Ankura CTIX FLASH Update - February 6, 2024

Ransomware/Malware Activity

Thousands of Ukrainian Computers Compromised by PurpleFox Malware

The Ukrainian Computer Emergency Response Team (CERT-UA) has reported on a recent attack campaign that infected at least 2,000 computers within Ukraine with PurpleFox malware. PurpleFox is a malware that utilizes a rootkit to hide itself inside a device and continue to exist while also acting as a downloader for more malicious activity. Additionally, PurpleFox can utilize infected devices to act as nodes in a botnet that can then be leveraged for successive DDoS attacks. PurpleFox has been used by threat actors since 2018 through a variety of configurations, including through malicious applications masquerading as legitimate services and worms that self-propagate. CERT-UA has stated that the PurpleFox malware in this attack is likely infecting devices through MSI installers that contain PurpleFox. PurpleFox has the ability to self-propagate across systems and typically