Ankura CTIX FLASH Update - June 9, 2023

Malware Activity

"Stealth Soldier" Malware Observed Using Surveillance Capabilities Against Libyan Organizations

Researchers have observed a previously undisclosed custom multi-stage backdoor dubbed "Stealth Soldier" involved in a wave of highly targeted espionage attacks against North Africa. The Stealth Solider malware strain is known to primarily operate "surveillance functions such as file exfiltration, screen and microphone recording, keystroke logging and stealing browser information." The first version of Stealth Soldier was first compiled in October 2022 and the most recent version was likely delivered in February 2023. Researchers note that the command-and-control (C2) servers in this ongoing campaign have been observed mimicking sites belonging to the Libyan Ministry of Foreign Affairs. It was also explained that there are indications that the C2 servers are part of a larger infrastructure set and related to various domains, which have in part been