Ankura CTIX FLASH Update - September 6, 2024

Ransomware/Malware Activity

MacroPack Red Teaming Tool Abused by Threat Actors Globally

Content Researchers have discovered that MacroPack – an attacker emulation software – is being abused by multiple cyber threat actors. MacroPack is a proprietary tool leveraged by red and purple teams to test prevention and detection mechanisms. Security researchers discovered its use for nefarious purposes by analyzing document submissions made to VirusTotal from around the globe. Submissions from the United States, China, Russia, and Pakistan indicate that MacroPack had been used to craft malicious VBA code delivered via Microsoft Office documents to spread final malware payloads such as Havoc, Brute Ratel, and PhantomCore. The documents analyzed all contained VBA subroutines embedded in the documents which indicate they had been created using MacroPack. Researchers believe that multiple different threat actors are behind these campaigns given the variation of lures and