PrimeXM explains how it dealt with ransomware attack

Rick Steves

The FX technology provider has shared the sequence of events in regard to the attack on parts of its hosting infrastructure.

PrimeXM has confirmed parts of its hosting infrastructure were attacked last Thursday, December 9, and less than 3% of Hosted Clients experienced any impact on their trading operations.

The FX technology provider refused to negotiate with the attackers nor has met any of their demands, the firm said in an official statement.

Threat has been dealt with

The provider of FX aggregation software, ultra-low-latency connectivity, institutional grade hosting solutions, MT4/MT5 Bridging and White Labels experienced its most vulnerable moment to date.

The firm says it has been able to handle the threat and promises to continue to provide updates ASAP and always remain transparent about it.

According to PrimeXM, the security of its internal systems, including XCore trading infrastructure, was not compromised or suffered any interruptions at any point.

“Finally, we want to sincerely apologize for any inconvenience this event might have caused to our customers. We will continue to increase in-house expertise and work closely with our Cybersecurity partners to improve the security of our hosted systems.”

Sequence of events

Below is the sequence of events in regards to the recent attack:

Thursday 18:50: A client reports inability to restart his MT5 History Server.

Thursday 20:40: A client reports that a ransomware attack on his server has been blocked by his antivirus.

Thursday 22:10: Several clients report switching to their failovers after experiencing issues with their primary MT4/5 servers after EOD restart.

Thursday 22:40: PrimeXM Support escalates to PrimeXM Networks for further investigation.

Thursday 22:50: PrimeXM Network escalates to PrimeXM Systems for further investigation.

Thursday 23:00: PrimeXM Systems investigates and identifies a ransomware attack by Atom Silo.

Thursday 23:15: PrimeXM Systems deploys a decryptor tool from AVAST to affected clients with decryption success rates between 5-20%.

Friday 00:15: PrimeXM Systems identifies the attack has spread to wider parts of PrimeXMs hosting infrastructure and escalates to management.

Friday 01:30: PrimeXM identifies that the attack can only disrupt client’s live trading by encrypting essential files if the MT4/5 servers are stopped or during restart.

Friday 02:30: PrimeXM issues a statement to all clients informing them of the ongoing attack. PrimeXM advises clients not to restart their MT4/5 servers and to verify their failover infrastructure is operational.

Friday 02:40: PrimeXM attempts to engage with various third party cybersecurity firms.

Friday 05:45: PrimeXM establishes a channel of communication to a Forensic and Malware Analyst who developed the core algorithm of AVASTs decryptor tool.

Friday 06:10: PrimeXM establishes a channel of communication to the cybersecurity firm, QSecure.

Friday 06:40: QSecure engages Deloitte Cyber Forensics.

Friday 08:00: PrimeXM calls clients and continues to do so throughout the day to ensure they are aware of the statement sent earlier around 02:30.

Friday 08:00: PrimeXM identifies and disables the entry point of the attacker. The entry point was a compromised web interface of the monitoring system ZABBIX.

Friday 10:30: QSecure in collaboration with Deloitte Cyber Forensics join PrimeXM engineers onsite and begin work on analyzing the ransomware itself as well as the attack.

Friday 14:30: Preliminary evidence gathered by the forensic teams by analysing the ransomware as well as network activity does not suggest there was either a data breach or backdoor present.

Friday 18:20: PrimeXM and QSecure start collaborating with the Forensic and Malware Analyst and provide data to improve the success rate of the decryption algorithm.

Saturday 00:30: PrimeXM advises clients to switch to their MT4/5 failover Infrastructure.  For clients hosting their failover with PrimeXM, PrimeXM provides assistance and new servers to migrate to.

Saturday 06:00: PrimeXM reaches out to clients to commence the migration of MT4/5 failovers.Failover migration continues through Saturday and Sunday.

Saturday 07:30: PrimeXM receives an updated version of the decryption algorithm.

Saturday 08:00: PrimeXM receives the source code of the decryption algorithm.

Sunday 17:00: QSecure and Deloitte Cyber Forensics confirm that based on their evidence there was no data breach or backdoor present in the malware.

Sunday 18:00: PrimeXM improved the decryption algorithm and added brute force capabilities now reaching decryption rates of close to 100%. PrimeXM assists clients to decrypt files.

Read this next

Retail FX

The Funded Trader is back? Traders report account closures

Prop trading firm The Funded Trader has updated its website with a few banners, nearly three weeks after it ceased all operations, with claims for a relaunch in the near future. However, there was no official statement on the relaunch on its website, Discord channel, or social media accounts yet.

Executive Moves

NAGA lures former Tickmill compliance exec Loukia Matsia

NAGA Group, a provider of brokerage services, cryptocurrency platform NAGAX and neo-banking app NAGA Pay, appointed Loukia Matsia as their new Head of Compliance and Anti-Money Laundering (AML).


Explore 2024’s Top Cryptocurrencies: BlockDAG Leads With 30,000x ROI Potential, Among Surge Predictions For Bitcoin And Ethereum

Navigating the vast ocean of cryptocurrencies might feel overwhelming for many investors, whether seasoned or newbies.

Tech and Fundamental, Technical Analysis

EURUSD Technical Analysis Report 18 April, 2024

EURUSD currency pair can be expected to fall further toward the next support level 1.0600 (which reversed the price earlier this month).

Digital Assets

Binance ordered to remove Changpeng Zhao to get Dubai license

Binance, the world’s largest cryptocurrency exchange, has obtained a Virtual Asset Service Provider (VASP) license in Dubai.

Crypto Insider

Evolution and current state of global crypto adoption

Every four years, the crypto world gets hyped for the Bitcoin halving. Past halvings, like the one of May 2020, saw a massive increase in BTC transactions, which was driven by growing adoption and community involvement.

Digital Assets

Binance set to re-enter India with $2 million fine settlement

Binance, the world’s largest cryptocurrency exchange, is preparing to re-enter the Indian market after agreeing to pay a $2 million fine, according to a report by the Economic Times.


Over 1,000 Builders, Partners, Investors and Enthusiasts Gather at Inaugural Global Event to Celebrate Sui

Last week in Paris, over 1,000 blockchain enthusiasts from 65 countries gathered at the inaugural Sui Basecamp during Paris Blockchain Week. This milestone event showcased major announcements and drew a global community, highlighting Sui’s impactful strides in blockchain technology.


Powered by Qualcomm, Aethir Unveils Game-Changing Aethir Edge Device to Unlock the Decentralized Edge Computing Future

Aethir, in collaboration with Qualcomm, unveils Aethir Edge, the pioneering authorized mining device. Integrated with a distributed cloud network, it offers advanced edge computing, decentralized access, and exclusive rewards. Dive into the decentralized future with Aethir Edge and unlock new dimensions in computing.