Ankura CTIX FLASH Update - January 30, 2024

Ransomware/Malware Activity

Mexican Organizations Targeted with New AllaKore RAT to Conduct Financial Fraud Attacks

A new spear phishing campaign is targeting Mexican financial institutions in order to deliver a new version of the Allakore remote access trojan (RAT). According to researchers, this campaign has been using Mexican Social Security Institute naming conventions and legitimate documents to initiate the payload. To load the malware, the threat actors begin with a zip file that is uploaded to the target network via a phishing email or some other drive-by compromise involving legitimate files. Once loaded and installed Allakore RAT has some of the typical trojan signatures, including the abilities to execute keystroke logging, exfiltrate files, and in some cases take control of a device through privilege escalation. This updated version of Allakore includes additional abilities that specifically target financial and cryptocurrency services, including