Ankura CTIX FLASH Update - January 14, 2025

Malware Activity

New cybersecurity threats have been discovered

• Several new cybersecurity threats have been discovered, including a malicious proof-of-concept (PoC) exploit for the "LDAPNightmare" vulnerability on GitHub, which infects users with infostealer malware that exfiltrates sensitive data. Additionally, ransomware attacks on VMware ESXi servers have surged, with attackers targeting the vCenter server and exploiting the "vpxuser" account to gain control and demand ransoms averaging $5 million. A new credit card skimmer campaign has also been discovered, targeting WordPress e-commerce checkout pages with stealthy malware that injects malicious JavaScript code and captures sensitive payment details. Furthermore, a new AI-assisted ransomware family called FunkSec has emerged, using double-extortion tactics and demanding low ransoms, while also selling stolen data to third parties. To protect against these threats, users and organizations are advised to