Ankura CTIX FLASH Update - August 2, 2022

Ransomware/Malware Activity

New Chinese-based Attack Framework "Manjusaka" Used in Maldoc Campaigns

Researchers from Cisco Talos discovered a relatively new attack framework dubbed "Manjusaka" that mimics the popular Cobalt Strike framework. Cobalt Strike is an offensive framework that allows penetration testers and ethical hackers to easily implant and manage beacons during security tests, but malicious threat actors have also gotten their hands on the tool. Due to the popularity of the Cobalt Strike tool, many endpoint detection and antivirus products detect the beacons it plants on victim machines. The risk of detection led to sophisticated threat actors developing their own frameworks. The Manjusaka framework uses Golang to program it's command and control (C2) server and user interface while the implants that are installed on victim devices are written in Rust. The implants are remote access trojans, arriving on victim computers through a malicious Microsoft