Ankura CTIX FLASH Update - March 10, 2023

Ransomware/Malware Activity

IceFire Ransomware Exploits File Sharing Software to Attack Linux-Powered Enterprise Networks

The IceFire ransomware, previously associated with the ".ifire" file extension that targeted Windows servers, has been altered to a novel version that executes on Linux systems of enterprise networks. Media and entertainment companies in Turkey, Iran, Pakistan, and the United Arab Emirates have been the primary victims. IceFire exploits CVE-2022-47986, a deserialization vulnerability in the IBM Aspera Faspex file sharing software. The ransomware encrypts files and evades detection by deleting itself after executing; but most importantly, it allows certain paths that are critical for the functionality of the server to stay unencrypted, avoiding disruptions, damages, or shutdowns. Moving from Windows-based ransomware to targeting Linux networks is a tactic consistent with other prominent ransomware groups involved in big-game hunting (BGH), part