Ankura CTIX FLASH Update - March 26, 2024

Ransomware/Malware Activity

StrelaStealer Malware Phishing Campaign Targets U.S. and E.U. Organizations

Cybersecurity researchers have observed Strelastealer malware targeting hundreds of U.S. and E.U. organizations in Q1 of 2024. Strelastealer malware was first observed in November 2022 as a new form of info-stealing malware built to swipe email account credentials. At the time, Strelastealer appeared to be targeting mainly Spanish-speaking individuals based on the language of phishing emails crafted to deliver the malware via .ISO files. Since 2022, the infection chain of Strelastealer has evolved. The newer version uses ZIP attachments instead of .ISO files to drop an initial JavaScript file. The JavaScript in turn drops a batch file and a malicious DLL which is executed via "rundll32.exe" to deploy the payload. In addition, the new Strelastealer packer has evolved and employs a control flow obfuscation technique to make analysis of the malware more difficult.