Ankura CTIX FLASH Update - November 8, 2024

SteelFox Infostealer and CryptoMiner Delivered via Cracked Software

Researchers have identified a new malicious malware bundle developed for Windows machines that drops both infostealing and cryptomining malware on victim devices. Active since at least February 2023 but just recently discovered, SteelFox is a malware dropper that uses a "bring your own vulnerable driver" technique to establish SYSTEM privileges on the victim Windows machine. SteelFox is delivered via cracked software such as Foxit PDF Editor, JetBrains, and AutoCAD. The software download does indeed contain the cracked version of the software, but it also includes the SteelFox malware. The admin access required to install the software is abused to create a service that runs a version of WinRing0.sys with two known vulnerabilities that are exploited to give the attacker NT\\SYSTEM privileges. This driver is also a component of XMRig miner which is used by the attacker for cryptojacking, connecting