Ankura CTIX FLASH Update - April 26, 2024

Ransomware/Malware Activity

Infostealer Malware Campaign Attributed to CoralRaider Exploits CDN Cache

Cybersecurity researchers have attributed an ongoing infostealer malware campaign to a threat actor termed "CoralRaider". CoralRaider is a financially motivated threat actor group of suspected Vietnamese origin known for targeting victims in Asian and Southeast Asian countries. The recent malware campaign has also been seen targeting countries such as the United States (U.S.), Germany, Poland, Japan, and Ecuador, among others.

• The campaign is designed to deliver infostealer malware including LummaC2, Rhadamanthys, and Cryptbot. The attack begins with a Windows shortcut file, which could be delivered via phishing or malvertising. The shortcut file contains PowerShell commands that grab an obfuscated HTML Application (HTA) file from the CDN cache of an attacker-controlled subdomain to avoid request delays and deceive network defenders. The HTA file contains