Ankura CTIX FLASH Update - April 19, 2024

Ransomware/Malware Activity

SteganoAmor Malware Campaign Hides Malicious Payloads via Steganography

Researchers at Positive Technologies have identified over 320 attacks in a malware campaign primarily targeting organizations in Latin America leveraging steganography to obfuscate malicious payloads. The hacking group TA558 is believed to be behind the operation. The SteganoAmor attack begins with a phishing email that is sent from compromised SMTP servers to exploit the positive reputation of existing domains. The phishing email contains Microsoft documents such as Excel or Word that are crafted to exploit a known Microsoft Equation Editor vulnerability tracked as CVE-2017-11882. This flaw is nearly seven (7) years old, and the exploit will check the version of Microsoft Office installed to determine whether it will advance to the next stage of the campaign which downloads a Visual Basic Script (VBS). The script grabs an image file which uses steganography to