Explore every episode of the podcast CYFIRMA Research

Mobile Threat Alert: GhostGrab Malware!
 
Cybercriminals are getting more sophisticated, and GhostGrab is a clear example. This Android malware doesn’t just steal banking credentials—it can also:

• Run hidden cryptocurrency mining that drains your battery and CPU
• Harvest debit card and online banking login information
• Intercept SMS messages, including one-time passwords (OTPs)
• Collect detailed device and SIM data
• Hide itself and resist removal
• Use phishing pages within apps to trick victims into revealing sensitive information
• Leverage Firebase as a Command & Control (C2) server, making traditional detection more difficult

How to Protect Yourself:

✅ Only download apps from official sources, such as the Google Play Store or, for iOS devices, the Apple App Store
 ✅ Avoid unknown APKs and suspicious links
 ✅ Monitor your bank accounts and SMS activity regularly
 ✅ Keep your device and apps updated
 
Mobile malware is evolving—stay informed, stay protected.

Link to the Research Report: https://www.cyfirma.com/research/ghostgrab-android-malware/

#CYFIRMA #CyfirmaResearch #CyberSecurity #MobileSecurity #AndroidMalware #GhostGrab #CyberThreats #ThreatAlert #ETLM   #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Critical Alert: CVE-2025-6541 – TP-Link Omada Gateway Remote Command Injection

Organizations using TP-Link Omada Gateway devices must act immediately. This critical vulnerability allows attackers to execute arbitrary OS-level commands via the device web management interface. Exploitation can lead to full device compromise, exposure of credentials, configuration changes, and potential lateral movement within enterprise networks.

Link to the Research Report: https://www.cyfirma.com/research/cve-2025-6541-tp-link-omada-gateway-remote-command-injection-vulnerability-analysis/

#CyberSecurity #TPLink #CVE20256541 #OmadaGateway #RCE #ThreatIntel
#VulnerabilityAlert #NetworkSecurity #CommandInjection #CYFIRMA
#CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

North Korea’s cyber operations are evolving into one of the most significant global sanctions-evasion threats. CYFIRMA's new report, DPRK Sanctions Violations in Cyber Operations Post UN Panel Demise, highlights escalating multi-billion-dollar crypto heists, advanced laundering through cross-chain bridges, widespread IT worker infiltration schemes, direct targeting of defense technologies, and the deepening DPRK–Russia cyber nexus. The findings highlight how geopolitical shifts and fragmented enforcement are shaping a more hostile and resilient DPRK cyber apparatus.

Link to the Research Report: https://www.cyfirma.com/research/dprk-sanctions-violations-in-cyber-operations-post-un-panel-demise/
 
 #CyberThreats #SanctionsEvasion #DPRK #CyberSecurity #ThreatIntelligence #CryptoSecurity #Geopolitics #CyberEspionage #APT #NationalSecurity #ExecutiveIntelligence #CISO #DigitalResilience #ETLM #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA’s Sept 2025 Ransomware Report highlights major evolutions across the ransomware landscape. Akira advanced by bypassing MFA on SonicWall VPNs through OTP seed theft, signalling a move beyond patchable flaws. MalTerminal broke new ground with AI-powered, runtime-generated ransomware payloads, while Scattered Spider reemerged to target financial workflows via AI-driven vishing and VMware ESXi exploits. CountLoader reinforced Russia’s ecosystem with modular, multi-language loaders distributing Cobalt Strike, AdaptixC2, and PureHVNC. HybridPetya escalated the threat to firmware-level extortion, exploiting Secure Boot (CVE-2024-7344) and encrypting the MFT at pre-boot for near-irrecoverable persistence.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-september-2025/

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Akira #MalTerminal #ScatteredSpider #CountLoader #HybridPetya #AIThreats #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA has identified Yurei Ransomware, a Go-based strain engineered for speed, stealth, and irreversible impact.

 It encrypts files with ChaCha20 + ECIES, appends a .Yurei extension, and drops ransom notes _README_Yurei.txt with Tor-based communication channels. Yurei destroys backups, wipes logs, manipulates timestamps, and even self-destructs to erase traces, leaving defenders blind. It spreads laterally via SMB shares, USBs, and PsExec/CIM-based credential execution, while adopting double-extortion tactics threatening both encryption and data leaks.

 Observed since September 2025, the first victim was a Sri Lankan food manufacturer, with samples uploaded from Morocco, Germany, and Turkey, pointing to a global footprint. Code overlaps suggest reuse from Prince Ransomware, reinforcing its professional design.

 Link to the Research Report: https://www.cyfirma.com/research/yurei-ransomware-the-digital-ghost/

#CyberSecurity #ThreatIntelligence #Ransomware #YureiRansomware #IncidentResponse #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM 

https://www.cyfirma.com/

Malware Alert: New DeerStealer Campaign

A new variant of sophisticated information-stealing malware, DeerStealer, has been identified targeting personal and financial data across infected systems. Using signed binaries, rootkit-like techniques, and deceptive installers (like Adobe Acrobat Reader), it evades detection while maintaining persistence via scheduled tasks.
 
Key highlights:

• Steals system info, credentials, crypto wallets, browser & app data.
• Uses obfuscated files and hidden components for stealth.
• Communicates with C2 servers and can switch servers to avoid detection.
• Sold and supported on dark-web forums and Telegram channels.
• Stay vigilant! Always verify downloads and keep security tools updated.

 Link to the Research Report: https://www.cyfirma.com/research/deerstealer-malware-campaign-stealth-persistence-and-rootkit-like-capabilities/

#CYFIRMA #MalwareAnalysis #InfoStealer #DeerStealer #ThreatIntel #CyberSecurity

https://www.cyfirma.com/

Defence Industry Cyber Threats: Espionage Meets Monetization

CYFIRMA observed sustained cyber campaigns targeting the global defence sector.

Key Highlights from the report:

• China: Long-term persistence in telecom & enterprise networks via router/switch compromises, harvesting IP and credentials.
• Russia: Disrupting logistics & transport contractors supporting Ukraine, aiming to destabilize defence supply chains.
• North Korea: Blending IP theft with aggressive financial operations, treating cybercrime as both a strategy and a revenue stream.
• Iran: Politically motivated intrusions aligned with regional tensions, occasionally spilling into Western-linked suppliers.
• Cybercriminals: Pivoting away from ransomware encryption → toward direct data theft + leak-driven extortion, exploiting misconfigured cloud environments and subcontractor access.
• Hacktivists: Amplifying propaganda through nuisance-level DDoS, often pro-Russian aligned.

Why it matters:
The defence industry is now under dual pressure, espionage-driven persistence and monetization-driven extortion. The underground economy confirms it: data leaks dominate dark web chatter, while ransomware “lock-and-encrypt” tactics are fading. Cloud-native techniques, subcontractor abuse, and living-off-the-land persistence are reshaping how adversaries sustain access and monetize breaches.

Link to the research report: https://www.cyfirma.com/research/cyfirma-defence-industry-threat-report/

#DefenceCyberSecurity #ThreatIntelligence #Espionage #CloudSecurity #SupplyChainRisk #CyberExtortion #RedTeam #BlueTeam #CYFIRMA

https://www.cyfirma.com/

🚨 Threat Intelligence Alert – XillenStealer 🚨
 
CYFIRMA research identifies XillenStealer, a Python-based open-source information stealer circulating on GitHub, built to exfiltrate:
 🔹 Browser credentials & cookies
 🔹 Cryptocurrency wallets
 🔹 Discord, Steam, Telegram sessions
 🔹 System & network data + screenshots

Key insights:
 ⚙️ Builder GUI lowers entry barriers, enabling even low-skilled actors to deploy the malware.
 📤 Data exfiltration is routed via Telegram bots.
 🕵️‍♂️ Anti-analysis, sandbox evasion & persistence mechanisms enhance stealth.
 🌐 Linked to Russian-speaking cybercriminal group “Xillen Killers” offering a suite of offensive tools & services.
🔑 Why it matters: Open-source availability accelerates adoption by threat actors, while also giving defenders valuable visibility to improve detection & mitigation.

✅ Recommendations:
Deploy advanced EDR & monitor unusual traffic to Telegram/Discord.
Enforce MFA & system hardening.
Educate users on phishing & malicious downloads.
Patch, monitor, and back up regularly.
🛡️ Stay proactive. Stay protected.

Link to the Research Report: https://www.cyfirma.com/research/unmasking-a-python-stealer-xillenstealer/

#CyberSecurity #ThreatIntelligence #Malware #XillenStealer #InfoStealer  #Cyfirma

https://www.cyfirma.com/

India faced a wave of coordinated cyberattacks in July-August 2025 from multiple countries targeting government and public systems. Notably, a sophisticated malware campaign impersonated the Income Tax Department, tricking users into downloading a malicious file linked to a Chinese-operated server for data theft.

Other attacks included data breaches, DDoS, defacements, and phishing scams. This rise in multi-nation hacktivism highlights the urgent need for strong cyber defenses and vigilance. Stay alert, verify sources, and protect your data! 
 
Link to the Research Report: https://www.cyfirma.com/research/digital-frontlines-india-under-multi-nation-hacktivist-attack/

#CYFIRMAResearch #CYFIRMA #CyberSecurity #Malware #Phishing  #Hacktivism #IndiaCyberThreats

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s Monthly Ransomware Report – Aug 2025.

CYFIRMA’s August 2025 Ransomware Report recorded 522 global victims, a slight dip but still far above 2023–24 levels. Qilin led with 84 attacks, while Akira surged by 35% targeting SonicWall VPNs and abusing Intel drivers for BYOVD evasion. Charon adopted APT-grade stealth, and 4L4MD4R blended Chinese ToolShell exploits with ransomware deployment. AI abuse accelerated with Claude enabling RaaS and PromptLock showcasing LLM-powered ransomware. Emerging groups Yurei, Desolator, and Anubis expanded globally, with the U.S., Canada, and UK most affected, and professional services, consumer services, and manufacturing hit hardest.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-august-2025/

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #Akira #Charon #4L4MD4R #AIThreats

https://www.cyfirma.com/

China's South China Sea ambitions stalled: ASEAN Fights Back Amid U.S. Distractions – check out the latest CYFIRMA report on Beijing's ambitions hitting a wall in the South China Sea, and the fallout in cyberspace. 

Link to the Research Report: https://www.cyfirma.com/research/grey-zone-warfare-in-chinas-stalled-south-china-sea-ambitions/

#Geopolitics #CYFIRMAresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MilitaryAffairs #GreyZoneCoertion #UNCLOS #MischiefReef #Spratlys #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA researchers have uncovered a malware campaign exploiting a spoofed Telegram Premium site—telegrampremium[.]app—to distribute a new variant of Lumma Stealer.

Key Findings:

• Drive-by download delivers malicious start.exe without user interaction

• Targets browser credentials, crypto wallets, system info

• Employs obfuscation, DGA-based domains, public DNS evasion

• Uses legitimate platforms (e.g., t.me, Steam) for stealthy C2

• Windows-focused, written in C/C++, and uses advanced evasion techniques

Stay vigilant. Threat actors are innovating—brand impersonation and drive-by downloads are on the rise.

Link to the Research Report: https://www.cyfirma.com/research/fake-telegram-premium-site-distributes-new-lumma-stealer-variant/

#CyberSecurity #ThreatIntelligence #Malware #LummaStealer #Telegram #CYFIRMA #InfoStealer #CyberThreat #APT

https://www.cyfirma.com/

Critical Alert: CVE-2025-8671 – HTTP/2 “MadeYouReset” DoS Vulnerability

Organizations operating HTTP/2-enabled infrastructure—such as Apache Tomcat, Netty, F5 BIG-IP, Jetty, and other affected stacks—must act swiftly. This newly uncovered flaw enables attackers to bypass HTTP/2 stream-concurrency protections and trigger unbounded backend processing by exploiting mismatched stream reset handling, leading to severe Denial-of-Service (DoS) conditions.

This vulnerability demands urgent attention—its low-complexity technique and global exposure pose a high-priority threat to web infrastructure availability.

Link to the Research Report: https://www.cyfirma.com/research/cve-2025-8671-http-2-madeyoureset-vulnerability-ddos-attack/

#CyberSecurity #MadeYouReset #CVE20258671 #HTTP2 #DoS #ThreatIntel #ExternalThreatLandscapeManagement #VulnerabilityAlert #StreamResetAttack #InfrastructureSecurity #CYFIRMA CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s Monthly Ransomware Report – July 2025.

CYFIRMA’s July 2025 Ransomware Report recorded 504 global victims, a 7.5% rise from June, reflecting sustained threat levels. Qilin remained the most active, while Incransom and SafePay surged. Interlock introduced FileFix, a stealthy Windows UI-based delivery method; GLOBAL GROUP launched an AI-powered RaaS; and Gunra expanded to Linux with multithreaded encryption. Emerging actors like Dire Wolf and D4RK4RMY focused on data leaks and ideological messaging, moving beyond traditional encryption. Scattered Spider escalated attacks on VMware ESXi through social engineering. The U.S., Canada, and the UK were top targets, with consumer services, professional services, and manufacturing sectors hit hardest. Attackers increasingly leverage native OS tools, cloud abuse, and MFA fatigue to evade detection.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-july-2025/

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #SafePay #Interlock #GLOBALGROUP #Gunra #DireWolf #D4RK4RMY #ScatteredSpider #CYFIRMAresearch #ExternalThreatLandscapeManagement #APT #LinuxRansomware

https://www.cyfirma.com/

CYFIRMA’s latest report explores Infos3c Grabber Stealer, a Python-based grabber malware that steals passwords, wallets, gaming accounts & Discord/Telegram data, captures screenshots, and exfiltrates via Discord. 

Use endpoint security + traffic monitoring to stay safe.

Link to the Research Report: https://www.cyfirma.com/research/unveiling-a-python-stealer-inf0s3c-stealer/

#CyberSecurity #ThreatIntel #Malware #DataTheft #InfoStealer #WindowsSecurity #EndpointProtection #ThreatHunting #Inf0s3c #grabber #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

New Threat Model: Executionless Persistence Across Endpoints & AI Layers REVENANT introduces a forward-looking multi-stage attack framework that chains stealthy, executionless techniques to persist not just on systems, but in the operational memory of AI assistants.

Key Highlights:

• Executionless delivery via fonts, clipboard state, and localization strings, no exploits, macros, or dropped binaries.
• AI-layer manipulation (inspired by real-world prompt injection research) to misclassify or suppress SOC alerts.
• Covert exfiltration through whitelisted telemetry channels, such as crash reporting.
• Chainable primitives that evade signature-based detection while surviving endpoint reimaging.
• Includes MITRE ATT&CK mapping, full kill chain simulation, and lab-safe PoC scenarios for blue team training.

REVENANT shows how trusted system features and AI-integrated workflows can be turned into long-lived footholds, bypassing traditional detection entirely. It’s a wake-up call for defenders: securing endpoints is no longer enough; the AI context layer is now part of the attack surface.

Link to the Research Report: https://www.cyfirma.com/research/revenant-executionless-self-assembling-threat-hidden-in-system-entropy/

#REVENANT #CyberSecurity #AIThreats #Executionless #AdversarySimulation #ThreatResearch #RedTeam #EDREvasion #AIsecurity #PassiveExecution #TrustAbuse #CyberDefense #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA has uncovered Salat Stealer (WEB_RAT) — a Go-based infostealer targeting Windows. It exfiltrates browser credentials, cryptocurrency wallets, and Telegram session data while evading detection through advanced persistence. Attributed to Russian-speaking actors, it operates under a MaaS model.

Explore our in-depth analysis and mitigation strategies in the full report.

Link to the Research Report: https://www.cyfirma.com/research/unmasked-salat-stealer-a-deep-dive-into-its-advanced-persistence-mechanisms-and-c2-infrastructure/

#CyberSecurity #ETLM #ExternalThreatLandscapeManagement
#CYFIRMA #CYFIRMAResearch #SalatStealer

https://www.cyfirma.com/

China's Cyber Shift: From espionage to sabotage, Targeting Global Infrastructure – check out, the newest CYFIRMA blog on Beijing's ambitions in the Fifth Domain.

Link to the Research Report: https://www.cyfirma.com/blogs/typhoon-in-the-fifth-domain-chinas-evolving-cyber-strategy/

#Geopolitics #CYFIRMAresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MilitaryAffairs #SaltTyphoon #VoltTyphoon #cyberesúionage #CYFIRMA #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA identified TinkyWinkey, a stealthy Windows keylogger, capable of capturing keystrokes, system info, and active windows. It leverages DLL injection and persistent services to evade detection and maintain long-term presence.

Link to the Research Report: https://www.cyfirma.com/research/tinkywinkey-keylogger/
 

#CyberSecurity #ThreatIntelligence #Keylogger #MalwareAnalysis 

#CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement 

#ETLM

https://www.cyfirma.com/

CYFIRMA has uncovered an ongoing cyber-espionage campaign orchestrated by APT36, a Pakistan-linked threat actor, targeting Indian Government entities.

Key Highlights:

• Initial Access: Spear-phishing emails delivering weaponized .desktop files disguised as PDFs.
• Target Platforms: Windows & Linux BOSS OS.
• Malware Behavior: Downloads & executes ELF payloads, establishes persistence via cron/systemd, and communicates with C2 servers (modgovindia[.]space, securestore[.]cv).
• Impact: Data exfiltration, sustained access, and evasion of security controls.
• Malware Identifiers: Meeting_Ltr_ID1543ops.pdf.desktop, Meeting_Ltr_ID1543ops.pdf-.elf (MD5: 10b7139952e3daae8f9d7ee407696ccf, 5bfeeae3cc9386513dc7c301c61e67a7).

This campaign reflects APT36’s increasing sophistication, tailoring malware to exploit indigenous technologies like Linux BOSS OS, and ensuring persistent, covert access to critical government infrastructure.

Organizations must stay vigilant, strengthen phishing defenses, and continuously monitor for malicious infrastructure and anomalous activity.

Link to the Research Report: https://www.cyfirma.com/research/apt36-targets-indian-boss-linux-systems-with-weaponized-autostart-files/

#CyberSecurity #ThreatIntel #APT36 #CyberEspionage #Linux #Windows #Phishing #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA research exposes Lazarus Stealer — a stealthy Android banking malware targeting Russian financial institutions.

 Key Attack Vectors:

• Overlay Attack: Displays fake banking login screens to steal card details & account credentials.
• Silent SMS Notification Blocking: Obtains default SMS handler rights to suppress OTP alerts from the victim’s view.
• Real-Time OTP Harvesting: Captures verification codes instantly to bypass multi-factor authentication.
• Covert C2 Communication: Sends stolen data to attacker-controlled servers.

Link to the Research Report: https://www.cyfirma.com/research/lazarus-stealer-android-malware-for-russian-bank-credential-theft-through-overlay-and-sms-manipulation/

#AndroidMalware #BankingTrojan #OverlayAttack #SMSInterception #OTPTheft #CyberThreatIntel #MobileSecurity #CYFIRMAResearch #CYFIRMA #ETLM #ExternalThreatLandscapeManagement 

https://www.cyfirma.com/

Posing as Indian banking apps, this Android malware deploys a hidden main payload that silently installs, maintains stealthy persistence, and facilitates credential theft. It harvests SMS, steals debit card details, and hijacks call forwarding all while leveraging Firebase Cloud Messaging (FCM) as its Command & Control (C2) channel.

Link to the Research Report: https://www.cyfirma.com/research/android-malware-posing-as-indian-bank-apps/

#AndroidThreat #FCMCommandControl #MalwareAnalysis #MobileSecurity #CyberThreat #BankingMalware #ThreatHunting #AndroidMalware #CyberSecurity #CYFIRMA #ExternalThreatLandscapeManagement #ETLM #BankingTrojan #Infosec #ThreatIntel

https://www.cyfirma.com/

CYFIRMA research explores the Raven Stealer, a stealthy info-stealing malware written in Delphi & C++, designed to harvest passwords, cookies, payment info and autofill data from Chromium-based browsers like Chrome & Edge. 

Link to the Research Report: https://www.cyfirma.com/research/raven-stealer-unmasked-telegram-based-data-exfiltration/

#CyberSecurity #InfoStealer #RavenStealer #ThreatIntel #Malware #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA research provides an analysis of a newly identified Remote Access Trojan, EdskManager RAT, which exhibits stealthy infection mechanisms and covert control using HVNC.

Key Capabilities:
·      Multi-stage infection using signed binaries and encrypted config
·      HVNC-based hidden window interaction
·      Browser extension profiling (Chrome, Edge, Brave)
·      Dynamic C2 switching with zlib-compressed communication
·      Persistence via Scheduled Tasks, Run Registry keys, and Startup shortcuts

This malware represents a growing threat with advanced evasion and surveillance features. Read our full report to stay informed!

Link to the Research Report: https://www.cyfirma.com/research/edskmanager-rat-multi-stage-malware-with-hvnc-and-evasion-capabilities/

#CyberDefense #CYFIRMA #CYFIRMAresearch #ETLM 

#ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Critical Alert: CVE-2025-5777 – Pre-Auth Memory Leak in Citrix NetScaler (CitrixBleed 2)!

Organizations relying on Citrix NetScaler ADC and Gateway for secure remote access must act immediately. This newly uncovered vulnerability allows unauthenticated attackers to leak sensitive memory—including session tokens—by sending malformed authentication requests.

Exploited in the wild and backed by public PoC code, this flaw enables session hijacking, MFA bypass, and potential lateral movement inside enterprise networks. Given its low complexity and global attack surface, CVE-2025-5777 is a high-priority threat for critical sectors like government, finance, and telecom.
Apply patches, terminate active sessions, restrict exposure, and monitor for abnormal authentication flows!

Link to the Research Report: https://www.cyfirma.com/research/cve-2025-5777-pre-auth-memory-leak-in-citrix-netscaler-citrixbleed-2/

#CyberSecurity #CitrixBleed2 #CVE20255777 #NetScaler #ThreatIntel 

#ExternalThreatLandscapeManagement #ZeroTrust #VulnerabilityAlert 

#SessionHijack #MFABypass #ETLM #CYFIRMA #CYFIRMAresearch

https://www.cyfirma.com/

CYFIRMA exposes Octalyn Forensic Toolkit, a malicious GitHub-hosted tool masquerading as a legitimate forensic utility. In reality, it functions as a credential stealer with Telegram-based C2, targeting browser data, crypto wallets, Discord, and VPN configs.
 
Built with Delphi and C++, Octalyn enables even low-skilled actors to exfiltrate sensitive data using Telegram bots. It uses PowerShell scripts for stealthy second-stage payloads, making it modular and easily customizable.

Stay ahead of emerging threats with CYFIRMA.

Link to the Research Report: https://www.cyfirma.com/research/octalyn-stealer-unmasked/
 
#CyberSecurity #ThreatIntel #Octalyn #MalwareAnalysis #TelegramC2 #CredentialStealer #CYFIRMA #ETLM #OSINT #RedTeam #MalwareDetection #Infosec #ExternalThreatLandscapeManagement #CYFIRMA #CYFIRMAresearch

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s Monthly Ransomware Report – June 2025. June saw 463 ransomware victims globally, a 15% decline from May. Qilin led the threat landscape, exploiting Fortinet flaws and adding legal pressure tactics. New players like Fog and Anubis adopted stealthy, modular toolkits and file-wipers for maximum damage. 
 
 Emerging groups Teamxxx, Warlock, and kawa4096 are gaining traction, each demonstrating unique behaviors from Chaos-based payloads to single-system attacks without data exfiltration. The U.S., Canada, and the UK were top targets, with professional services, IT, and healthcare sectors most affected. Dragonforce surged, while Play and Safepay activity dropped. Attackers now blend open-source tools, cloud abuse, and RMM exploits to evade detection.
 
Get CYFIRMA’s insights to stay one step ahead.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-june-2025/
 
 #CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #Teamxxx #Warlock #kawa #Play #Dragonforce #safepay #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

New Threat Model: Zero-Click Compromise via File Rendering Automation 
RenderShock introduces a powerful new attack framework that leverages trusted file previewing, indexing, and sync mechanisms to trigger payloads — without exploits, macros, or even opening the file.
 
Key Highlights:

•  Zero-click execution using passive system features.
•  Payloads delivered via LNKs, polyglots, CHMs, EXIF beacons, and remote Office templates.
•  Targets Windows/macOS preview handlers, indexing engines, and cloud sync daemons.
• Demonstrates execution chains without user interaction or CVE exploitation.
• Includes MITRE mapping, detection guidance, and red team-ready payload chains.

Link to the Research Report: https://www.cyfirma.com/research/rendershock-weaponizing-trust-in-file-rendering-pipelines/

#RenderShock #CyberSecurity #ZeroClick #AdversarySimulation #ThreatResearch #RedTeam #EDREvasion #FileAbuse #PassiveExecution #TrustAbuse #CyberDefense #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA Research's latest report explores a fake "Free VPN for PC" app hosted on GitHub, delivering a packed DLL payload using obfuscated Base64 hidden in junk strings. It uses P/Invoke to load a hidden DLL, executes GetGameData, and injects into legit processes like MSBuild.exe. Packed, evasive, and anti-debug.

Link to the Research Report: https://www.cyfirma.com/research/github-abused-to-spread-malware-disguised-as-free-vpn/

#MalwareAnalysis #CyberSecurity #DLLInjection #FakeVPN      #ReverseEngineering #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA uncovers a sophisticated phishing campaign by APT36 (Transparent Tribe) leveraging Linux-specific malware on BOSS Linux systems (widely used by Indian government agencies). Attackers use malicious .desktop files to deploy stealthy ELF binaries while distracting users with fake PowerPoint files.

 Stay vigilant and safeguard critical infrastructure!

 Link to the Research Report: https://www.cyfirma.com/research/phishing-attack-deploying-malware-on-indian-defense-boss-linux/

#CyberSecurity #APT36 #LinuxMalware #Phishing #IndianDefense #CYFIRMA #ThreatIntel #CyberEspionage #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

12-Day War update: Israel and Iran agree to a fragile ceasefire after America's bombing run on Tehran's nuclear facilities.

Link to the Research Report: https://www.cyfirma.com/research/12-day-war-update/

#OperationRisingLion #MidnightHammer #IsraelIran #Geopolitics #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MiddleEastWar #MilitaryAffairs #CYFIRMA #ExternalThreatLandscapeManagement 

https://www.cyfirma.com/

Odyssey Stealer, a rebranded version of Poseidon Stealer, targets macOS users through the Clickfix technique—tricking victims into copy-pasting malicious scripts into their terminal.
 
With capabilities to steal hardware details, keychains, browser cookies, crypto wallets, and plugins, the stolen data is sent to the stealer's hosted infrastructure. During our analysis, we observed it creating a directory in the /tmp folder named "lovemrtrump."
 
Interestingly, earlier versions avoided CIS countries, and this trend may still continue. Stay vigilant!

Link to the Research Report: https://www.cyfirma.com/research/odyssey-stealer-the-rebrand-of-poseidon-stealer/
 
#CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM #lovemrtrump

https://www.cyfirma.com/

Cyber Threat Alert: APT36 Targets Indian Defense with a Sophisticated Phishing Campaign!
 
CYFIRMA has uncovered a targeted cyber-espionage operation by APT36 (Transparent Tribe), a Pakistan-based threat actor. This group is exploiting phishing emails embedded with malicious PDFs mimicking official NIC documents to infiltrate Indian defense systems.
 
What’s Happening:
 · Victims receive a fake “protected” PDF (PO-003443125.pdf).
 · Clicking the button redirects to a fraudulent site, downloading a disguised malware-laden ZIP file.
 · Upon execution, the malware conducts credential theft, data exfiltration, and persistent access.
 · Uses anti-debugging, fileless execution, and clipboard/keylogging techniques.
 · Communications were observed with low-reputation C2 domains via encrypted channels.
 
 Key Défense Recommendations:
 · Enforce file extension visibility on endpoints.
 · Train personnel to detect phishing lures.
 · Monitor for anomalous process trees and network traffic.
 · Apply proactive threat hunting and behavior-based detection.
 
 APT36’s campaign is a stark reminder of the evolving sophistication of state-sponsored cyber threats. Awareness, detection, and rapid response remain our best defenses. 

Link to the Research Report: https://www.cyfirma.com/research/apt36-phishing-campaign-targets-indian-defense-using-credential-stealing-malware/

#CyberSecurity #APT36 #Phishing #ThreatIntel #India #Defense #Infosec #TransparentTribe #CYFIRMA #MalwareAlert #CYFIRMA #CYFIRMAResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay ahead of evolving ransomware threats with CYFIRMA’s May 2025 Ransomware Report.

May witnessed a 15.95% spike in ransomware attacks compared to April, with 545 incidents logged globally. New actors like SafePay and SilentRansomGroup rapidly gained ground, while established groups like Qilin deployed advanced loaders like NETXLOADER and SmokeLoader. Attackers leveraged tools such as Kickidler for stealthy credential theft and embedded ransomware in JPEG files to evade detection. Vulnerabilities in SAP NetWeaver were exploited by multiple groups, deploying payloads like PipeMagic. Meanwhile, emerging groups like IMN Crew and J Group began naming victims on their leak sites.

As attackers shift to evasive techniques and exploit enterprise software, our report provides timely insights to defend critical systems.

Link to the Research report: https://www.cyfirma.com/research/tracking-ransomware-may-2025/

#CyberSecurity #RansomwareReport #ThreatIntelligence #DigitalDefense #ETLM #ThreatLandscape #StaySecure #CYFIRMA #CyberResilience #Qilin #Play #Manufacturing #IT #SafePay #Qilin #JGroup #IMNCrew

https://www.cyfirma.com/

CYFIRMA’s latest research report analyses a stealthy Windows-based malware known as CyberEye, which is posing a significant threat across systems by offering attackers full remote control through a Telegram Bot API. Once executed, it silently harvests browser-stored passwords, cookies, credit card details, Wi-Fi credentials, and session tokens from apps like Telegram, Discord, and Steam. It monitors clipboard activity in real time, hijacking cryptocurrency wallet addresses to redirect funds.
 
The malware disables Windows Defender protections using PowerShell, evades analysis, and exfiltrates stolen data instantly via Telegram chats. It can log keystrokes, capture screenshots, record desktop activity, and steal entire folders like Minecraft profiles or desktop files. Designed to blend in with legitimate software, it can persist silently, avoid detection, and respond to attacker commands over encrypted channels.
 
A private Telegram channel run by the developer suggests the existence of a premium variant with extended capabilities. This malware highlights the growing sophistication of commodity threats and their increasing distribution across underground channels.
 
Link to the Research Report: https://www.cyfirma.com/research/understanding-cybereye-rat-builder-capabilities-and-implications/

#CyberSecurity #MalwareAlert #StaySafeOnline #CYFIRMA #CYFIRMAResearch

#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Ukraine’s daring drone strike reshapes warfare! CYFIRMA’s research team examines how cheap tech took on Russia’s nuclear air force and what it means for global militaries.
 
Link to the Reseach Report: https://www.cyfirma.com/blogs/ukraines-attack-on-russias-strategic-air-force-live-feed-from-a-revolution-in-military-affairs/
 
 #Geopolitics #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #AirForce #UkraineWar #MilitaryAffairs #OperationSpidersWeb #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

A highly modular Windows Remote Access Trojan (RAT), DuplexSpy, written in C#, has surfaced with advanced surveillance and system control capabilities.

Features include keylogging, remote shell access, screen & webcam spying, audio eavesdropping, and live C2 chat.

•  It uses fileless execution, UAC bypass, registry persistence, and DLL injection to evade detection.
•  Logs keystrokes in real time, records system audio, and hijacks webcams for covert monitoring.
•  Comes with a GUI builder, making it accessible to low-skilled attackers. 
•  Communication is secured via RSA and AES encryption, complicating detection and analysis.
•  First seen on April 15th, with ongoing updates expected, including browser data stealing and AD enumeration. 

Link to the Research Report: https://www.cyfirma.com/research/duplexspy-rat-stealthy-windows-malware-enabling-full-remote-control-and-surveillance/

#DuplexSpy #CyberThreat #Malware #RemoteAccessTrojan #ThreatIntel 

#InfoSec #CyberSecurity #RAT #CYFIRMA #CYFIRMAResearch 

#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

As tensions between India and Pakistan escalated in early 2025, the conflict spilled into cyberspace. In the wake of the April 22nd Kashmir attack and India’s Operation Sindoor, dozens of hacktivist groups launched a wave of digital assaults — from DDoS attacks and defacements to claimed data breaches — targeting critical infrastructure and government entities on both sides.

While the technical impact of many attacks was limited, the volume and coordination signalled a new era of hybrid conflict. CYFIRMA’s latest report breaks down how this cyber escalation unfolded, who was involved, and what it means for the future of digital warfare.

Link to the Research Report: https://www.cyfirma.com/research/firewalls-and-frontlines-the-india-pakistan-cyber-battlefield-crisis/

#CYFIRMAResearch #CYFIRMA #CyberConflict #CyberHacktivist  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Critical Alert: CVE-2025-34027 – Authentication Bypass + RCE in Versa Concerto!
 

Organizations using Versa Concerto for network orchestration must take immediate action. This newly disclosed vulnerability allows unauthenticated attackers to bypass login mechanisms and gain remote code execution through exposed REST APIs. The flaw affects key authentication flows, exposing internal configurations and allowing full takeover of the orchestrator.
 

Given its low complexity and potential to impact critical infrastructure and telecom networks, this vulnerability represents a high-priority risk. Restrict API access and monitor for suspicious activity to mitigate threats. Stay vigilant.

Link to the Research Report: https://www.cyfirma.com/research/versa-concerto-understanding-and-mitigating-cve-2025-34027/
 
 #CyberSecurity #VulnerabilityManagement #CVE202534027 #VersaConcerto #CYFIRMAResearch #ExternalThreatLandscapeManagement #ETLM #ZeroTrust #CYFIRMA

https://www.cyfirma.com/

A new ransomware! Lyrix Ransomware targets Windows systems, encrypting files and appending random 10-character extensions. Victims receive a README.txt ransom note demanding payment, threatening to leak stolen data.
 
Strengthen robust defenses & comprehensive incident response now!
 
Link to the Research Report: https://www.cyfirma.com/research/lyrix-ransomware/

#LyrixRansomware #CYFIRMA #CYFIRMAresearch 

#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Read CYFIRMA’s latest geo-political analysis, regarding Trump’s continued disruption of the world order, calling U.S. alliances into question while an emboldened China prepares for war over Taiwan.

Link to the Research Report: https://www.cyfirma.com/research/while-trump-disrupts-the-world-order-china-prepares-for-war-over-taiwan/

#Geopolitics #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM   #currentaffairs #invasionfleet #CYFIRMA   #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

A high-risk Android malware poses a serious threat by targeting banking apps, bypassing screenshot protections through UI reconstruction to steal sensitive financial data. It records live screen activity, captures video, and audio in real time, SMS, Contacts, Call logs, files and silently auto-grants all permissions. Once installed, it takes full control of the device, monitoring every action while staying hidden. Any attempt to uninstall is blocked as it hijacks system dialogs, displays fake full-screen warnings, and locks out users from settings. This stealthy malware ensures deep persistence, making it nearly impossible to remove. This malware is being widely promoted via YouTube and Telegram channels.

Link to the Research Report: https://www.cyfirma.com/research/ghostspy-web-based-android-rat-advanced-persistent-rat-with-stealthy-remote-control-and-uninstall-resistance/

#CyberSecurity #MalwareAlert #StaySafeOnline #CYFIRMA #CYFIRMAResearch#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay ahead of evolving ransomware threats with CYFIRMA’s April 2025 Ransomware Report.

Last month revealed shifting dynamics—Qilin surged by 71%, while Play and DragonForce increased by 75% and 25% respectively. Despite a 29% drop in total incidents from March, the Manufacturing, IT, and Consumer sectors remained heavily targeted.

The U.S. topped the victim chart, followed by the UK and Canada. New threats emerged with FOG, Interlock, and ELENOR-corp using phishing lures, fake IT tools, and stealth tactics. Storm-2460 exploited a Windows zero-day, while DragonForce and Nova expanded affiliate models driving modular, widespread ransomware campaigns. Emerging Groups like Silent and Gunra are further complicating the landscape.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-april-2025/

#CyberSecurity #RansomwareReport #ThreatIntelligence #DigitalDefense 

#ETLM #ThreatLandscape #StaySecure #Cyfirma #CyberResilience #USA 

#UK #Qilin #Play #Manufacturing #IT #Silent #Gunra #Fog #Interlock  #CYFIRMA #CyfirmaResearch

https://www.cyfirma.com/

CYFIRMA’s latest threat report reveals the workings of PupkinStealer, a .NET-based information stealer designed to extract a focused set of sensitive data from victim systems. Targeting browser credentials, desktop files, Telegram and Discord sessions, and screenshots, the malware compresses all stolen content into a ZIP archive and exfiltrates it using the Telegram Bot API, making attribution and detection more challenging. Our report includes a full technical analysis, Indicators of Compromise (IoCs), MITRE ATT&CK mapping, and a custom YARA rule for detection. 

Stay informed and enhance your defenses.
 
Link to the Research Report: https://www.cyfirma.com/research/pupkinstealer-a-net-based-info-stealer/

#CyberSecurity #CYFIRMAResearch #ThreatIntel #Infostealer #PupkinStealer   #MalwareAnalysis #CYFIRMA #ExternalThreatLanscapeManagement #ETLM

https://www.cyfirma.com/

Geopolitical tensions between Algeria and Morocco have reignited over the Western Sahara issue. Hacktivist groups have exacerbated the situation by targeting each other’s critical infrastructure. Algerian hacktivists claimed to have breached Morocco's CNSS, while Moroccan hacktivists alleged, they had hacked and leaked data from Algeria's MGPTT. However, such claims often prove to involve old or publicly accessible data rather than new breaches. Despite this, these actions significantly disrupt everyday life, such as through DDoS attacks on websites essential for daily activities, thereby impacting ordinary citizens.

Link to the Research Report: https://www.cyfirma.com/research/explainer-the-algeria-morocco-tensions/

#CyberThreat #ThreatIntel #Cybersecurity #CYFIRMA #CyfirmaResearch  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

A new threat is on the rise - Gunra Ransomware. This sophisticated ransomware not only encrypts files but also exfiltrates sensitive data, threatening to leak the data unless the ransom is paid.

Read the latest report from the CYFIRMA research team to learn more! Stay informed and safeguard your systems! 

Link to the Research Report: https://www.cyfirma.com/research/gunra-ransomware-a-brief-analysis/

#CyberSecurity #Ransomware #Gunra #DataProtection #CyberThreats  #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Donald Trump’s new tariff promises to revive American manufacturing, but evidence shows they are more likely to raise prices, reduce competitiveness, deter investment, and fuel geopolitical instability. The vision of millions of factory jobs ignores automation, labor shortages, and global supply chains. Instead of revitalizing the industry, tariffs risk slowing growth and driving inflation, putting greater pressure on businesses and consumers. 

Critically, the turbulence is likely to extend into cyberspace. Economic strain and heightened geopolitical tensions are expected to trigger a sharp increase in cyberattacks! Read CYFIRMA’s latest report to learn more.

Link to the Research Report: https://www.cyfirma.com/research/us-manufacturing-relocation-and-threats/

#CyberSecurity #Geopolitics #CYFIRMAresearch #ThreatIntelligence  #cybersecurity #ETLM #currentaffairs #ExternalThreatLandscapeManagement #CYFIRMA

https://www.cyfirma.com/

Read CYFIRMA’s report on the Hannibal Stealer, a rebranded variant of SHARP and TX Stealers, which has re-emerged with expanded data exfiltration capabilities and an updated command-and-control infrastructure. Hannibal Stealer is built in C# on the .NET framework. It targets a wide range of data sources, including browsers, cryptocurrency wallets, VPN configurations, FTP credentials, and system information. It incorporates clipboard hijacking and geofencing techniques to maximize impact. The malware is managed through a Django-based control panel, enabling real-time log monitoring and payload distribution. Current promotion across Telegram and underground forums points to sustained activity.

Link to the Research Report: https://www.cyfirma.com/research/hannibal-stealer-a-rebranded-threat-born-from-sharp-and-tx-lineage/
 
 #CyberThreat #HannibalStealer #InfoStealer #ThreatIntel #MalwareAnalysis #C2Infrastructure #Cybersecurity #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

A New Breed of Python-Based RATs is Abusing Discord for C2
 
The CYFIRMA research team has investigated an emerging class of Python malware that is turning popular platforms into weaponized control panels. One recent variant showcases just how accessible and disruptive these tools have become.
 
This lightweight Remote Access Trojan (RAT) uses Discord bots and interactive UI buttons to control infected systems — no shell commands, no fancy exploits, just real-time remote control through a familiar interface.
 
 Key Capabilities:

• Locks the user’s screen with an unclosable fullscreen GUI
• Forces system crashes (BSOD) via low-level Windows API calls
• Randomly moves the mouse to confuse or disable users
• Collects system and geolocation data through public APIs
• Embeds directly into Windows Startup for persistence

 
 This serves as a critical reminder: The line between trusted apps and abuse is thinner than ever.

Link to the Research Report: https://www.cyfirma.com/research/technical-malware-analysis-report-python-based-rat-malware/
 
 #CyberSecurity #MalwareAnalysis #PythonRAT #ThreatIntel #InfoSec #RedTeam #BlueTeam #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Cybercriminals are impersonating trusted business executives and financial experts to trap unsuspecting investors. These scammers are creating fake investment firms with fraudulent registration details, professional-looking websites and manipulated social media engagement to appear legitimate. They are actively using Telegram channels, WhatsApp groups, and fake company domains to lure victims.
 
Most of these scams involve UPI payments, making it easier for fraudsters to collect and launder money swiftly. Many operate through fake mobile apps that look like real investment platforms, where users are tricked into depositing funds they can never withdraw. These schemes often function as Ponzi scams — offering early returns funded by new investors before collapsing.
 
Victims are also pressured into making fast decisions with tactics like “limited-time offers” and “VIP access.” Alarming developments show that attackers are exploiting vulnerabilities in Indian Government and educational institution websites to redirect users to malicious domains. Evidence links the developers of these fake sites to foreign courtiers , suggesting potential international involvement.
 
Stay alert. Always verify investment opportunities!
 
Link to the Research Report: https://www.cyfirma.com/research/scamonomics-the-dark-side-of-stock-crypto-investments-in-india/ 

#CyberSecurity #InvestmentScam #CYFIRMA #OnlineFraud #UPIScam 

#PonziAlert #ThreatIntel #FakeApps #StaySafeOnline #CyfirmaResearch 

#ExternalThreatLandscapeManagement

https://www.cyfirma.com/