Ankura CTIX FLASH Update - June 21, 2022

Ransomware/Malware Activity

Banking Trojan BRATA Observed with Upgraded Capabilities

Cleafly researchers have observed the threat actor behind the "BRATA" banking trojan advancing the malware's capabilities and noted that the group's recent activity is now categorized as Advanced Persistent Threat (APT) activity. This categorization is due to the group's latest campaigns that included establishing "a long-term presence on a targeted network to steal sensitive information." Researchers detailed that the threat group behind BRATA is very targeted, as it focuses on only one (1) financial institution at a time and pivots only when the victim establishes effective countermeasures that are consistent. The latest BRATA variant has been updated with new phishing techniques, information-stealing capabilities, new classes to obtain GPS data, overlay abilities (which allows the malicious application to display over other apps on a device), SMS sending and receiving