Ankura CTIX FLASH Update - June 11, 2024

Ransomware/Malware Activity

SickSync Malware Campaign Targets Ukranian Defense Forces

The Computer Emergency Response Team of Ukraine (CERT-UA) released an advisory last week about a new malware campaign targeting Ukranian defense forces. The "SickSync" campaign is named after its tactic of abusing a legitimate file-syncing software – SyncThing – to steal sensitive information from its targets. The attack begins with a phishing email with a ".rar" attachment that extracts a PDF document, an installer "sync.exe", and BAT script. The BAT script executes the "sync.exe" installer which downloads SyncThing and SPECTR malware. SPECTR malware can grab screenshots of targeted program windows every ten (10) seconds, copy files from local directories and connected USBs, and steal authentication data from browsers and instant messaging applications. The information SPECTR steals is copied to a folder on the victim machine linked to SyncThing, which syncs the data back to