Ankura CTIX FLASH Update - December 22, 2023

Ransomware/Malware Activity

Bogus F5 BIG-IP Update Embedded with Malware

Israel has been victimized in a phishing campaign that has been delivering Windows and Linux data wipers to devices. The campaign is believed to be perpetrated by pro-Hamas hacktivists and other Iranian-backed actors. The Israel Nation Cyber Directorate, a government organization dedicated to protecting Israeli cyber assets, released a report detailing how a phishing campaign impersonated a cloud security company. The email message describes a supposed zero-day vulnerability for F5 BIG-IP devices. It then urges the victim to download and install the update, which comes in the form of "F5Updater.exe" for Windows and "update.sh" for Linux. The Windows version of the executable creates a fake F5 security update with the F5 logo on the screen to further impersonate F5 and convince the victim that the software is legitimate. This pop up contains a clickable button that when clicked sends a