PrimeXM fends off hosted MT4/5 server hack attack and ransom demand

There have been rumors circulating in the FX world the past few days about a targeted hack attack against FX broker tech, liquidity, and hosting provider PrimeXM, specifically targeting its MT4/5 hosted servers. PrimeXM provides dedicated MT4/5 hosting and connectivity services for quite a number of FX and CFD brokers.

The rumors have included multiple PrimeXM-hosted brokers being “down” and at risk of losing client data, and PrimeXM itself being asked to pay ransom to free everything up. We understand that these rumors are a large exaggeration of what actually happened.

So what did (and didn’t) happen?

Well to begin, on Thursday evening part of PrimeXM’s hosted servers were indeed hit by a ransomware attack. The company did manage to decrypt most files that got encrypted. Ultimately, less than 3% of PrimeXM hosted clients experienced any impact to their trading operations. And, at no point did PrimeXM enter into any negotiations with the attackers nor has it met any of their demands – i.e. no ransom was paid by PrimeXM.

The security of PrimeXM’s internal systems, including its XCore trading infrastructure, was not compromised nor suffered any interruptions at any point. Also, no traces of any data leaks were found.

PrimeXM put together the following incident report, which it provided late Monday to its clients, outlining a detailed review if what happened, and PrimeXM’s response, from Thursday evening until the issue was fully resolved late Sunday GMT.

Dear Clients,

We would like to share with you the sequence of events in regards to the recent attack on parts of our hosting infrastructure. The attack was discovered on THU the 9th of December 2021. All timestamps below are approximate and in GMT:

Sequence of events:

Thursday 18:50: A client reports inability to restart his MT5 History Server.

Thursday 20:40: A client reports that a ransomware attack on his server has been blocked by his antivirus.

Thursday 22:10: Several clients report switching to their failovers after experiencing issues with their primary MT4/5 servers after EOD restart.

Thursday 22:40: PrimeXM Support escalates to PrimeXM Networks for further investigation.

Thursday 22:50: PrimeXM Network escalates to PrimeXM Systems for further investigation.

Thursday 23:00: PrimeXM Systems investigates and identifies a ransomware attack by Atom Silo.

Thursday 23:15: PrimeXM Systems deploys a decryptor tool from AVAST to affected clients with decryption success rates between 5-20%.

Friday 00:15: PrimeXM Systems identifies the attack has spread to wider parts of PrimeXMs hosting infrastructure and escalates to management.

Friday 01:30: PrimeXM identifies that the attack can only disrupt client’s live trading by encrypting essential files if the MT4/5 servers are stopped or during restart.

Friday 02:30: PrimeXM issues a statement to all clients informing them of the ongoing attack. PrimeXM advises clients not to restart their MT4/5 servers and to verify their failover infrastructure is operational.

Friday 02:40: PrimeXM attempts to engage with various third party cybersecurity firms.

Friday 05:45: PrimeXM establishes a channel of communication to a Forensic and Malware Analyst who developed the core algorithm of AVASTs decryptor tool.

Friday 06:10: PrimeXM establishes a channel of communication to the cybersecurity QSecure.

Friday 06:40: QSecure engages Deloitte Cyber Forensics.

Friday 08:00: PrimeXM calls clients and continues to do so throughout the day to ensure they are aware of the statement sent earlier around 02:30.

Friday 08:00: PrimeXM identifies and disables the entry point of the attacker. The entry point was a compromised web interface of the monitoring system ZABBIX.

Friday 10:30: QSecure in collaboration with Deloitte Cyber Forensics join PrimeXM engineers onsite and begin work on analyzing the ransomware itself as well as the attack.

Friday 14:30: Preliminary evidence gathered by the forensic teams by analysing the ransomware as well as network activity does not suggest there was either a data breach or backdoor present.

Friday 18:20: PrimeXM and QSecure start collaborating with the Forensic and Malware Analyst and provide data to improve the success rate of the decryption algorithm.

Saturday 00:30: PrimeXM advises clients to switch to their MT4/5 failover Infrastructure. For clients hosting their failover with PrimeXM, PrimeXM provides assistance and new servers to migrate to.

Saturday 06:00: PrimeXM reaches out to clients to commence the migration of MT4/5 failovers. Failover migration continues through Saturday and Sunday.

Saturday 07:30: PrimeXM receives an updated version of the decryption algorithm.

Saturday 08:00: PrimeXM receives the source code of the decryption algorithm.

Sunday 17:00: QSecure and Deloitte Cyber Forensics confirm that based on their evidence there was no data breach or backdoor present in the malware.

Sunday 18:00: PrimeXM improved the decryption algorithm and added brute force capabilities now reaching decryption rates of close to 100%. PrimeXM assists clients to decrypt files.

Summary:

We would like to confirm that less than 3% of Hosted Clients experienced any impact to their trading operations. At no point did PrimeXM enter into any negotiations with the attackers nor has met any of their demands.

The security of PrimeXM’s internal systems, including XCore trading infrastructure, was not compromised or suffered any interruptions at any point.

We will continue to provide updates as we receive them and we will always remain transparent.
Our teams are available around the clock to provide any assistance needed.

Finally, we want to sincerely apologize for any inconvenience this event might have caused to our customers. We will continue to increase inhouse expertise and work closely with our Cybersecurity partners to improve the security of our hosted systems.

2021-12-14