Ankura CTIX FLASH Update - May 23, 2023

Malware Activity

Researchers Observed New Capability in ALPHV Ransomware Involving Malicious Windows Kernel Drivers

The ALPHV (aka BlackCat) ransomware has been observed in February 2023 with a new capability that correlates with activity detailed in three (3) reports published in late 2022. The three (3) reports detailed "malicious kernel drivers being signed through signed Microsoft hardware developer accounts," which were seen in various cyberattacks involving ransomware-based incidents. Researchers noted the capability, which is a malware dubbed "POORTRY," was used in the recent activity for the defense evasion phase of the attack and was an updated version that "inherited the main functionality from the samples disclosed in previous research," as the threat actor initially attempted to deploy a kernel driver identified in December 2022. The updated POORTRY malware can conduct the following actions: activating and deactivating the driver, killing any