Ankura CTIX FLASH Update - July 16, 2024

Ransomware/Malware Activity

CRYSTALRAY Ramps Up Attacks Leveraging OSS Tools

Researchers at Sysdig's Threat Research Team have reported an uptick in attacks by a threat actor dubbed "CRYSTALRAY". Observed in February 2024 abusing SSH-Snake, an Open-Source Software (OSS) penetration testing tool to exploit Confluence vulnerabilities, CRYSTALRAY's operations have scaled ten-fold to target over 1,500 potential victims. CRYSTALRAY's techniques rely heavily on OSS for all tactics in the MITRE ATT&CK matrix (i.e., reconnaissance, initial access, lateral movement, command and control, and impact). Tools used and abused by the threat group include asn, zmap, httpx, nuclei, SSH-Snake, sliver, and platypus. CRYSTALRAY first conducts reconnaissance to specify IP ranges to scan for vulnerable services. It then leverages existing vulnerability proof-of-concepts (PoC) to gain remote code execution (RCE) and initial access via the identified vulnerability. Lateral movement is