Malware Distributed as Copyright Violation-Related Materials (Beast Ransomware, Vidar Infostealer)

AhnLab ASEC identifies a phishing campaign distributing two payloads—Beast ransomware and Vidar infostealer—via external download links in copyright/resume-themed emails; attackers nest an ALZ archive inside a downloaded ZIP to bypass compression-detection, deliver two executables (one encryptor, one infostealer), and employ SMB scanning for lateral movement and resilient C2 mechanisms (using Telegram/Steam) to exfiltrate data and maintain command-and-control.