Ankura CTIX FLASH Update - November 19, 2025

Malware Activity

The Return of the Finger Command and Kraken Ransomware

Hackers are now reusing the old "finger" command, once used to look up user info on Unix, Linux, and Windows systems, to deliver malicious software remotely. Through phishing campaigns called ClickFix, attackers trick users into running commands that download malware like remote access tools or malicious scripts, often disguising them as PDFs or legitimate prompts. Experts warn that this method can bypass traditional security defenses, so blocking outgoing traffic on TCP port 79 (used by the finger protocol) is recommended. Separately, Kraken ransomware has become a highly dangerous threat targeting Windows and Linux systems, testing machines for quick encryption to cause maximum damage while avoiding detection. It exploits vulnerabilities to access networks, steals data, and then encrypts critical files, demanding ransoms sometimes as high as $1 million. Kraken also deletes logs and