Ankura CTIX FLASH Update – December 23, 2025

Malware Activity

Advancements in Ransomware and Malware Campaigns

Recent developments in cybercrime reveal that ransomware groups like RansomHouse are continuously enhancing their tools to evade detection and increase their destructive potential. Their latest encryption method, called 'Mario,' uses a two-step process with multiple keys, making it much harder for security experts to reverse-engineer or decrypt data. This upgrade also includes techniques that process files based on size, adding complexity and further challenging static analysis. Meanwhile, cybersecurity researchers have identified two highly sophisticated malware campaigns. CountLoader, a stealthy loader, spreads through cracked software and USB drives, executing malicious tools while avoiding detection by operating in memory. GachiLoader, distributed via compromised YouTube accounts, employs obfuscation and anti-security tricks to deliver additional malware, such as info stealers. These evolving