Ankura CTIX FLASH Update - May 17, 2022

Ransomware/Malware Activity

German Entities Targeted with PowerShell RAT

Threat actors are actively targeting German entities with custom PowerShell payloads to gather information about the ongoing conflict between Russia and Ukraine. The malicious remote access trojan (RAT) is masked as a downloadable reporting document on a clone site mimicking the official Baden-Württemberg website. Once downloaded, the user is met with a fake error message stating an error in the application, while in the background a PowerShell Base64 command is being executed to reach out to actor-controlled nodes of the fake website and download the associated payloads. Once completed, files "MonitorHealth.cmd" and "Status.txt" are dropped onto the compromised system. A scheduled tasking is set within the payload to execute "MonitorHealth.cmd" at a specific time each day to validate persistence on the system. "Status.txt" is a PowerShell RAT which collects device information such as