Ankura CTIX FLASH Update - June 23, 2023

Malware Activity

RedEyes Threat Group Observed Using New Malware to Exploit the Ably Service and Wiretap Victims

Researchers have observed RedEyes (also known as APT37 and ScarCruft) using a previously unknown information-stealing malware dubbed "FadeStealer" as well as the "AblyGo Backdoor." RedEyes is a state-sponsored advanced persistent threat (APT) group that has historically conducted cyberattacks aligned with North Korean interests, including against North Korean defectors, human rights activists, and university professors. Researchers explained that the malware is assumed to be delivered through spear-phishing emails with a typical password-protected document and a fraudulent password file attached. A Compiled HTML Help File (CHM) malware is masqueraded as the password file so the campaign victims believe they must execute the disguised malware in order to view the password-protected document. Once executed, the victim can view the password information