H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Prestige](https://attack.mitre.org/software/S1058) ransomware has been used by [Sandworm Team](https://attack.mitre.org/groups/G0034) since at least March 2022, including against transportation and related logistics industries in Ukraine and Poland in October 2022.(Citation: Microsoft Prestige ransomware October 2022)

Labels

malware

10 recorded

Relationships

uses

to Data Encrypted for Impact

Technique

uses

to File and Directory Discovery

Technique

uses

to Group Policy Modification

Technique

uses

to Inhibit System Recovery

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Service Stop

Technique

uses

from Sandworm Team

Group

2 external

References

mitre-attack

S1058

Microsoft Prestige ransomware October 2022

https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/