Ankura CTIX FLASH Update - March 24, 2023

Malware Activity

Information-Stealer "BlackGuard" Variant Observed with Advanced Capabilities

Researchers have identified a new variant of "BlackGuard", an information-stealing malware first discovered in March 2022 being sold as malware-as-a-service (MaaS) in Russian-speaking forums. BlackGuard is known for its attempts at exfiltrating "cookies and credentials stored in web browsers, cryptocurrency wallet browser extension data, desktop crypto wallet data, information from messaging and gaming apps., email clients, and FTP or VPN tools." The active malware is constantly evolving, and the new variant has updated, advanced features. The malware now has the ability to propagate through removable devices, such as USBs, and automatically infect new machines. The BlackGuard variant can also establish persistence between system reboots by adding itself under the "Run" registry key as well as copying malware files with random names to every folder within the C: drive.