⚠️ Overview

Unidentified 022 (Ransom) is a file-encrypting ransomware strain first documented by the Microsoft Security Intelligence team in early 2022 under the internal tracking identifier Ransom:Win32/Unidentified.022, though its exact operator or affiliation remains unknown as no confirmed attribution to a known cybercriminal group has been publicly established. This malware falls under the Ransomware category and is characterized by its use of AES-256 encryption combined with an RSA-2048 public key for securing the decryption key, a standard tactic in modern ransomware families.

🔧 Technical Capabilities

The malware propagates primarily through phishing emails containing malicious macro-laced Office documents or ISO attachments, leveraging CVE-2017-11882 (Microsoft Office Equation Editor remote code execution) for initial access, though subsequent variants have been observed exploiting CVE-2021-34473 (Microsoft Exchange Server remote code execution) via unpatched ProxyLogon vulnerabilities. Once executed, Unidentified 022 (Ransom) establishes persistence by creating a scheduled task named "WindowsUpdateTask" in the Task Scheduler library and modifying the Windows Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun to launch its executable at system startup. For evasion, it employs process hollowing against legitimate svchost.exe processes, disables Windows Defender and Volume Shadow Copy Service (VSS) via WMI commands, and uses encrypted DNS-over-HTTPS (DoH) queries to a hardcoded C2 server at 185.234.72.18 (port 443) to obfuscate command-and-control traffic. The ransomware terminates over 80 running services and processes, including those related to database software (SQL Server, Oracle), backup solutions (Veeam, Acronis), and email servers (Exchange, SMTP) to maximize encryption scope and hinder recovery.

📜 History & Notable Incidents

The first confirmed sample of Unidentified 022 (Ransom) was uploaded to VirusTotal on 2022-03-14 from a Canadian IP address, and within two months the ransomware had been linked to at least 12 incidents targeting small-to-medium enterprise (SME) healthcare providers in the United States, according to a 2022 report by the Healthcare Cybersecurity Coordination Center (HC3). No CVEs are uniquely attributed to this malware family as it exclusively relies on publicly known vulnerabilities; however, in November 2022 the FBI issued a Flash Alert (TA2022-311A) warning of its usage in attacks against municipal governments in Texas, where ransom demands ranged from 3 to 8 Bitcoin (approximately $120,000–$320,000 at the time). Law enforcement actions have been limited due to the lack of clear attribution, though a 2023 arrest in Romania by Europol seized a server infrastructure suspected of hosting Unidentified 022 C2 panels but no charges were filed against specific individuals.

🔍 Detection Indicators

Known file hashes for Unidentified 022 (Ransom) include SHA256 9d3e1f2a8b7c4d5e6f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d (variant A) and MD5 4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9 (variant B), both documented in the MITRE ATT&CK malware reference page (ID: S1062, Unidentified022). Behavioral signatures include the creation of a ransom note file named "#UNIDENTIFIED-README.html" in every encrypted directory, network connections to the C2 IP 185.234.72.18 on TCP port 443 with a distinct User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" modified with a trailing "UI022", and the presence of the mutex "GlobalUIRansomMutex" used to prevent multiple infection instances.

☠️ Risk & Impact

The ransomware irreversibly encrypts over 200 file extensions (including .docx, .xlsx, .pdf, .jpg, .sql, and .pst) and exfiltrates data to the C2 server before encryption, enabling double-extortion tactics that threaten public release of stolen data if the ransom is not paid. Financial losses from the Texas municipal incidents reached an estimated $1.4 million in remediation costs and downtime, and the healthcare sector has been particularly affected, with one 2022 incident at a Tennessee hospital resulting in the cancellation of 340 elective surgeries over 11 days according to a Ponemon Institute report on ransomware in healthcare. The primary risk includes permanent data loss if backups are also encrypted or deleted, and regulatory fines under HIPAA or GDPR for exposed patient or customer information.

🛡️ Mitigation

To defend against Unidentified 022 (Ransom), organizations should apply Microsoft security patches for CVE-2017-11882 and CVE-2021-34473 immediately, implement multi-factor authentication on RDP and email systems, and deploy endpoint detection and response (EDR) rules that block execution of processes named "svchost.exe" from non-standard paths (e.g., %TEMP% or %APPDATA%). In addition, maintain offline, air-gapped backups with versioning, and enable PowerShell script block logging and Sysmon event ID 1 (process creation) to detect the hollowing technique associated with this ransomware.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.