Ankura CTIX FLASH Update - June 18, 2024

Ransomware/Malware Activity

DISGOMOJI Linux Malware Commanded by Emojis

Researchers at Volexity have recently reported on a Linux malware strain named "DISGOMOJI" which has been observed targeting government agencies in India. The threat actor behind the campaign is believed to be a Pakistan-based threat actor dubbed "UTA0137". UTA0137 leverages an open-source command-and-control (C2) project "discord-c2", which uses Discord as the C2 server. The attackers communicate with DISGOMOJI malware via emojis, coding each emoji to represent a command. Examples include an emoji of a man running which executes a command on the victim's device, an emoji of a camera which takes a screenshot of the victim's screen, and a fire emoji which finds and sends all files matching an extension list to the attacker. Other capabilities of the DISGOMOJI malware includes zipping Firefox profiles on the victim's device and downloading/uploading additional files. The malware has