An emerging threat organization tracked as Cranefly, also known as UNC3524, has been observed utilizing new techniques, tools, and scripts in their active campaigns. Cranefly threat actors focus on launching campaigns against corporate development, mergers & acquisitions, and large corporate transactions. Stealthy attacks are Cranefly’s preferred attack method, hiding within the infected system by deploying several backdoors on unprotected appliances such as load balancers and wireless access point controllers. Recently, threat actors began targeting employees who are heavily involved with major corporate transactions, specifically with the “Geppei” dropper and “Danfuan” malware. The Geppei dropper sets the stage for the attack, which allows for the Danfuan malware and other threat actor payloads to be deployed onto the compromised system. These malicious payloads are able to communicate stealthily by reading commands from Internet Information Services (IIS) logs which are masked as harmless web requests from Cranefly command-and-control (C2) servers. No data has been observed being exfiltrated from the victim’s infrastructure, leading researchers to believe Cranefly’s primary motive is intelligence gathering. CTIX continues to monitor threat actor activity worldwide and will provide updates accordingly.