Ankura CTIX FLASH Update - June 27, 2025

Malware Activity

Sophisticated Tactics Exploiting Trusted Software Ecosystems

Cybercriminals are deploying advanced and deceptive techniques to infiltrate organizations and systems. One campaign exploits the ScreenConnect remote access software by using Authenticode-stuffing. Malicious payloads are digitally signed with legitimate certificates, allowing malware to bypass security measures that verify code signatures. This method involves embedding malicious code within legitimate software updates or files. Which makes the malicious activity difficult to detect. Simultaneously, another campaign targets the NPM package ecosystem. By distributing malware through 35 seemingly legitimate packages, it's disguised as interview or resume tools. Once integrated, it enables data theft and remote code execution (RCE). These tactics exploit the trust placed in software updates and popular development tools, emphasizing the need for rigorous validation, continuous monitoring