Ankura CTIX FLASH Update - July 1, 2025

Malware Activity

From Basic Data Stealers to Sophisticated Espionage and Persistent Malware Campaigns

Recent cybersecurity analyses reveal that malware like GIFTEDCROOK has advanced from simple browser data theft to a highly targeted espionage tool. Primarily aimed at Ukrainian government and military data. It now employs complex techniques such as macro-laden phishing emails with military-themed content to exfiltrate sensitive documents, cookies, and authentication details. While evading detection through segmented ZIP archives and trace-cleaning scripts. Concurrently, Chinese-speaking targets face threats from campaigns mimicking popular software like WPS Office and Sogou. Distributing malware such as Sainbox RAT and stealthy rootkits via malicious MSI installers. Attributed to the Chinese hacking group Silver Fox, these operations leverage legitimate-looking files and open-source tools to maintain persistent access. Highlighting a disturbing trend of