Ankura CTIX FLASH Update - August 19, 2022

Ransomware/Malware Activity

"DarkTortilla" Crypter Malware Used to Drop Information Stealers, RATs, Ransomware

Researchers from Secureworks Counter Threat Unit (CTU) released a report detailing a malware they have been tracking since January 2021. Dubbed "DarkTortilla", the malware is a "complex and configurable .NET-based crypter" that has been active since at least August 2015. Crypters are malware that use encryption, obfuscation, and code manipulation to evade detection software and drop other malware. DarkTortilla delivers popular information stealers and remote access trojan malware such as "AgentTesla", "AsyncRat", "NanoCore", and "RedLine Stealer" and has been known to drop ransomware in some cases. DarkTortilla has been observed being deployed using malicious spam campaigns. The phishing emails typically use a logistics lure and includes the malicious payload in a malicious document or an archived attachment with the file types .iso, .zip, .img, .dmg,