Ankura CTIX FLASH Update - September 26, 2025

Malware Activity

Obscura Ransomware and Obfuscated NPM Malware

Obscura is a sophisticated ransomware variant identified in August 2025 that employs stealth tactics to maximize impact within domain environments. It propagates through the Windows NETLOGON share, creating scheduled tasks for remote encryption, and requires administrative privileges to disable security features and perform reconnaissance. Utilizing advanced cryptography (Curve25519 and ChaCha20), it selectively encrypts files while avoiding critical system files, embedding a base64-encoded ransom note within its binary. Its design emphasizes rapid, widespread encryption, making detection difficult due to hardcoded paths and stealth mechanisms. Concurrently, the malicious npm package Fezbox demonstrates evolving malware techniques by using QR code steganography to conceal payloads that extract and exfiltrate user credentials from browser cookies. Discovered by AI-powered scanning,