# MA-1076.052024: MyCERT Advisory - Estate Ransomware

**Date:** 28 May 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1076.052024  
**Advisory ID:** MA-1076.052024

---

**1.0 Introduction**
CyberSecurity Malaysia has recently observed ransomware-
**2.0 Impact**
The impacts of Estate Ransomware are:
- **Operations disruption** with essential functions coming to a halt.
- **Extortion** by the hackers for financial gain.
- **Data leakage** if the victim does not comply.
**3.0 Indicator of Compromise**
A .6AklzADP4 file extension is added to file names that are encrypted and a ransom note titled 6AklzADP4.README is left on the compromised system.
Below is shown in Figure 1, Estate Ransomware drops a ransom note named “6AklzADP4.README” as a .txt file – the note provides the instruction to contact the group via email.
Figure 1: Estate ransom note.
**4.0 Recommendations**
It should be noted that, as of now, there is no decryptor available to decrypt files encrypted by Estate Ransomware. Nevertheless, there are some recommendations for immediate protection against general ransomware attacks, including Estate Ransomware, as below:
**4.1 Recommendations for System Administrators:**
1. Organisations must proactively monitor and screen for compromised credentials potentially due to Infostealers infection. Infostealers could be part of a bigger attack like ransomware. Hence, compromised credentials must be immediately rectified by changing the passwords to strong passwords.
2. Implementing password revocation to enforce password changing.
3. Encourage employees to use secure password managers and longer passphrases, avoid using the same password for multiple accounts and set reminders to change passwords after several months.
4. Use multi-factor authentication to identify and protect the businesses' critical assets and access to critical information systems.
5. Restrict access authorisations according to user roles and develop authorisation policy to secure idle accounts; automatically lock accounts and alert IT staff after several failed login attempts.
6. Review Active Directory (AD) to locate and close existing backdoors such as compromised service accounts, which often have administrative privileges and are often targeted by attackers who aim to steal credentials.
7. Update security patches and antivirus software regularly.
8. Perform Data backups daily and test regularly. Place backup copies in a remote location.
9. Conduct IS awareness training for all staff at least once a year.
10. Do not download suspicious files from an unknown sender.
11. Conduct Disaster Recovery Plan review and update, if necessary.
12. Conduct Business Continuity Plan review and update, if necessary.
**4.2 Recommendations for Internet users:**
1. Users should use strong and unique passwords.
2. Users should use secure passwords for the network.
3. Users should be wary of phishing attempts and must not simply click on any links or executables they receive via social media and other messaging applications.
4. Users should practice safe browsing and backup data regularly.
5. Users should download software or applications from reputable sources.
6. Users should be wary and suspicious of applications circulated on social media for downloads.
7. Enable and use up-to-date anti-virus software.
8. Do regular security updates and patches.
9. Contact relevant authorities such as CyberSecurity Malaysia for inquiries and assistance 
10. Users are also encouraged to report to the Service Providers or the social media platform concerning the circulation of posts or ads with suspicious links.
Generally, CyberSecurity Malaysia advises users to be updated with the latest security announcements and follow best security practices to protect against ransomware attacks.
For further enquiries or to report an incident, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)