNews

May 2, 2025

Detection: Windows New Default File Association Value Set | Splunk Security Content

Associated Analytic Story Data Destruction Hermetic Wiper Prestige Ransomware Windows Persistence Techniques Windows Privilege Escalation Windows Registry Abuse

cyfirma blogNews

Dec 4, 2023

Ukraine Industries Attacked by Prestige Ransomware

Ransomware that enumerates directories, files, and processes; encrypts victim files by appending the .enc extension; drops a ransom note at C:\Users\Public\README; registers a custom file extension handler to display the ransom note; deletes volume shadow copies and backup catalogs; and can encrypt files offline using a hardcoded RSA public key with references to AES and DES.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping31

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Prestige Ransomware