Ankura CTIX FLASH Update - January 24, 2025

Malware Activity

Threat Actors are Exploiting Current Events

Threat actors are exploiting current events, such as Ross Ulbricht's pardon, to trick users into downloading malware through fake social media accounts and Telegram channels. Meanwhile, a China-aligned hacking group called "PlushDaemon" has conducted a supply chain attack on South Korean VPN provider IPany, compromising the company's VPN installer to deploy custom "SlowStepper" malware, which has infected companies including a semiconductor firm and a software development company. Additionally, cybersecurity researchers have discovered a new BackConnect (BC) malware module linked to the QakBot loader, which has been used to deliver ransomware and other payloads and is part of a larger cybercrime ecosystem with connections to threat groups such as Storm-1811 and FIN7. Furthermore, researchers have identified a series of cyber-attacks targeting Chinese-speaking regions using a known malware called