Ankura CTIX FLASH Update - September 1, 2023

Malware Activity

New Report Detailing "SapphireStealer" Malware Activity in 2023

Researchers have released a new report on the "SapphireStealer" malware, an open-source information stealer that was first released to the public in December 2022. Researchers detailed that "newly compiled versions of SapphireStealer began being uploaded to public malware repositories beginning in mid-January 2023, with consistent upload activity being observed through the first half of 2023." Artifacts associated with three (3) samples indicated to the researchers that the malware is currently being used by various threat actors and that SapphireStealer's capabilities are being improved. SapphireStealer was primarily designed to facilitate the exfiltration of browser credential databases and files that potentially contain sensitive user data. Once executed on a victim machine, the malware will attempt to stop any existing browser processes that are running on the system. The