Ankura CTIX FLASH Update - January 28, 2025

Malware Activity

Several new malicious campaigns uncovered

Several malicious campaigns have been uncovered, targeting various systems and individuals. Ransomware actors are leveraging SSH tunneling to persist on VMware ESXi bare metal hypervisors, while a North Korean threat group, Andariel, is using a technique called RID hijacking to trick Windows into treating low-privileged accounts as administrator accounts. Additionally, a threat actor has been targeting low-skilled hackers with a fake malware builder that secretly infects them with a backdoor, allowing the attacker to steal data and take over computers. Meanwhile, a malware campaign is utilizing a PowerShell-based loader called MintsLoader to distribute secondary payloads, including the StealC information stealer and the legitimate BOINC network computing platform, targeting the electricity, oil and gas, and legal services sectors in the US and Europe. These campaigns highlight the importance of monitoring