Ankura CTIX FLASH Update - May 26, 2023

Malware Activity

Buhti Ransomware Operation Observed Using LockBit Black and Babuk Ransomware to Target Windows and Linux Machines

Researchers observed a new ransomware operation, dubbed "Buhti", utilizing the leaked source code of LockBit and Babuk ransomware in its latest activity. Buhti, first discovered in February 2023, is targeting Windows with "LockBit Black" alongside Linux systems with variants of the "Babuk" ransomware and is using a custom data exfiltration tool for double extortion. The exfiltration tool is a Go-based information stealer that can target specifically chosen file systems and twenty-nine (29) file types. Buhti's operators, tracked as Blacktail, have also been observed exploiting the PaperCut NG and MF remote code execution (RCE) vulnerability, tracked as CVE-2023-27350, in order to "install Cobalt Strike, Meterpreter, Sliver, AnyDesk, and ConnectWise" on targeted machines, leveraging them to "steal data from, and deliver the ransomware