Ursnif

Ursnif, also known as Gozi or ISFB, is a type of malware that has been distributed by threat actor group TA551. This harmful software can infiltrate systems via suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or even hold data for ransom. Ursnif was notably documented in an infection on December 19, 2019, during which Valak was identified as follow-up malware. The malware is often delivered through Word documents with macros and has been linked to other prevalent malware families such as Dridex and Emotet. TA551, active since at least November 2017, has historically pushed different families of information-stealing malware like Ursnif and Valak. This group exfiltrates data stolen from victim networks using post-exploitation tools, such as Cobalt Strike, and other malware forms. In one campaign, landing pages used resembled those discovered by Google Cloud's security team in a previous effort to spread a new variant of the URSNIF malware. TA547, another financially motivated threat actor, has conducted multiple campaigns delivering various Android and Windows malware, including Ursnif. The use of Ursnif has evolved over time. In 2017, SVG files were used to distribute this malware, and by 2022, these files were being used to smuggle .zip archives containing QakBot malware. Notably, Italian firms were targeted by TA544 threat actors using the Ursnif banking trojan. A WikiLoader campaign tricked users into installing Ursnif malware using a fake parcel delivery PDF, indicating a rise in PDF threats spreading malware like WikiLoader, Ursnif, and DarkGate. Furthermore, three documents used to deliver Ursnif, all containing the same image, were found in a database search from May 2021.