Ankura CTIX FLASH Update - May 3, 2024

Ransomware/Malware Activity

Cuttlefish Malware Monitors and Hijacks Traffic on SOHO Devices

Researchers at Black Lotus Labs have recently reported on a new version of malware targeting small office/home office (SOHO) routers. The Cuttlefish malware is designed to steal traffic relating to credentials and hijack DNS and HTTP traffic associated with communications on the internal network. It is currently unclear how the attackers behind the Cuttlefish malware gain initial access to the victim routers. Once initial access is gained, the attackers deploy a bash script that downloads the Cuttlefish payload and gathers the host data to send back to the attackers' command-and-control (C2) server. The Cuttlefish malware is built to infect all major router architectures. Its first step is to configure a packet filter that monitors all connections through the router. The filter is coded so that only traffic matching certain criteria is sent back to the C2