CYFIRMA Research

APT36 Multi-Vector Execution Malware Campaign Targeting Indian Government Entities Researchers at CYFIRMA have identified and analyzed a sophisticated malware campaign attributed to APT36 targeting Indian government entities. The campaign demonstrates a structured, multi-stage infection chain designed for stealth, persistence, and long-term remote access. This campaign reflects a targeted espionag...

The Telegram ecosystem. Ransomware groups, Initial Access Brokers, malware operators, and leak channels are converging on a single platform for coordination, recruitment, validation, and amplification. This isn’t a migration from darknet forums — it’s an operational upgrade.  Link to the Research Report: Telegram as the New Operational Layer of Cyber Threat Activity - CYFIRMA #CyberSecurity   #Thr...

Emerging Threat Model: Python-Based Credential Stealer (CharlieKirk Grabber): Recent analysis of a Python-based information stealer highlights the continued growth of modular, builder-driven malware targeting Windows environments. The sample demonstrates how commodity stealers are evolving to combine credential harvesting, system profiling, and cloud-based exfiltration using legitimate services an...

Stay ahead with CYFIRMA’s January 2026 Ransomware Threat Report. January 2026 opened with sustained high ransomware activity and sharp operational volatility across major groups. Qilin remained one of the most active actors despite a post-surge decline, while Cl0p executed a dramatic rebound after a December pause, highlighting how quickly campaigns can reactivate at scale. Thegentlemen and Sinobi...

Malware Spotlight: LTX Stealer  CYFIRMA researchers uncovered a sophisticated Windows info-stealer hidden in a legit Inno Setup installer. Key takeaways:  🔹 Node.js stealer with Bytenode bytecode obfuscation  🔹 Targets Chromium browsers & crypto wallets  🔹 Persists in hidden/system folders under Program Files(x86)   🔹 Uses Supabase for operator auth + Cloudflare to mask backend  🔹 Commerc...

CYFIRMA has identified an active Telegram phishing campaign that abuses Telegram’s legitimate login and in-app authorization workflows to fully compromise user accounts without malware or exploits. By leveraging QR codes and manual login flows tied to attacker-controlled Telegram API credentials, victims are tricked into approving genuine authorization prompts inside the Telegram app under false s...

Critical Alert: CVE-2026-23760 – SmarterMail Pre-Auth Bypass Leading to Full System Compromise Organizations running SmarterTools SmarterMail email servers—widely deployed across SMBs, MSPs, educational institutions, and healthcare environments—must take immediate action. This actively exploited authentication bypass vulnerability allows unauthenticated attackers to reset system administrator pass...

Threat Research Alert | Android Loan Scam Our analysis uncovered an Android application, Hicas, distributed via the Google Play Store and marketed as a Smart Travel Packing Companion, which covertly operates as a region-targeted fraudulent loan platform. Key Findings: • Play Store app masquerading as a travel utility • Region-based cloaking activates loan flow on IN devices • Remote WebView delive...

WinRAR CVE-2025-8088 is a path validation vulnerability that allows a crafted RAR archive to write files outside the intended extraction directory during unpacking. In the observed attack chain, this behavior is abused to silently drop a malicious script into the Windows Startup folder, establishing persistence without requiring administrative privileges or explicit execution by the user. Once tri...

Mamba 2FA illustrates the evolution of phishing into highly automated adversary-in-the-middle attacks that can bypass traditional MFA by closely emulating legitimate cloud authentication experiences. As part of a broader phishing-as-a-service ecosystem, these tools enable scalable, low-effort campaigns with high impact across cloud environments. Addressing this threat requires MFA-resistant authen...

Emerging Threat Model: SOLYXIMMORTAL Malware Recent analysis highlights how modern commodity malware continues to evolve by abusing legitimate system functionality rather than relying on exploits or vulnerabilities. The malware demonstrates how attackers can achieve persistent access, credential theft, and user surveillance entirely within the user space, leveraging trusted operating system featur...

Stay ahead with CYFIRMA’s December 2025 Ransomware Report. December marked the most active month of 2025 with 801 global ransomware victims, signaling a strong year-end escalation. Qilin surged to 175 victims, reinforcing its dominance, while Safepay and Sinobi posted sharp month-over-month growth, highlighting shifting group momentum. Ransomware operations increasingly adopted cartel-style, acces...

The threat landscape just got more complex. The Scattered LAPSUS$ Hunters-alliance has re-emerged, merging the tactics of notorious groups. This isn’t just a name change; it’s a shift toward professionalized, identity-centric extortion. What you need to know: High-Value Targets: Focused on enterprises with $500M+ revenue, specifically in Cloud, Telecom, and Finance. Identity is the Perimeter: They...

APT36 Targets Indian Entities Using Weaponized Windows Shortcut Files CYFIRMA has identified a coordinated cyber-espionage campaign attributed to APT36 (Transparent Tribe), a Pakistan-aligned threat actor persistently targeting Indian government entities and strategic sectors. This campaign highlights APT36’s evolving tradecraft, leveraging malicious Windows shortcut (.LNK) files and multi-stage p...

Hacktivist activity is often dismissed as low-sophistication noise, website defacements, DDoS attacks, or online activism. Our latest research argues that this view is increasingly outdated. The report introduces Hacktivist Proxy Operations as a repeatable model of deniable cyber pressure, where ideologically aligned non-state groups apply disruption, narrative amplification, and psychological pre...

Threat Alert: APT 36 CYFIRMA has identified a targeted malware campaign abusing fake NCERT WhatsApp advisory PDFs to compromise Windows systems. Link to the Research Report: APT36 LNK-BASED MALWARE CAMPAIGN LEVERAGING MSI PAYLOAD DELIVERY - CYFIRMA #APT36 #Cyberthreatintelligence #Malware analysis #Threathunting #Cybersecurity #ETLM #CYFIRMA https://www.cyfirma.com/

A sophisticated QR-code phishing (“quishing”) campaign is targeting employees with payroll-themed lures, bypassing email security and harvesting credentials via obfuscated, per-victim infrastructure. This trend underscores the growing risk of mobile-based phishing and the need for stronger user awareness and behavior-driven defenses. Link to the Research Report: Quishing Campaigns : Advanced QR-Co...

New Research Alert: NexusRoute Campaign Uncovered    We’ve uncovered a large-scale Android malware and phishing operation impersonating Indian government services like mParivahan and e-Challan. Threat actors are abusing GitHub to host malicious APKs and fake payment portals, tricking users into sharing OTPs, UPI PINs, and financial details. The malware uses advanced techniques—dynamic loaders, nat...

Mobile Threat Alert: Crypto Mnemonic Phrase Stealer SeedSnatcher is a newly uncovered Android malware family targeting the crypto ecosystem, built to steal users’ mnemonic recovery phrases using a sophisticated DisplayOverlay attack Capabilities: Intercepts and exfiltrates seed phrases and private keys from major cryptocurrency wallets Presents deceptive wallet-import screens to lure users into en...

CYFIRMA researchers have identified a sophisticated Android malware operation spreading via fake RTO Challan/e-Challan notifications shared over WhatsApp.   The malicious APK uses two-stage installation, NP-based code obfuscation, and a custom VPN layer to evade detection and maintain persistent control over infected devices. C2 Infrastructure Exposed. Our analysis uncovered two domains used as th...

CYFIRMA | November 2025 Ransomware Snapshot Ransomware activity shifted fast in November—Akira and INC Ransom surged; AI-driven tools accelerated attacks, and critical sectors like Manufacturing, IT, and Professional Services took the heaviest hits. North America remained the top target as threat actors expanded into virtualization platforms and even official software marketplaces. The ransomware...

APT36 Targets Indian Government Entities with a New Python-Based ELF Malware. CYFIRMA has uncovered a new cyber-espionage campaign by APT36 (Transparent Tribe), a Pakistan-based threat actor long known for targeting Indian government entities and strategic sectors. This campaign showcases a major leap in the group’s technical sophistication — delivering custom Python-based ELF malware through weap...

After Russia’s veto of the UN Panel of Experts and increased military cooperation over the war in Ukraine, North Korea is ramping up sanctions evasion—deepening its military ties with Moscow and stealing billions in cryptocurrency to finance its WMD programs. Link to the Research Report: NORTH KOREAN CYBER CRIME AS A STATECRAFT TOOL - CYFIRMA #NorthKorea   #Russia   #sanctions   #cryptoheist   #Ge...

Black Friday & Cyber Monday Cyber Threats Are Already Here As festive shopping surges, so does cybercrime. CYFIRMA’s latest analysis reveals a spike in fake websites, phishing campaigns, malicious ZIP downloads, UPI-based payment scams, and dark-web-powered phishing kits—all engineered to exploit the 2025 holiday rush. Our researchers uncovered multiple spoofed retail domains, automated malwar...

Tycoon 2FA - The Phishing-as-a-Service Platform Our latest technical deep-dive reveals how Tycoon 2FA, a sophisticated Phishing-as-a-Service (PhaaS) platform, is successfully evading detection and bypassing multi-factor authentication (MFA) to compromise enterprise cloud environments. This isn't just another phishing kit. It's an Adversary-in-the-Middle (AitM) framework that captures ses...