Ankura CTIX FLASH Update - November 1, 2022

Ransomware/Malware Activity

Two New Reports Published on the LODEINFO Malware Targeting Japanese Organizations

Kaspersky researchers have recently published two (2) reports on their observations of APT10, the Chinese Cicada hacking group abusing antivirus software to target Japanese organizations with a new version of the "LODEINFO" malware. LODEINFO is a sophisticated and fileless backdoor that is regularly updated to target "think tanks" as well as media, governmental, diplomatic, and public sector organizations in Japan. Researchers first discussed their observations from March and June of 2022, where APT10 attacks in Japan used a Microsoft Word file as the initial infection vector and later used an SFX file that utilized a decoy file with the name of a famous Japanese politician in the filename. During this time, a new downloader shellcode called "DOWNNIISSA" was observed being used to deploy the LODEINFO backdoor. From March to June of 2022, various