CYFIRMA Research

CYFIRMA’s research team has discovered a new Remote Access Trojan named Xeno-RAT, featuring sophisticated capabilities. Through comprehensive analysis, our report explores the various evasion techniques utilized by threat actors to circumvent detection, as well as elucidates the methods employed in creating robust malware payloads. Xeno RAT, a potent malware written in C# with advanced capabilitie...

The recent acceleration in hostilities involving Iran-backed militias and the United States, coupled with a surge in Israeli strikes on Iranian positions in Syria, seems to have compelled Tehran to reassess elements of its regional strategy. These regional escalations come at an inopportune time for Iran. This report assesses the current situation in the Middle East, including Iran’s current postu...

Urgent Security Advisory! A critical vulnerability, CVE-2024-23897, has surfaced in Jenkins, posing a global threat to digital security. CYFIRMA researchers have conducted an in-depth analysis and exploitation, Immediate action is advised - secure your systems with the latest Jenkins patches. Strengthen access controls, fortify your digital infrastructure, and remain vigilant. Stay informed about...

Our latest report talks about the XSSLite Stealer; an infostealer born from a malware development competition on a Russian hacking forum. This infostealer comes with anti-sandbox & anti-debugging capabilities, in addition to a web panel's source code to receive the stealer logs from compromised victims.  A hefty prize pool of tens of thousands of USD shows just how much these administrato...

Uncover the latest trends in the cybersecurity landscape with CYFIRMA's January 2024 Monthly Ransomware Report. LockBit takes the lead with 64 victims, targeting diverse industries, notably Manufacturing. Despite a 20.51% dip in incidents from December 2023, the long-term trend indicates a persistent rise in ransomware threats. New players like Slug, Going Insane, and Kasseika bring fresh cha...

In times of conflict, the cyber realm becomes a battleground too! Instances like the Russia-Ukraine war & Israel-Gaza conflict show how hacktivists are playing a role. They launch attacks using DDoS tools, deface websites, and even mentor others to disrupt organizations. In the ongoing Israel-Palestine conflict, hackers are wreaking havoc online too. They're creating custom tools, sharing...

CYFIRMA’s research team, reveals a critical OS command injection vulnerability (CVE-2024-21833) affecting TP-Link Routers, demanding immediate attention. With a high CVSS score of 8.8, this flaw poses a significant risk, attracting state-sponsored entities and threat groups. Active exploitation is observed, emphasizing the need for prompt patching, proactive monitoring, and collaboration within th...

The CYFIRMA research team reveals a Russian-origin Drainer-as-a-Service (DaaS) project gaining traction in the hacking community. This crypto drainer targets wallets on Ethereum, BNB, Polygon, etc with a massive affiliate network of 10k members.  Our investigation reveals how the threat actors are creating phishing infrastructure at no cost, subsequently using compromised Twitter accounts to launc...

The geopolitical landscape in 2024 is at a critical juncture! As we begin the year, explore five key events may shape the course of global affairs and have profound effect on the Cyber Threat Landscape through this Cyfirma blog! Covering the below key events:     ·       World Goes to the Polls: Over four billion people in nearly 80 countries will participate in elections, with Taiwan's recen...

“CYFIRMA’ s research team has identified a new stealer in the wild called “Rage Stealer”. Rage Stealer employs a multifaceted approach, covertly extracting sensitive data encompassing browsers, cryptocurrency wallets, files, credentials, and various applications data. What sets "Rage Stealer" apart is its systematic organization of extracted information into specific directories, ensurin...

The CYFIRMA team recently discovered a malicious Android package orchestrating a sophisticated extortion scheme. Masked as a loan app promising quick funds, unsuspecting users are duped into revealing sensitive information during the installation process.  The deceptive app coerces victims into submitting KYC details, including a selfie, gradually acquiring a wealth of personal data. Once armed wi...

CYFIRMA’s Q4 2023 APT report focusses on APT groups from Iran, Russia, China, and North Korea, that brought forth a wave of dynamic and innovative cyber activities, challenging the global cyber security landscape. Iranian actors targeted telecom, higher education, and tech sectors, showcasing updated techniques and new C2 frameworks in the backdrop of the Israel-Hamas conflict. Russian APTs target...

Monster Cloud, an emerging player in the Russian stealer log threat landscape, has shifted from just offering stealer logs to a Malware-as-a-Service (MaaS) model. Operating on Telegram, these threat actors have announced the release of their fully native proprietary information stealer. In this report, we dive into the operations of the Russian-speaking threat group, their history, and capabilitie...

A critical vulnerability has been identified in Apache Struts 2, exposing a global threat to digital security. CYFIRMA Researchers have analysed this flaw, uncovering potential risks of unauthorized access and data breaches. It is advised to take immediate action - secure your systems with the latest Apache Struts 2 patches. Strengthen access controls, fortify your digital infrastructure, and rema...

Taiwan’s election marks the first on the calendar in what will be the largest election year in history. Understanding how the onslaught of disinformation will impact the opinions of the Taiwanese public will be critical for Taiwan’s election, but the tactics and behaviors will likely be duplicated elsewhere, not only by the Chinese Communist Party but also by other actors. Based on previous experi...

Dive into Cyfirma’s December 2023 Ransomware Report for an exploration of evolving cyber threats. The rise of new players like Hunters International, Dragon Force and WereWolves highlight a severe threat.    With 75% more incidents in 2023 than in 2022, this report unveils critical insights into the escalating global cybersecurity threat. Covering key events during this period such as:   Akira hit...

At Cyfirma, we are committed to providing up-to-date information on the most prevalent threats and tactics used by malicious actors to target both organizations and individuals. This comprehensive analysis delves into the dissemination of cryptocurrency miners through a YouTube channel. Examining the tactics employed, the report reveals a concerning trend of malicious actors leveraging popular vid...

This report provides a glimpse into the evolving landscape of RAT development and malicious activities performed by threat actors working under name of ‘Anonymous Arabic’. Our team investigated the Silver RAT (written in C sharp) which has capabilities to bypass anti-viruses and covertly launch hidden applications, browsers, keyloggers, and other malicious activities. The developers operate on mul...

Satellites now sit at the heart of geopolitical power, playing a pivotal role in warfare and strategy. SpaceX's Tranche 0 satellites for the U.S. military and Starlink's impact in Ukraine exemplify this shift. Yet, amidst the dazzle of rocket launches and mega constellations, a silent cyber battle is escalating. This report explores the interconnected realms of SpaceX's advancements...

CYFIRMA’s Research team has conducted a thorough analysis of the critical security vulnerability, CVE-2023-49103, in OwnCloud's Graph. Uncovered by ownCloud on November 21, 2023, this vulnerability is assigned a CVSS score of 7.5, underscoring its severity. This flaw directly impacts OwnCloud/graphapi, posing a significant risk of unauthorized access to sensitive information! Our report provi...

Dive into the November 2023 Ransomware Report by CYFIRMA for a deep dive into evolving cyber threats. LockBit dominates with 108 victims. With a 25% surge in attacks on Manufacturing and a 78.3% rise in FMCG incidents, the need for defences is evident. Geographically, the USA remains a prime target, experiencing a 45.72% share of attacks. Explore the developments in ransomware like DJVU, Phobos an...

This report explores a sophisticated cyber threat orchestrated by the Sidewinder APT group. Targeting Nepalese government officials, this advanced threat involves a malicious Word document wielding a stealthy Nim backdoor. Unraveling the attack chain reveals a symphony of tactics, including VB scripts, BAT scripts, and a deceptive payload camouflaged as communications from the Nepalese Prime Minis...

A critical vulnerability, CVE-2023-46747, has surfaced in the F5 BIG-IP Traffic Management User Interface (TMUI), posing a significant global threat to organizations. This flaw enables unauthorized remote code execution, potentially compromising digital assets. CYFIRMA’s Research team has conducted an extensive analysis of this security flaw. Take Immediate Action! Ensure your systems are shielded...

The world has witnessed an unprecedented surge in conflicts over the past two years, surpassing any period since the end of World War II. Amidst a fracturing world order and the waning Pax Americana, simmering tensions threaten to erupt suddenly, or at the very least, escalate into major crises with significant cyber repercussions.   Link to the Research Report: THE END OF PAX AMERICANA - CYFIRMA...

At Cyfirma, we are committed to providing up-to-date information on the prevalent threats and tactics used by malicious actors. Our latest report delves into DanaBot Stealer and presents a comprehensive overview of its functionality and capabilities.   DanaBot is a stealthy, multi-stage and versatile malware that infiltrates computers to steal valuable information for monetization, operates discre...