Ankura CTIX FLASH Update - June 4, 2024

Ransomware/Malware Activity

Fake Web Browser Updates Used to Deploy LummaC2 and BitRAT

Researchers at eSentire's Threat Response Unit (TRU) have reported on a malware campaign active in May 2024 which is using fake Chrome update webpages to trick users into downloading information-stealing malware. In this latest campaign, users are directed to a fake Chrome browser update page after visiting a compromised website. Users are urged to click a link to download the update, which downloads a zip file called "Update.zip". Once opened, a malicious JavaScript file "Update.js" executes PowerShell scripts that retrieve malicious files that serve as the loaders, persistence mechanisms, and final payloads of BitRAT and LummaC2 (aka Lumma Stealer). BitRAT is categorized as a Remote Access Tool, but also includes XMR miner for cryptocurrency mining, webcam live feed, keylogger functionality, and file manager with zip compression among other capabilities. LummaC2 is a very