Private HTS programs that spread ransomware

ASEC identified that fraud groups distributing a fake HTS called "UBP Asset" have begun delivering a Rust-based ransomware (KRSID) via the HTS update mechanism: the updater downloads Update.Lst which pulls and executes HTSPnew.Exe, while UBP.Dll was modified to launch the ransomware. The ransomware uses AES-256/RSA-2048, creates README_KRSID.Txt ransom notes (contact via Telegram), targets a wide list of file types, and the report includes IOCs (MD5 hashes, URL), historical context (prior Quasar RAT distribution via illicit HTS), and mitigation advice to only install HTS from regulated institutions.