Ankura CTIX FLASH Update - March 19, 2024

Ransomware/Malware Activity

RisePro InfoStealer Spread via Cracked Software Advertised on GitHub

Cybersecurity researchers have discovered GitHub repositories with instructions to install cracked software that contains the RisePro infostealer payload. The malicious repositories used green Unicode circles in the "README.md" file to mimic GitHub's use of green or red circles to display the status of automatic builds to portray a sense of legitimacy. Each repository pointed to a download link at "digitalxnetwork[.]com" which contains a RAR archive prompting victims to input the password indicated in the GitHub README.md file to open it. The RAR file contains an installer that unpacks an executable which injects RisePro malware into either the AppLaunch.exe or RegAsm.exe process on the victim's machine. The RisePro infostealer is written in C++ and exfiltrates sensitive data from infected hosts to Telegram channels controlled by the attacker. It is noted that