Ankura CTIX FLASH Update – December 16, 2025

Malware Activity

Malware via Fake Movie Torrents and Reemerging Ransomware Groups

Cybercriminals are increasingly exploiting popular movies to spread malware, with recent cases involving fake torrents of Leonardo DiCaprio's upcoming film, "One Battle After Another." These malicious files hide dangerous scripts that, when run, install remote access tools like AgentTesla, allowing hackers to steal sensitive information such as passwords and screenshots. The attack cleverly uses encrypted scripts and hidden files to avoid detection, highlighting how hackers are becoming more sophisticated in their methods. Meanwhile, the pro-Russian hacking group CyberVolk, also known as GLORIAMIST, has resurfaced with a new ransomware called VolkLocker. This ransomware targets both Windows and Linux systems, encrypting files and deleting backups, but has a major flaw—the encryption keys are stored openly, making it easy for anyone to decrypt files without paying. They sell their