Ankura CTIX FLASH Update - February 2, 2024

Ransomware/Malware Activity

USB Devices: Still a Vector

A threat actor group has been seen in the wild utilizing USB devices for the initial infection of targeted systems. Appearing to be financially motivated, UNC4990 has been tracked by Mandiant primarily targeting Italian systems and users through an attack chain enabled by USB devices but propagated by text strings and files stored in uncompromised locations. Initiated by having victims click a malicious LNK file on the USB drive, which is typically used to link to folder structures within Windows. This link is written to emulate the USB drive itself, convincing users that it is a safe object to interact with. Once clicked, the PowerShell script "explorer.ps1" is activated, a known malicious script that downloads malicious payloads including the EMPTYSPACE downloader. This PowerShell script then downloads more resources hosted on GitHub and GitLab. Specifically, a file named "src.txt" is downloaded that