Ankura CTIX FLASH Update - March 17, 2023

Malware Activity

Actors Observed Abusing Adobe Acrobat Sign Service to Spread "Redline" Malware

Researchers have recently observed actors taking advantage of the legitimate e-signature service Adobe Acrobat Sign to distribute info-stealing malware. The campaign operators register for the service and send targeted emails containing documents hosted on Adobe's servers. The emails involve a real Adobe email address and legitimate Adobe URL to trick users into opening the shared documents and clicking a link contained in the documents' text. The link redirects users to a different website that prompts for a hard coded CAPTCHA to be entered. Once the CAPTCHA is completed, the users are prompted to download a malicious ZIP file that contains one (1) of two (2) possible "Redline" trojan variants, which have capabilities to exfiltrate passwords, cryptocurrency wallets, and more from a victim device. Researchers noted that the campaign operators "artificially increased