Ankura CTIX FLASH Update - June 14, 2024

Ransomware/Malware Activity

WARMCOOKIE Backdoor Distributed via Fake Job Offers

Researchers at Elastic Security Labs have reported on an ongoing malware campaign pushing the "WARMCOOKIE" Windows backdoor via fake employment opportunities. The victims of the campaign are initially sent an email purportedly from a company interested in hiring the individual. The email encourages the victim to click on a link to take them to the company's internal recruitment platform to learn more. The link directs victims to a landing page which prompts the victim to solve a CAPTCHA prior to downloading a JavaScript file containing malicious code. The JavaScript file leverages Window's Background Intelligence Transfer Service (BITS) to download the WARMCOOKIE DLL file which is executed via rundll32.exe. WARMCOOKIE collects background information on the infected host which is encrypted and sent to the attacker C2. The backdoor's main capabilities include capturing screenshots,