CYFIRMA Research

At Cyfirma, we are committed to providing up-to-date information on the most prevalent threats and tactics used by malicious actors to target both organizations and individuals. This comprehensive analysis delves into the dissemination of cryptocurrency miners through a YouTube channel. Examining the tactics employed, the report reveals a concerning trend of malicious actors leveraging popular vid...

This report provides a glimpse into the evolving landscape of RAT development and malicious activities performed by threat actors working under name of ‘Anonymous Arabic’. Our team investigated the Silver RAT (written in C sharp) which has capabilities to bypass anti-viruses and covertly launch hidden applications, browsers, keyloggers, and other malicious activities. The developers operate on mul...

Satellites now sit at the heart of geopolitical power, playing a pivotal role in warfare and strategy. SpaceX's Tranche 0 satellites for the U.S. military and Starlink's impact in Ukraine exemplify this shift. Yet, amidst the dazzle of rocket launches and mega constellations, a silent cyber battle is escalating. This report explores the interconnected realms of SpaceX's advancements...

CYFIRMA’s Research team has conducted a thorough analysis of the critical security vulnerability, CVE-2023-49103, in OwnCloud's Graph. Uncovered by ownCloud on November 21, 2023, this vulnerability is assigned a CVSS score of 7.5, underscoring its severity. This flaw directly impacts OwnCloud/graphapi, posing a significant risk of unauthorized access to sensitive information! Our report provi...

Dive into the November 2023 Ransomware Report by CYFIRMA for a deep dive into evolving cyber threats. LockBit dominates with 108 victims. With a 25% surge in attacks on Manufacturing and a 78.3% rise in FMCG incidents, the need for defences is evident. Geographically, the USA remains a prime target, experiencing a 45.72% share of attacks. Explore the developments in ransomware like DJVU, Phobos an...

This report explores a sophisticated cyber threat orchestrated by the Sidewinder APT group. Targeting Nepalese government officials, this advanced threat involves a malicious Word document wielding a stealthy Nim backdoor. Unraveling the attack chain reveals a symphony of tactics, including VB scripts, BAT scripts, and a deceptive payload camouflaged as communications from the Nepalese Prime Minis...

A critical vulnerability, CVE-2023-46747, has surfaced in the F5 BIG-IP Traffic Management User Interface (TMUI), posing a significant global threat to organizations. This flaw enables unauthorized remote code execution, potentially compromising digital assets. CYFIRMA’s Research team has conducted an extensive analysis of this security flaw. Take Immediate Action! Ensure your systems are shielded...

The world has witnessed an unprecedented surge in conflicts over the past two years, surpassing any period since the end of World War II. Amidst a fracturing world order and the waning Pax Americana, simmering tensions threaten to erupt suddenly, or at the very least, escalate into major crises with significant cyber repercussions.   Link to the Research Report: THE END OF PAX AMERICANA - CYFIRMA...

At Cyfirma, we are committed to providing up-to-date information on the prevalent threats and tactics used by malicious actors. Our latest report delves into DanaBot Stealer and presents a comprehensive overview of its functionality and capabilities.   DanaBot is a stealthy, multi-stage and versatile malware that infiltrates computers to steal valuable information for monetization, operates discre...

Cyfirma’s latest report concerning a new malware, Nova, being offered by MaaSoperators Sordeal who have been actively distributing it since early 2023. This information stealer exhibits advanced capabilities, leveraging sophisticated techniques for anti-forensics and defense evasion. Nova targets most of the commonly used browsers, exfiltrating autofills, bookmarks, payment cards, cookies, downloa...

Amidst the conflicts in Ukraine and Gaza, little attention has been paid to China’s ongoing coercion in the South China Sea. Yet Beijing and Manila are in the midst of an increasingly tense standoff over Second Thomas Shoal, which could easily escalate into a major crisis or even a conflict with cyber fallout. Link to the Research Report: WITH THE WORLD DISTRACTED, CHINA STIRS TROUBLE IN THE ASIA...

Explore the October 2023 Ransomware Report from CYFIRMA, uncovering the ever-changing landscape of cyber threats. LockBit leads the charge with 66 victims. Manufacturing takes a hit with 64 incidents, stressing the need for specific defences. The USA is a prime target, enduring 151 ransomware incidents, and now, a new player, Hunters International, adds a twist to the cybersecurity plot. While the...

A critical vulnerability found in Citrix ADC/Gateway poses a severe threat to digital security. This flaw facilitates unauthorized access and potential data breaches, raising concerns globally. CYFIRMA researchers have done an in-depth analysis of this vulnerability. Immediate action needed! Secure your systems with the latest patches from Citrix. Strengthen access controls and maintain constant v...

Cybercriminals are  exploiting   vulnerabilities in major platforms, including  Windows ,  JetBrains ,  MicrosoftStreamingServiceProxy , and  Ubuntu   kernels . These exploits are being actively traded on darkwebforums , posing a serious risk of  ransomwareattacks and remote system control. For example, the  MOVEit vulnerability alone exposed millions of people to cyber threats. Threatactors such...

#Russia pulled out of the #BlackSeaGrainDeal this summer and started bombing Ukraine’s #grain export terminals with the goal of damaging Ukrainian economy and political cohesion of the #EU , after Ukrainian grain is forced towards EU #markets instead of its customers in #GlobalSouth . We assess that Russia will also use #cybertools to go after #European #agriculturallogistics to keep pressure on t...

Stay Ahead of the evolving cyber threat landscape, CYFIRMA Research's latest report dives deep into the Millenium RAT, a sophisticated Win32 executable targeting windows systems. Unveiling its advanced capabilities in data exfiltration evasion, and remote control, the report emphasizes the urgency for heightened cybersecurity awareness.   The Millenium-RAT, transitioning from v2.4 to v2.5, si...

  #Cyfirma #research presents the #Quarterly #Q3 #APT Highlights Report! This report dives into the #dynamiclandscape of Advanced Persistent Threat ( #APT ) groups, suspected to be hailing from #China , #NorthKorea , #Iran , and #Russia . Witness their #innovativestrategies and #adaptability that challenge global #cybersecurity . Link to the research report: APT QUARTERLY HIGHLIGHTS - Q3 : 2023 -...

Stay ahead of ransomware threats with CYFIRMA 2023 Q3 Ransomware Report, offering essential insights into the ever-evolving cyber threat landscape. This quarter saw a stark reminder of the urgent need for robust cybersecurity measures, as the manufacturing industry topped the list with 209 reported cyberattacks.   In addition to manufacturing, industries like IT, FMCG, Healthcare and Real Estate a...

The team at CYFIRMA recently obtained the new version of Craxs RAT. We observed the latest developments in the advanced Craxs Remote Administration Tool. The tool is now equipped with the dropper module that generates a malicious Android payload which carries the main payload. This new add-on empowers threat actors to compromise Android users with greater efficiency. What's more, the introduc...

At Cyfirma, we are committed to providing up-to-date information on the prevalent threats and tactics used by malicious actors and with our latest report we delve into a python-based information stealer ‘Akitra Stealer’ and present a comprehensive overview of its functionality and capabilities. Offered as MaaS (Malware-as-a-Service) on a dedicated website with tag “Akira Undetector”, Akira is an i...

A critical vulnerability, CVE-2023-22515, has been detected in the Atlassian Confluence Data Center and Server, posing a grave threat to organizations globally. This flaw allows unauthorized access and privilege escalation, leaving digital assets vulnerable to hackers. Alarmingly, the notorious ransomware group; Trigona, is also linked to this threat. CYFIRMA Research has done an in-depth analysis...

Shedding light on the diverse cyber threat actors entangled in the escalating Middle East cyber conflict, stemming from the ongoing situation in Gaza, our latest CYFIRMA report offers a comprehensive overview. Explore the intricate emerging trends shaped by ongoing geopolitics. Link to the Research Report: ISRAEL GAZA CONFLICT : THE CYBER PERSPECTIVE - CYFIRMA #Cybercriminals #Hacktivists #APTs #P...

CYFIRMA uncovers Nuclear 27; a nation-state threat actor, hijacking the cause of various Anonymous and other environmental hacktivists of engaging in online protests using #OpFukushima, #OpJapan, or #OpTEPCO, against the release of treated water from the Fukushima Daichi Nuclear Power Plant in Japan.   The threat actor staged a suspected nation-state propaganda, claiming a 0-day RCE vulnerability...

When you look at the ongoing conflict in Gaza, what may not be visible to the naked eye is that beyond the action on the ground, the conflict has already spiked in cyberspace. This report will tell you everything you need to know and prepare for the defence of your organization and it’s Crown jewels against an uptick in cyberattacks motivated from this geopolitical phenomenon.   Link to the Resear...

The current flareup in the Middle East is taking place in a complex tapestry of relations in the region that can be described as a hotbed of geopolitics, where – despite the superficial media image – politics always takes primacy over religion. To understand the situation better and to learn why there is a cyber arms race going on in the region, read our comprehensive CYFIRMA research report. Link...