Ankura CTIX FLASH Update - January 19, 2024

Ransomware/Malware Activity

Vulnerability Exploited to Drop Phemedrone Stealer in Targeted Browsers, Crypto Wallets, and Messaging Apps

Threat actors have been observed utilizing CVE-2023-36025, a bypass vulnerability for Windows SmartScreen, to deliver the open-source malware Phemedrone Stealer. Phemedrone Stealer is an information stealer malware that targets web browsers, messaging applications like Telegram and Discord, and cryptocurrency wallets. Once the data is compromised, it is returned to the threat actors through Telegram and their command-and-control (C2) server infrastructure. Phemedrone is deployed using CVE-2023-36025, a vulnerability that involves tricking the victim into clicking on a .URL file that has been shortened and masked with URL shorteners and then posted to the messaging app. After clicking the malicious link, the .URL file connects to the threat actor's C2 server before executing a control panel file that takes advantage