Ankura CTIX FLASH Update - October 22, 2024

Ransomware/Malware Activity

ESET Distributor Breached, Data Wipers Sent to Israeli Organizations

Cybercriminals have allegedly breached Comsecure, an Israeli distributor of ESET's software and cybersecurity products, to send phishing emails to Israeli organizations containing data wiping malware disguised as cybersecurity software. The phishing campaign began on October 8^th, when emails from the legitimate eset[.]co[.]il domain were sent to Israel-based customers from ESET's "Advanced Threat Defense Team". The phishing emails warned that the recipient had recently been targeted by government-backed attackers and offers the recipient a link to download an advanced cybersecurity tool: "ESET Unleashed". The link directs users to the legitimate eset[.]co[.]il domain which hosts a ZIP archive containing four DLL files digitally signed by ESET's code signing certificate along with an executable "Setup.exe" that is not signed. "Setup.exe" is the data wiper, designed to