Ankura CTIX FLASH Update - June 3, 2022

RANSOMWARE/MALWARE ACTIVITY

Newest XLoader Versions Use Probability Theory to Hide Their C2 Server Domains Amongst Sixty-Three Decoys

The newest versions of the evolving "XLoader" botnet have been observed using probability theory to obscure their command-and-control (C2) infrastructures from analysts and lower the risk of losing nodes via tracking, identifying, and blocking. XLoader, an information-stealer botnet, was first discovered in January of 2021, and is known as the successor of the "Formbook" malware, which has a history of targeting both Windows and macOS systems. CheckPoint researchers conducted analysis of XLoader and determined that malware creators developed a way to mask the true C2 infrastructure among a series of decoys. CheckPoint researchers detailed XLoader 2.3 previously began concealing its C2 servers by using sixty-three (63) decoy domains in a configuration with the real C2 domain. Sixteen (16) domains are randomly added to a list by the