Ankura CTIX FLASH Update - February 28, 2023

Ransomware/Malware Activity

Unknown Threat Actors Target Government Entities Worldwide with PureCrypter Malware

Multiple government entities in North America and the Asia Pacific region have been targeted by currently unknown threat actors using the PureCrypter downloader malware. Through a Discord URL pointing to an encrypted ZIP archive as an initial attack vector, PureCryptor is used to install additional malware such as Agent Tesla, Eternity, and Blackmoon on the victim system. A sample of the campaign's PureCrypter malware variant was analyzed by researchers, who determined that the malware leveraged Agent Tesla to connect to a compromised FTP server of a non-profit organization in Pakistan where exfiltrated data was being sent. The Agent Tesla malware allows threat actors to exfiltrate login credentials and further escalate attacks over time while avoiding detection by leveraging process injection, whereby the Agent Tesla executable code is injected into