Ankura CTIX FLASH Update - May 16, 2023

Malware Activity

Year-Long Campaign Targeting Organizations in South and Southeast Asia Attributed to Lancefly APT Group

Researchers have attributed a highly targeted year-long campaign to the new advanced persistent threat (APT) group Lancefly. The latest ongoing activity began in mid-2022 and has targeted the government, aviation, telecom, and education sectors throughout South and Southeast Asia. Lancefly is noted to "have some links to previously known groups" that were low-confidence, but the group's custom malware dubbed "Merdoor" is believed to have existed since 2018. This malware has been used previously in activity occurring in 2020 and 2021 and in Lancefly's latest campaign to gather intelligence on its victims. Merdoor is an advanced backdoor that has low prevalence and is "used very selectively." The malware is typically injected into the legitimate processes "perfhost.exe" and "svchost.exe" and has the capabilities to install itself as a service,