Ankura CTIX FLASH Update - April 7, 2023

Malware Activity

Researchers Observe "Rorschach", One of the Fastest Ransomware Strains to Date

Researchers have recently observed a previously unnamed ransomware dubbed "Rorschach" that they emphasize to be "one of the fastest ransomware observed, by the speed of encryption." In the observed instance, researchers noted that Rorschach was deployed "using DLL side-loading of a Cortex XDR Dump Service Tool, a signed commercial security product," which is a loading method that is not typically utilized by ransomware operations and uses three (3) files during execution. The main payload is injected into "notepad.exe" and then runs processes in SUSPEND mode while providing falsified arguments. This technique is conducted to make analysis more difficult as well as deleting shadow volumes and backups by using legitimate Windows tools, clearing specific Windows event logs, disabling the Windows firewall, and attempting to stop a number of predefined