Cyber Threat Intelligence from BlackBerry

One of the things that makes RisePro Infostealer so concerning is that it has no specific infection vector. It can be dropped onto a victim’s device in a plethora of ways, often relying on malicious links and lures to gain an initial foothold. In the past, it has been deployed by a pay-per-install (PPI) malware service, which is often utilized by other threat actors as a malware distribution platform.

Increased global trade and the growth of the Latin American (LATAM) market have made the region an increasingly attractive target for cybercriminals in recent years. Coyote is a .NET banking Trojan observed targeting Brazilian financial institutions, primarily banks. Its execution chain clearly distinguishes it from other banking Trojans. Coyote got its name because it abuses valid, non-malicious software to manage the installation and update of Windows applications.

BlackBerry Threat Researchers take you under the hood of the Akira Ransomware attack chain, which was discovered targeting a Latin American Airline in June 2024. The threat actor initially succeeded in exfiltrating critical data before deploying a strain of the Akira ransomware. Throughout this compromise, a number of legitimate tools were abused in conjunction with living off the land. Assailants performed reconnaissance and persisted in the victim's environment.