Ankura CTIX FLASH Update - July 26, 2022

Ransomware/Malware Activity

APT37 Targets Users in Various European Countries in Latest Phishing Campaign

Several high-value organizations throughout Poland, the Czech Republic, and other European countries have been targets of a recent social engineering campaign that utilizes the "Konni" remote access trojan (RAT). These attributed threat actors, tracked as APT37 and InkySquid, are a North Korean-backed cyber espionage organization who have targeted entities throughout South Korea, Japan, Russia, China, Vietnam, and several countries throughout the Middle East. Major operations conducted by APT37 in recent years include Operation Daybreak, Operation Erebus, and a more recent campaign involving the targeting of journalists with the "GOLDBACKDOOR" malware. In this new phishing campaign, threat actors are distributing emails to users containing malware-infected Word documents and Windows shortcut files. Once downloaded and opened by the user, the attached .LNK