Investment fraud rings in South Korea have spent years talking people into installing a fake stock trading app so they could take the money paid into it. AhnLab's Security intelligence Center now reports that one of those apps has started doing something else to the same victims: installing ransomware on their PCs.
The app is called UBP Asset, and it already has a history.
An app built to look like a bank
A home trading system, or HTS, is the desktop software Korean investors use to buy and sell stocks and futures. The legitimate ones come from licensed brokerages. This one impersonates the name and logo of the Swiss private bank Union Bancaire Privee, and according to a Korean law firm's September 2025 warning about the matching ub900[.]org impersonation site, victims were recruited through Telegram and Band group chats, pressed for deposits, and cut off when they refused to send more.
ASEC says the app that delivered the ransomware carries the same interface and the same UBP strings in its version information, which puts it in the same family. Fake trading platforms are a large and well organised business: IntelFusions covered a $187 million investment fraud network in August running the same recruitment pattern.
The update channel was the weapon
UBP Asset installs into a UBP-Asset folder at the root of the drive. Clicking the desktop shortcut runs UBPUpdater.exe, which in turn runs UBPPatch.psh. Despite that extension, the file is an executable: it contacts the update server and fetches Update.lst, the list of what to install.
From its own detection logs, ASEC concludes that UBPPatch.psh pulled an Update.lst configured to fetch ransomware and installed a file named HTSPnew.exe. The researchers also found that the current build of UBP.dll, which holds the application's real functionality, has gained a new instruction to execute HTSPnew.exe from the same folder. The update server is now unreachable, so the contents of that configuration file cannot be read directly.
A Rust encryptor with a Telegram handle
ASEC names the payload KRSID ransomware, after the .krsid extension it leaves behind. It is written in Rust, encrypts with AES-256 and RSA-2048, and drops a note called README_KRSID.txt, written in Korean, telling victims to make contact on Telegram under the handle Bratteam88. ASEC assesses from the wording that the note was produced with AI.
The encryptor takes command line arguments, including a dry run mode that only logs the files it would encrypt, and it skips system folders along with developer directories such as node_modules, .git and .cargo. Run with no arguments, it encrypts the whole drive. ASEC flags one omission as unusual: it does not delete volume shadow copies, which ransomware normally destroys precisely because those copies can be used to restore files.
Paying a fraud ring is not a recovery plan
The people hit by this have already been defrauded once, and as ASEC points out, it is unclear whether recovery is even possible after paying, given who is holding the key. South Korea's Financial Supervisory Service is blunter about prevention, in a line quoted in the report: "Legitimate financial institutions do not distribute private HTS software through messaging apps or similar channels." Install trading software only from a licensed brokerage's own website, and treat an investment app that arrives through a group chat as hostile. More on the country's threat picture sits on our South Korea profile, and AhnLab's full write up carries the analysis.
Indicators
- FQDN: phf-ubp[.]com
- URL: hxxps://phf-ubp[.]com/UBPA/_hts_tv/user
- MD5: 6d2cd65dbd0df30404b08ff007359e54, a9cce44c4d42b07f114dd2b340f0046a, f86b2ece324cfd36e832a3b48cc3719b
- Artifacts: HTSPnew.exe, README_KRSID.txt, ransomware-silent.log, .krsid extension
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.