Colombia's national cyber emergency team has published an analysis of a ransomware intrusion in which the attackers spent time mining cryptocurrency on the victim's machines before turning around and encrypting them.
The alert, COLCERT AL 20260809 111, describes a Ransomware-as-a-Service operation aimed at operational disruption. colCERT does not name the affected organization, and it stops short of attributing the activity to a known crew.
What the attackers did
colCERT reconstructs a clear sequence. The intruders moved laterally using PsExec with administrator credentials, dropped loaders disguised as legitimate operating system processes, and deployed a cryptomining kit of four closely related executables dressed up as Windows Media Player components. Along the way they harvested sensitive information out of PowerShell command history on multiple systems. Mass file encryption came last.
One technique shows up again and again. More than a dozen archives contained Microsoft's legitimate, digitally signed WmiPrvSE.exe sitting next to malicious DLLs, the signature of DLL side-loading (MITRE ATT&CK T1574.002): a trusted signed program is made to load an attacker's library from a directory the attacker controls, so the malicious code runs wearing the reputation of the process hosting it.
An encryptor stitched together from three families
The indicators and behavior matched the LockBit family, but colCERT says the encryption binary itself is a hybrid, carrying techniques associated with LockBit, BlackMatter and EnigmaLocker at once. The team reads that as a modified builder, or as components from several families merged into a single artifact.
The binary is packed and obfuscated to frustrate analysis, injects code into WerFault.exe, the Windows error reporting process, to hide its execution, and validates the system date and the machine's regional language settings before running, which colCERT describes as anti-analysis measures. It can encrypt selectively or in bulk.
Why it matters beyond one victim
colCERT's stated concern is not this single case. It is that one threat actor is reusing the same toolset, which in the team's assessment raises the likelihood of further compromises at other organizations. The mining kit is the tell worth remembering: the attackers monetized the victim's own compute first and then destroyed the same estate for a ransom, which points to an operator squeezing value out of access every way it can rather than one working toward a single payout.
What you should do
The published alert is a behavioral writeup rather than an indicator dump, and colCERT holds the full IoC list. Defenders can still act on the tradecraft it describes: restrict and monitor PsExec use along with the administrator credentials that make it work, alert on WmiPrvSE.exe running from anywhere other than its system directory, look for code injection into WerFault.exe, and treat unexplained CPU load as a possible precursor to encryption rather than a billing nuisance, because here the miner landed first.
This is the third colCERT alert we have covered in a week, after its warnings on fake court notices carrying a data stealing worm and on a Remcos spyware case. It also fits a wider pattern of intruders monetizing access with miners and tunnels before doing anything louder. Our Colombia country profile tracks the broader picture.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.