CYFIRMA Research

The next gap in your AI agent’s security model may not be in its tool list. Most threat models for agentic AI ask one question: what is this agent allowed to use? Far fewer ask what the infrastructure around it does by default. Curious? CYFIRMA’s new report, “Shadow Channels,” examines three architectural gaps that reviews focused on declared tools and permissions can miss: 1. Trace Drain: Observa...

CYFIRMA Research - September 2026 Ransomware Threat Intelligence Briefing Ransomware activity in September 2026 settled at 862 publicly disclosed victims worldwide, down 26.3% from August's 1170, based on CYFIRMA's final full-month leak-site tracker count. Affiliate tradecraft around RMM abuse, edge access, BYOVD, and data extortion remained intact. Link to the Research Report: https://w...

The CYFIRMA Research team has published its Australia & New Zealand Cyber Threat Landscape Report, examining cyber threat activity across Mining, Financial Services, Manufacturing, and Banking from January 2025 onward. The research highlights a persistent identity and access-driven threat landscape, with credential-based attacks, ransomware, compromised access, and underground-market activity...

Tax-Themed Malware Campaign Abusing Indian Income Tax Department Identity Researchers at CYFIRMA have identified and analysed a malware distribution campaign abusing the Indian Income Tax Department theme to target users in India. The campaign uses multiple fraudulent tax-themed domains, deceptive assessment notices, and a malicious VHDX disk image to deliver a staged malware payload.  The campaig...

August 2026 Ransomware Threat Intelligence Briefing Ransomware activity rebounded in August 2026, with 1046 publicly disclosed victims worldwide, an 18.2% increase from July, highlighting the continued resilience and expansion of the ransomware-as-a-service (RaaS) ecosystem. In this episode, we break down: • The most active ransomware groups shaping the August threat landscape, including Qilin and...

India BFSI Cyber Threat Landscape 2026 India’s BFSI ecosystem is entering a more complex cyber-risk environment where data exposure, ransomware, digital-payment fraud, identity compromise, AI-enabled social engineering, cloud/SaaS abuse and third-party risk are increasingly converging. Our latest analysis of validated threat activity identified 46 data-breach incidents, 37 data-leak incidents and...

Deepfakes didn't stay a disinformation problem; they've become a manufacturing supply chain risk. Our latest cyber threat intelligence report breaks down what's actually happening on the ground: Executive impersonation fraud is scaling fast: Arup lost $25M after attackers ran a live video call where every "executive" on screen was AI-generated. Pindrop tracked a 1,210% ris...

A stolen credential at one company just breached a completely different company.   No malware in that second half. No phishing email either. Just an OAuth grant nobody flagged as risky. CYFIRMA's new report, "The Trust Cascade," walks through four real, documented intrusions from the past year and finds they aren't isolated incidents. They're the same attack surface, enter...

While conventional weapons in the Middle East may pause under a shaky ceasefire, the wires remain hot. Our latest analysis dives into the fragile U.S.–Iran conflict over the Hormuz Strait, exploring how a permanent grey-zone and cyber attrition are shaping a new era in the Middle East. Link to the Research Report: https://www.cyfirma.com/research/permanent-attrition-and-the-shifting-grey-zone-in-t...

Technical Analysis: Lucid Stealer Understanding how modern information stealers operate is essential for strengthening enterprise defenses.   Our comprehensive technical analysis of Lucid Stealer provides an in-depth breakdown of its complete execution lifecycle—from payload initialization and anti-analysis techniques to browser credential theft, cryptocurrency wallet targeting, PowerShell-based k...

July 2026 Ransomware Threat Intelligence Briefing Ransomware activity rebounded sharply in July 2026, with 883 publicly disclosed victims worldwide, a 21.3% increase from June and one of the highest monthly totals of the year, highlighting the continued resilience and expansion of the ransomware-as-a-service (RaaS) ecosystem. Link to the Research Report : https://www.cyfirma.com/research/tracking-...

AI is changing the cybersecurity threat landscape and accelerating the speed, scale, and sophistication of cyberattacks. CYFIRMA’s latest insights on Thailand’s AI-era cyber risk environment highlight a critical shift: AI is not necessarily creating entirely new attack categories. Instead, it is acting as a force multiplier, enabling threat actors to conduct reconnaissance, personalise phishing an...

UK & Ireland Threat Landscape Report 2026 The cyber threat landscape across the United Kingdom and Ireland continues to evolve as ransomware groups, data leak actors, and financially motivated adversaries refine their tactics and expand their operational reach. Our latest The UK & Ireland Threat Landscape Report delivers an intelligence-led assessment of the region's evolving threat e...

The next industrial espionage campaign may not begin with malware. It may begin with an AI-generated resume, a cloned executive's voice, or an employee asking a public chatbot for help. Perhaps the biggest shift is not any individual technique, but how these capabilities combine. The report explores emerging risks around AI coding assistants, software supply chains, overprivileged AI agents,...

CYFIRMA's latest assessment highlights a threat environment shaped by ransomware, state-aligned espionage, mobile banking fraud, AI-enabled attacks, and persistent botnet activity. Key findings:  🔹 Ransomware remains the most disruptive threat  🔹 Mobile banking fraud is becoming increasingly sophisticated and scalable  🔹 State-sponsored actors continue targeting government and critical inf...

The June 2026 edition of the CYFIRMA Ransomware Threat Intelligence Briefing is now available. While publicly disclosed ransomware incidents declined during the month, threat actors continued to evolve their operations through Initial Access Brokers, ClickFix campaigns, custom malware, identity-focused attacks, and advanced defense-evasion techniques. Tune in as the CYFIRMA Research Team analyzes...

Artificial intelligence is reshaping the cyber threat landscape, and e-commerce platforms are increasingly becoming prime targets for AI-powered bot attacks. Unlike traditional bots, these advanced automated tools can mimic legitimate user behaviour, adapt to security controls, and execute large-scale attacks with greater speed and precision. From credential stuffing and account takeover to invent...

Saudi Arabia’s digital ecosystem is facing a convergence of escalating cyber risks. Our latest threat landscape assessment highlights: 🔹 Intensified state-aligned espionage targeting Saudi Arabia   🔹 Ransomware operational maturity with multi-vector intrusion models  🔹 AI-enabled phishing increasing credential harvesting success rates  🔹 Rising dark web exposure of Saudi-linked datasets and ac...

Hong Kong Cyber Threat Landscape 2025–26 CYFIRMA's latest intelligence assessment reveals a sharp rise in ransomware, state-aligned espionage, cloud abuse, and data-theft operations targeting Hong Kong. Ransomware groups like RansomHouse, Cl0p, Sinobi, and advanced APTs such as Salt Typhoon, Lotus Panda, PlushDaemon, APT41, and Tropic Trooper continue to drive high-impact activity across fina...

Fake Income Tax Notice Delivers RAT Malware CYFIRMA has identified a sophisticated malware distribution campaign leveraging a fraudulent Indian Income Tax Department assessment notice to infect users with a Remote Access Trojan (RAT)-like payload. The campaign uses a convincing tax-themed lure hosted on a malicious domain to impersonate legitimate government communications, tricking victims into d...

An active phishing campaign is leveraging Microsoft Teams-themed lures to distribute legitimate remote access software configured for unauthorized access.   The campaign highlights a growing trend in cybercrime operations: leveraging trusted platforms, legitimate software, and reputable hosting providers to bypass conventional security controls. As threat actors continue shifting toward legitimate...

CYFIRMA's latest research documents how adversaries are exploiting the Model Context Protocol, the integration standard now embedded in Claude, Copilot, Cursor, VS Code, and hundreds of enterprise AI platforms, to turn AI agents into autonomous attack infrastructure. If your organization has deployed MCP-connected agents in production, the decisions this report describes are available now. #T...

Alert : Major NPM Supply Chain Attack Exposed: 2.7M+ Downloads Impacted CYFIRMA Researchers identified 11 malicious npm packages targeting blockchain and Web3 developers, highlighting the growing risks within the open-source software supply chain. The attack demonstrates how a single typo or unverified dependency can introduce malicious code into development workflows. As Web3 adoption grows, soft...

48 teams 3 host nations. Billions of viewers And a cyber-attack surface unlike anything seen before. As global anticipation for the FIFA World Cup 2026 grows, so does cybercriminal interest. Our assessment identified FIFA-themed phishing domains, fraudulent ticketing infrastructure, and malicious streaming platforms already leveraging tournament branding. Looking ahead, organizations should prepar...

CYFIRMA Healthcare Industry Report | Q2 2026 | Overall industry risk: 6.9 / 10 - ELEVATED 90 days of telemetry. 5 threat categories. Here is what the numbers say about the healthcare sector this quarter. Ransomware across the period: 216 victims across 42 countries, up 8.5% from 199 last quarter, with 50 of 81 active gangs recording healthcare targets (62% participation, the highest rate observed...