An emerging ransomware strain dubbed “Big Head” has been identified in malvertising campaigns that promote fraudulent Microsoft Word installers and Windows updates. Researchers initially discovered two (2) samples of the malware in May of 2023 and published an initial report in mid-June of 2023. Additional researchers have recently published a deep dive in early July that discussed the technical aspects of the ransomware operation as well as a third variant. The three (3) samples were identified to have the same contact email address in their ransom notes, leading researchers to believe they are from the same developer. During the attack chain of the first sample, researchers noted the presence of three (3) executables that dropped a copy of itself for propagation purposes, a Telegram bot for establishing communication, and ransomware that encrypts and encodes files in Base64 as well as displays a fraudulent Windows update screen. The ransomware in this sample also deletes system backups and disables various processes including the Task Manager. Researchers noted that the malware terminates itself if the system’s language matches the Russian, Belarusian, Ukrainian, Kazakh, Kyrgyz, Armenian, Georgian, Tatar, and Uzbek country codes. The second sample has both ransomware and information-stealer capabilities. Like the first sample, the second sample drops a copy of itself on the victim machine and encrypts various file types. The malware also collects the following data: browser history of all available browsers, list of directories and running processes, product key, networks, replica of drivers, and a screenshot of the machine’s display after executing the malware. Researchers discovered the “Neshta” file infector in the third sample of Big Head. Neshta is a virus that infects a machine and inserts malicious code into executable files. This virus is used in the Big Head ransomware deployment as a “camouflage technique” for the final payload. It is emphasized that the technique “can make the piece of malware appear as a different type of threat, such as a virus, which can divert the prioritization of security solutions that primarily focus on detecting ransomware.” The ransom note for this sample is different than the ones identified in previous samples. Significant information on the malware developer has yet to be published. Indicators of compromise (IOCs) as well as additional technical details can be viewed in the reports linked below.