Ankura CTIX FLASH Update - August 9, 2024

Ransomware/Malware Activity

Hunters International Ransomware Group Targets IT Professionals with SharpRhino RAT

Researchers at Quorum Cyber have recently published a post regarding a new Remote Access Tool (RAT) linked to ransomware gang Hunters International. Hunters International has been active since October 2023 and is believed to be an offshoot of the Russian-based Hive ransomware group based on similarities in ransomware source code. Hunters International has announced 134 ransomware attacks already this year and is becoming one of the most active ransomware groups of 2024. Researchers at Quorum Cyber report that the SharpRhino malware is disseminated by a typosquatting site which mimics the website for a well-known networking tool Angry IP Scanner. Hunters International is spreading their initial access malware by mimicking well-known networking tools in the hopes of compromising IT workers at organizations who tend to have elevated privileges. The