Ankura CTIX FLASH Update - May 2, 2023

Malware Activity

New "ViperSoftX" Variant Evolved to Target Password Managers, Cryptocurrency Wallets, and Browsers

Researchers have identified a new variant of the "ViperSoftX" cryptocurrency and information-stealing malware currently targeting password managers, including KeePass and 1Password. In the latest campaign, ViperSoftX targets a new range of browsers, including Brave, Opera, Edge, and Firefox, and impacts both the consumer and enterprise sectors. As of April 24, 2023, over 50% of the campaign's activity has taken place in the United States, Australia, Japan, India, Taiwan, Malaysia, Italy, and France. The malware has evolved to have a stronger encryption measure of byte remapping, which increases analysis difficulty as analysts cannot correctly decrypt the encrypted shellcode without having the correct byte map. The malware is also changing its command-and-control (C2) server monthly in order to make detection evasion easier. Researchers explained