Ankura CTIX Flash Update - July 8, 2022

Ransomware/Malware Activity

"Brute Ratel C4" Stepping in as the New Cobalt Strike for Threat Actors

Cobalt Strike, an attack simulation tool used by legitimate red teams and ethical hackers, has been used by malicious threat actors for years. Cracked versions of the software are often distributed on hacker forums to be used as a malicious command-and-control (C2) server for malware and ransomware operations. While Cobalt Strike has been one of the most popular pieces of malware for a long time, a new penetration testing tool named "Brute Ratel C4," has recently been used by multiple threat actors. Brute Ratel started as a simple C2 server developed part-time by security engineer Chetan Nayak, an ex-penetration tester for both Mandiant and CrowdStrike. In January of 2022, Nayak began working full-time on the project. The first major update features techniques that allowed Brute Ratel to evade most endpoint detection and antivirus software, a service that is