Ankura CTIX FLASH Update - July 11, 2023

Malware Activity

Researchers Publish Deep Dive on Emerging "Big Head" Ransomware Strain

An emerging ransomware strain dubbed "Big Head" has been identified in malvertising campaigns that promote fraudulent Microsoft Word installers and Windows updates. Researchers initially discovered two (2) samples of the malware in May of 2023 and published an initial report in mid-June of 2023. Additional researchers have recently published a deep dive in early July that discussed the technical aspects of the ransomware operation as well as a third variant. The three (3) samples were identified to have the same contact email address in their ransom notes, leading researchers to believe they are from the same developer. During the attack chain of the first sample, researchers noted the presence of three (3) executables that dropped a copy of itself for propagation purposes, a Telegram bot for establishing communication, and ransomware that encrypts and encodes files in Base64