Ankura CTIX FLASH Update - July 2, 2024

Ransomware/Malware Activity

New Threat Actor Releases Malware Cluster Bombs

Researchers at Outpost24's KrakenLabs have concluded that several recent reports and articles regarding a novel infection technique distributing multiple types of malware are likely linked to a single threat actor group: "Unfurling Hemlock". Notable characteristics linking these recent attacks include using cabinet files for malware distribution, the file "WEXTRACT.EXE .MUI", and the use of a common autonomous system related to hosting services seen used by Eastern European cybercriminals. The researchers refer to the infection method as a "malware cluster bomb", as the initial compressed file unfurls itself into multiple payloads using a nesting pattern up to seven nodes deep. The malware distributed in a single attack can include Redline, Mystic Stealer, RisePro, Amadey, and SmokeLoader. Researchers have found at least 50,000 sample files sharing this malware campaign's characteristics