Ankura CTIX FLASH Update - September 20, 2024

Malware Activity

New SambaSpy Malware Targeting Italian Users in Phishing Campaign

A newly discovered malware dubbed SambaSpy is exclusively targeting Italian users through a phishing campaign led by a suspected Brazilian Portuguese-speaking threat actor. The attack begins with phishing emails containing HTML attachments or embedded links that initiate the malware infection process. The HTML attachment opens a ZIP archive that deploys a downloader or dropper to launch the remote access trojan (RAT) payload. SambaSpy's infection chain is elaborate, redirecting users to either legitimate invoices or malicious web servers based on specific criteria such as browser type and language settings. Users meeting these criteria are served a malicious JAR file from MediaFire, leading to the deployment of the RAT, which is capable of extensive remote-control functions such as file management, keylogging, webcam control, and more. The malware also steals credentials