Ankura CTIX FLASH Update - May 3, 2022

Ransomware/Malware Activity

UNC3524 Observed Targeting Corporate Development, Merger, and Acquisition-Focused Employees

UNC3524, an emerging advanced persistent threat (APT) group tracked by Mandiant, has been observed breaching corporate networks to target "executive teams and employees that work in corporate development, mergers, and acquisitions, or IT security staff." The threat group's goal is to gain privileged credentials from these specific targets' mail environments in order to make Exchange Web Services (EWS) API requests to Microsoft Exchange or Microsoft 365 Exchange Online environments in order to exfiltrate emails. The exfiltrated emails span over a specified date range rather than through keyword-filtering, which is a tactic utilized by Russian-backed threat group Cozy Bear. In addition to tactics linked to Cozy Bear, researchers have noted that UNC3524 has used tools and tactics previously linked to Russian-backed Fancy Bear, or APT28, but there is