Ankura CTIX FLASH Update - October 11, 2024

Ransomware/Malware Activity

SilentCryptoMiner Infects Over 28,000 Systems

SilentCryptoMiner, a malware designed to hijack system resources for cryptocurrency mining, has been downloaded on over 28,000 systems in Russia, Turkey, and Ukraine. The campaign behind these infections promotes the malware as legitimate software on YouTube and GitHub repositories, and hides in game cheat codes, trading bots, and pirated office-related software. The fake software downloads are contained in a password-protected zip file, which when opened drops obfuscated scripts, DLL files, and an AutoIT interpreter that launches the main payload. As with most modern malware, the malicious download checks for the presence of debugging tools prior to preceding. The malware hijacks legitimate Windows system services and browser update processes to ensure it is executed upon launch of those processes. The Ncat network utility is used for command-and-control (C2) communications. There are two