Ankura CTIX FLASH Update - August 19, 2025

Malware Activity

Exploitation of Vulnerabilities and AI System Risks

Recent cybersecurity developments reveal a persistent threat from the Russian hacking group EncryptHub, active since mid-2024, which exploits a now-patched Windows vulnerability (CVE-2025-26633) through sophisticated social engineering and technical exploits. Their campaigns involve impersonating IT personnel via Microsoft Teams to initiate remote access, deploying malicious MSC files, and establishing persistence through PowerShell scripts communicating with their command-and-control (C2) servers. They also leverage legitimate platforms like Brave Support to host malware, utilizing tools such as Go-based loaders and fake video conferencing sites to bypass defenses. Concurrently, a new frontier of cyber threats targets AI language models like ChatGPT, where attackers exploit "prompt injection" techniques—crafting deceptive prompts to manipulate AI outputs, disclose sensitive data, or produce