Ankura CTIX FLASH Update - November 14, 2025

Malware Activity

DanaBot Resurfaces with New Infrastructure and Crypto Channels After Operation Endgame Takedown

Six (6) months after its takedown in Operation Endgame, the DanaBot malware has reemerged with version 669, featuring a rebuilt command-and-control (C2) infrastructure leveraging Tor domains and "backconnect" nodes. Researchers at Zscaler ThreatLabz report that threat actors are now using multiple cryptocurrency wallets in BTC, ETH, LTC, and TRX to collect stolen funds. Originally discovered by Proofpoint as a Delphi-based banking trojan operating under a malware-as-a-service (MaaS) model, DanaBot has evolved into a modular infostealer and loader capable of harvesting credentials and crypto wallet data from browsers. Despite law enforcement's global disruption in May, the malware's operators have rebuilt the network, spotlighting the resilience of cybercriminals when key actors remain operational. DanaBot continues to spread via phishing emails, SEO