Ankura CTIX FLASH Update - December 6, 2024

Malware Activity

Venom Spider Develops Malware-as-a-Service Offering

Venom Spider, the financially motivated threat actor also known as Golden Chickens, has been developing a malware toolset under its Malware-as-a-Service (MaaS) business. Cybersecurity researchers have discovered and analyzed recent campaigns leveraging a novel backdoor and loader named after Venom Spider's toolset. Venom Spider's malware has been linked to cybercrime groups Cobalt and Fin6, and CTIX analysts reported on the use of the "More_eggs" backdoor linked to Venom Spider in recent campaigns this year. The two (2) new malware variants recently uncovered are Venom Loader and a backdoor named RevC2. The RevC2 backdoor uses WebSockets for command-and-control (C2) communications, enabling the transfer of stolen data such as browser cookies and passwords and remote code execution (RCE). The RevC2 backdoor was observed in a campaign that used API documentation as a lure. The backdoor can also