Multiple government entities in North America and the Asia Pacific region have been targeted by currently unknown threat actors using the PureCrypter downloader malware. Through a Discord URL pointing to an encrypted ZIP archive as an initial attack vector, PureCryptor is used to install additional malware such as Agent Tesla, Eternity, and Blackmoon on the victim system. A sample of the campaign’s PureCrypter malware variant was analyzed by researchers, who determined that the malware leveraged Agent Tesla to connect to a compromised FTP server of a non-profit organization in Pakistan where exfiltrated data was being sent. The Agent Tesla malware allows threat actors to exfiltrate login credentials and further escalate attacks over time while avoiding detection by leveraging process injection, whereby the Agent Tesla executable code is injected into the process memory of a legitimate program. Agent Tesla also has the capability to screen capture and steal login credentials saved to a web browser or clipboard. CTIX analysts will continue to monitor attacks by this new threat actor and will provide updates accordingly.