This browser is not actively supported anymore. For the best passle experience, we strongly recommend you upgrade your browser.

Social Media Links

| 3 minutes read

Ankura CTIX FLASH Update - March 7, 2023

Malware Activity

ALPHV Extorting Healthcare Network with Clinical Images of Breast Cancer Patients

On February 20, 2023, Lehigh Valley Health Network (LVHN), a healthcare network based in Pennsylvania, disclosed that it had suffered a cyberattack by ALPHV. ALPHV (also known as BlackCat) is a Russia-linked ransomware group that typically targets healthcare and academic organizations and continues to be very active this year. LVNH noted that the attack involved "patient images for radiation oncology treatment and other sensitive information on a single physician practice in Lackawanna County" and that the network would not be paying the demanded ransom. In response to this payment denial, ALPHV has begun attempting to extort LVNH by publishing exfiltrated data and clinical images of breast cancer patients to their leak site, describing the images as nudity. Alongside this data, ALPHV stated, "Our blog is followed by a lot of world media, the case will be widely publicized and will cause significant damage to your business. Your time is running out. We are ready to unleash our full power on you!" Security researchers are outraged at this level of extortion and the threat group attempting to capitalize on the sensitivities surrounding cancer treatment. CTIX analysts will continue to monitor this ongoing situation and will provide updates as they become available.

Threat Actor Activity

Threat Actors Romance Android Users, Install Espionage Malware 

Transparent Tribe actors have unveiled a new campaign targeting Android users throughout India and Pakistan. Historically, Transparent Tribe (APT36) is known for their continuous cyberespionage attacks against research, defense, and diplomatic organizations in Afghanistan and India for nearly a decade. This new campaign has set sights on Indian and Pakistani Android users who are involved with military or political operations in the region. Users are contacted on common messaging platforms and are lured via romance scams to download and install another messaging platform laced with malicious software. Transparent Tribe actors embedded malicious code into the applications (MeetsApp and MeetUp) to install the “CapraRAT” backdoor, one (1) of their more commonly used malwares in previous campaigns. Once installed, CapraRAT has the capabilities to exfiltrate sensitive information, make phone calls, record phone call audio, capture screenshots, and send SMS text messages. Communications from both malicious applications relay back to the same command-and-control (C2) server and contain the same digital certificates. Personal identifiable information (PII) of around 150 victims were obtained and analyzed by researchers due to weak security by the threat actors. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.


PoC Published on Twitter for a Critical Microsoft Word Vulnerability Allowing for RCE

A proof-of-concept exploit has just been published for a critical vulnerability affecting Microsoft Word that could be exploited by threat actors to conduct remote code execution (RCE) attacks on vulnerable systems. The flaw, tracked as CVE-2023-21716, is a heap memory corruption vulnerability within Microsoft Word's RTF (Rich Text Format) parser and occurs when dealing with Microsoft Office’s “wwlib.dll”, a font table "(*\fonttbl*) containing an excessive number of fonts (*\f###*).” A remote attacker could exploit this flaw by creating a malicious ".RTF" file and delivering it to the victim through a phishing email or other social engineering tactic. This flaw does not require much user interaction to be exploited; simply previewing a malicious .RTF file using Microsoft Word could allow the threat actor to execute code with the permissions of the opening application. The low-level of user interaction coupled with the low complexity of the attack and a PoC exploit gives this flaw a CVSS score of 9.8/10. To prevent exploitation, Microsoft users should ensure that the latest updates are installed. If users cannot apply the patch, Microsoft has provided workarounds in their advisory, which include modifying the Windows Registry and enabling the Microsoft Office File Block policy, preventing any Office applications from automatically opening RTF documents unless the user approves the file origin. There is currently no evidence of active exploitation. CTIX analysts will continue to monitor this matter as well as other Microsoft critical vulnerabilities.

The semi-weekly Ankura Cyber Threat Investigations and Expert Services (CTIX) FLASH Update is designed to provide timely and relevant cyber intelligence pertaining to current or emerging cyber events. The preceding is a collection of cyber threat intelligence leads assembled over the past few days and typically includes high level intelligence pertaining to recent threat group/actor activity and newly identified vulnerabilities impacting a wide range of industries and victims. Please feel free to reach out to the Flash Team ( if additional context is needed.

© Copyright 2023. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.


cyber response, cybersecurity & data privacy, data privacy & cyber risk, data & technology, f-risk, memo

Let’s Connect

We solve problems by operating as one firm to deliver for our clients. Where others advise, we solve. Where others consult, we partner.

I’m interested in

I need help with