Ankura CTIX FLASH Update - June 13, 2023

Malware Activity

Researchers Begin Publishing Report Series on the Fully Undetectable Malware Obfuscation Engine "BatCloak"

Researchers have released the first report of a three (3) part series about "BatCloak," a fully undetectable (FUD) malware obfuscation engine that has been used to deploy malware strains since September 2022. FUD refers to "a type of malicious software designed to evade antivirus and security solutions" that may make use of combined techniques such as encryption, obfuscation, and polymorphism. Researchers emphasized that the identified samples of BatCloak grant actors "the ability to load numerous malware families and exploits with ease through highly obfuscated batch files," and noted that 80% of the 784 reviewed samples had zero (0) detections from security solutions. The BatCloack engine is noted to be the most fundamental part of an open-source batch file loader called Jlaive. Jlaive was previously available on GitHub and GitLab in