CYFIRMA Research

Threat Research: Operation Tax Shadow Explore CYFIRMA's latest report regarding a tax-themed phishing campaign impersonating government tax authorities across multiple countries. • Multi-stage malware delivery via ZIP archive  • DLL Search Order Hijacking for stealthy execution  • API Hooking and Access Token Manipulation  • COM Callback-based code execution to evade monitoring  • Modified RC...

Kenya’s cyber threat landscape is intensifying. The latest CYFIRMA report reveals a surge in ransomware activity, credential leaks, dark web data trading, website defacements, and attacks targeting government, finance, telecom, and critical infrastructure sectors throughout 2025–2026. From ransomware groups like Qilin and RansomHub to large-scale underground credential sales and AI-driven phishing...

The CYFIRMA Research team has identified key security insights related to CVE-2026-34197, a high-severity remote code execution vulnerability affecting Apache ActiveMQ Classic deployments. The vulnerability arises from exposure of the Jolokia JMX-HTTP bridge, which allows authenticated attackers to invoke privileged broker management operations and abuse the addNetworkConnector() functionality to...

China’s cyber threat landscape is evolving faster than ever — and the implications go far beyond its borders. Our latest threat intelligence report 2025 – 2026 highlights a convergence of ransomware, state-sponsored espionage, and systemic infrastructure risk that organizations cannot afford to ignore. From hyper-targeted phishing to faster vulnerability exploitation, AI is increasing both the spe...

The increasing digitalization of India’s education sector has created a growing attack surface for cybercriminals targeting student-related data. Our latest threat intelligence assessment explores how exposed or misused student information is being leveraged for phishing, social engineering, impersonation, credential theft, and financial fraud.  The report highlights multiple observed cases involv...

South Korea isn't just facing high-frequency cyberattacks, it’s navigating a highly professionalized exploitation pipeline. Regional APTs, RaaS affiliates, and initial access brokers aren't operating in silos; they are stakeholders in a maturing digital shadow economy. South Korea’s hyper-connected infrastructure and high-value industrial sectors aren't just targets-they are high-yi...

CYFIRMA – April 2026 Ransomware Threat Intelligence Briefing Ransomware activity reached 801 global incidents in April 2026, marking the highest April total in recent years and reinforcing the continued expansion of ransomware-as-a-service operations. In this episode, the CYFIRMA Research Team breaks down: • The most active ransomware groups driving April activity • Key sectors and countries under...

Operation SilentCanvas – JPEG-Based Multi-Stage PowerShell Intrusion CYFIRMA Research conducted an in-depth technical investigation into a sophisticated multi-stage intrusion campaign leveraging a weaponized PowerShell payload disguised as a legitimate “.jpeg” image file to deploy a trojanized ConnectWise ScreenConnect framework for covert persistent access.     Key highlights from the research:  ...

New Research: Trusted Infrastructure Phishing — The Attack That Lives Inside Your Security Stack Most phishing starts outside your perimeter. This one starts inside it. Trusted Infrastructure Phishing (TIP) is a threat class in which every phase of the attack chain — delivery, hosting, execution, authentication, and persistence — operates through legitimate, enterprise-trusted cloud infrastructure...

Malaysia isn’t just seeing cyber threats - it’s seeing a structured cyber economy take shape. Ransomware groups, data brokers, and access sellers are all operating across the same ecosystem. Manufacturing, government, and service sectors aren’t just targets - they’re data-rich environments with real extortion value. It’s a connected threat landscape: Data breaches feeding underground markets.  Ran...

Taiwan Cyber Threat Landscape 2026 Taiwan remains at the forefront of global cyber conflict—driven by its semiconductor dominance, strategic geopolitical position, and deep international partnerships. 🔹 Relentless Pressure: ~2.63M daily cyber intrusion attempts in 2025 (+100% since 2023)  🔹 Primary Threat Actors: PRC-linked APT groups conducting espionage, IP theft, and infrastructure pre-positi...

Singapore’s position as a global financial, technological, and connectivity hub continues to attract sophisticated cyber threats from both state-sponsored actors and financially motivated cybercriminal groups. Key Threat Actors Identified : UNC3886, Mustang Panda, Volt Typhoon, APT41 – China-linked APT groups conducting long-term espionage targeting telecoms, government networks, and high-tech ind...

Stay ahead with CYFIRMA’s Philippines Evolving Cyber Threat Landscape 2025–2026 Report. The Philippines is facing a sharp escalation in AI-driven and automated cyber threats. Q3 2025 recorded over 52 million exposed credentials, while ransomware operations increasingly targeted operational systems across healthcare, BFSI, and critical infrastructure. Identity compromise, vendor access abuse, and s...

KYCShadow: Mobile Threat Alert – Android Banking Malware Campaign CYFIRMA Research has identified a sophisticated Android malware campaign distributed via WhatsApp, impersonating Bank KYC and e-Challan services to compromise financial users at scale. The campaign demonstrates structured backend operations and infrastructure reuse (e.g., jsonapi[.]biz), indicating a coordinated and evolving fraud e...

Operation PhantomCLR Our latest research uncovers a highly sophisticated post-exploitation framework that represents a significant shift in modern attacker tradecraft. The campaign leverages .NET AppDomainManager hijacking to abuse a legitimate, digitally signed Intel binary (IAStorHelp.exe), transforming it into a stealthy execution container without modifying the original file.  This allows mali...

CYFIRMA Research has identified an active crypto drainer campaign targeting Trust Wallet users through QR code phishing distributed via Telegram channels. The attack leverages deep link abuse and deceptive transaction flows to gain persistent access to victim funds. This campaign highlights a shift toward user-authorized exploitation, where no wallet vulnerability is required. By abusing standard...

The CYFIRMA Research team has identified critical security insights related to CVE-2026-1492, a high-severity authentication bypass and privilege escalation vulnerability affecting the WordPress User Registration & Membership plugin. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting improper server-side validation and weak authorization controls wit...

March reflected a further escalation in ransomware activity, with incident volumes rising and multiple threat actors expanding operations simultaneously. Qilin emerged as the most dominant group with a sharp increase in activity, while several others, including Akira, Incransom, Nightspire, Dragonforce, and LockBit5, showed significant growth, indicating a highly competitive and rapidly scaling ec...

CrySome RAT – Advanced Threat Insight CrySome RAT is a sophisticated .NET-based remote access trojan engineered for long-term persistence and stealth on Windows systems. It extends beyond typical malware by maintaining execution even after system resets, leveraging recovery partition abuse and offline registry manipulation to ensure continued presence. Beyond persistence, it delivers a full post-e...

New Threat Intelligence Report: Invoice-Themed Phishing Campaign A sophisticated phishing campaign is actively targeting finance and procurement teams using invoice, payment, and operational lures—timed strategically around financial year-end activities. With increased transaction volumes and audit processes, employees are more likely to engage with seemingly routine emails—making this campaign pa...

Stay informed with CYFIRMA’s February 2026 Ransomware Threat Report. February continued to reflect a high-activity ransomware environment, with noticeable shifts in group dynamics and operational patterns. While Qilin sustained consistent activity levels, other actors showed mixed trends, with some groups scaling rapidly and others reducing operations, highlighting the constantly evolving nature o...

The CYFIRMA Research team has identified critical security insights related to CVE-2026-24423, a high-severity unauthenticated remote code execution vulnerability impacting SmarterTools SmarterMail. The vulnerability allows attackers to execute arbitrary commands through the ConnectToHub API, potentially leading to full system compromise. Our research highlights the exploitation mechanism, threat...

CYFIRMA Research uncovered a targeted Android spyware campaign, Operation False Siren, exploiting wartime urgency by weaponizing the trusted Israeli civil defense alert application. In this operation, threat actors distributed a trojanized version of the missile warning app via SMS phishing (smishing) campaigns, convincing victims to install what appeared to be a critical alert system update. Once...

New Report Released: Advanced Android Banking RAT Targeting Russian Financial Institutions CYFIRMA Research has uncovered a highly sophisticated Android Banking Trojan with integrated Remote Access Trojan (RAT) capabilities targeting Russian users and financial institutions, such as banking apps, cryptocurrency applications, government services apps, and marketplace platforms. What the report cove...

New Research: Dead Infrastructure Hijacking — The Attack That Doesn't Need a Vulnerability Most breaches start with an exploit. This one starts with a domain registration. We've published a full threat intelligence report on Dead Infrastructure Hijacking (DIH) — a threat class that exploits residual trust relationships left behind when digital infrastructure is decommissioned, migrated,...