Ankura CTIX FLASH Update - April 2, 2024

Ransomware/Malware Activity

Vultur Android Banking Trojan Advances Capabilities and Updates Techniques

Vultur is a banking trojan designed to infect Android phones to steal financial information and credentials from victims. First seen in 2021, the malware has used dropper applications masquerading as legitimate applications on the Google Play store to trick victims into installing the malware. Recently, threat actors have updated their initial attack vector to proactively source victims through SMS messages. Attackers will send targets a malicious SMS message that proports to be from a financial institution and alerts the victim to an unauthorized transaction on their account. The message instructs the victim to call a phone number which is answered by the attacker who instructs the victim to open a link arriving in another SMS message. This malicious link directs the victim to a site to download a trojanized version of the McAfee Security application. Once