Ankura CTIX FLASH Update - September 27, 2022

Ransomware/Malware Activity

New NullMixer Malware Campaign Spreading Through Cracked Software Websites

An emerging campaign was recently discovered by Kaspersky researchers spreading the "NullMixer" malware. NullMixer exfiltrates victims' credentials, addresses, credit card data, cryptocurrencies, as well as Facebook and Amazon account credentials by capturing all information entered with the device's keyboard. Researchers emphasized that currently 47,500 individuals have been attacked with NullMixer and the malware is distributed by cracked software websites. The operators of NullMixer were observed using "professional SEO [search engine optimization] tools" in order to have their websites appear in the early results of an online search. It is common for those downloading content illegally to receive adware or other low-end malware, but NullMixer is described as "far more dangerous" due to its ability to download many malicious files at once (such as