CYFIRMA Research

Cyfirma’s latest report concerning a new malware, Nova, being offered by MaaSoperators Sordeal who have been actively distributing it since early 2023. This information stealer exhibits advanced capabilities, leveraging sophisticated techniques for anti-forensics and defense evasion. Nova targets most of the commonly used browsers, exfiltrating autofills, bookmarks, payment cards, cookies, downloa...

Amidst the conflicts in Ukraine and Gaza, little attention has been paid to China’s ongoing coercion in the South China Sea. Yet Beijing and Manila are in the midst of an increasingly tense standoff over Second Thomas Shoal, which could easily escalate into a major crisis or even a conflict with cyber fallout. Link to the Research Report: WITH THE WORLD DISTRACTED, CHINA STIRS TROUBLE IN THE ASIA...

Explore the October 2023 Ransomware Report from CYFIRMA, uncovering the ever-changing landscape of cyber threats. LockBit leads the charge with 66 victims. Manufacturing takes a hit with 64 incidents, stressing the need for specific defences. The USA is a prime target, enduring 151 ransomware incidents, and now, a new player, Hunters International, adds a twist to the cybersecurity plot. While the...

A critical vulnerability found in Citrix ADC/Gateway poses a severe threat to digital security. This flaw facilitates unauthorized access and potential data breaches, raising concerns globally. CYFIRMA researchers have done an in-depth analysis of this vulnerability. Immediate action needed! Secure your systems with the latest patches from Citrix. Strengthen access controls and maintain constant v...

Cybercriminals are  exploiting   vulnerabilities in major platforms, including  Windows ,  JetBrains ,  MicrosoftStreamingServiceProxy , and  Ubuntu   kernels . These exploits are being actively traded on darkwebforums , posing a serious risk of  ransomwareattacks and remote system control. For example, the  MOVEit vulnerability alone exposed millions of people to cyber threats. Threatactors such...

#Russia pulled out of the #BlackSeaGrainDeal this summer and started bombing Ukraine’s #grain export terminals with the goal of damaging Ukrainian economy and political cohesion of the #EU , after Ukrainian grain is forced towards EU #markets instead of its customers in #GlobalSouth . We assess that Russia will also use #cybertools to go after #European #agriculturallogistics to keep pressure on t...

Stay Ahead of the evolving cyber threat landscape, CYFIRMA Research's latest report dives deep into the Millenium RAT, a sophisticated Win32 executable targeting windows systems. Unveiling its advanced capabilities in data exfiltration evasion, and remote control, the report emphasizes the urgency for heightened cybersecurity awareness.   The Millenium-RAT, transitioning from v2.4 to v2.5, si...

  #Cyfirma #research presents the #Quarterly #Q3 #APT Highlights Report! This report dives into the #dynamiclandscape of Advanced Persistent Threat ( #APT ) groups, suspected to be hailing from #China , #NorthKorea , #Iran , and #Russia . Witness their #innovativestrategies and #adaptability that challenge global #cybersecurity . Link to the research report: APT QUARTERLY HIGHLIGHTS - Q3 : 2023 -...

Stay ahead of ransomware threats with CYFIRMA 2023 Q3 Ransomware Report, offering essential insights into the ever-evolving cyber threat landscape. This quarter saw a stark reminder of the urgent need for robust cybersecurity measures, as the manufacturing industry topped the list with 209 reported cyberattacks.   In addition to manufacturing, industries like IT, FMCG, Healthcare and Real Estate a...

The team at CYFIRMA recently obtained the new version of Craxs RAT. We observed the latest developments in the advanced Craxs Remote Administration Tool. The tool is now equipped with the dropper module that generates a malicious Android payload which carries the main payload. This new add-on empowers threat actors to compromise Android users with greater efficiency. What's more, the introduc...

At Cyfirma, we are committed to providing up-to-date information on the prevalent threats and tactics used by malicious actors and with our latest report we delve into a python-based information stealer ‘Akitra Stealer’ and present a comprehensive overview of its functionality and capabilities. Offered as MaaS (Malware-as-a-Service) on a dedicated website with tag “Akira Undetector”, Akira is an i...

A critical vulnerability, CVE-2023-22515, has been detected in the Atlassian Confluence Data Center and Server, posing a grave threat to organizations globally. This flaw allows unauthorized access and privilege escalation, leaving digital assets vulnerable to hackers. Alarmingly, the notorious ransomware group; Trigona, is also linked to this threat. CYFIRMA Research has done an in-depth analysis...

Shedding light on the diverse cyber threat actors entangled in the escalating Middle East cyber conflict, stemming from the ongoing situation in Gaza, our latest CYFIRMA report offers a comprehensive overview. Explore the intricate emerging trends shaped by ongoing geopolitics. Link to the Research Report: ISRAEL GAZA CONFLICT : THE CYBER PERSPECTIVE - CYFIRMA #Cybercriminals #Hacktivists #APTs #P...

CYFIRMA uncovers Nuclear 27; a nation-state threat actor, hijacking the cause of various Anonymous and other environmental hacktivists of engaging in online protests using #OpFukushima, #OpJapan, or #OpTEPCO, against the release of treated water from the Fukushima Daichi Nuclear Power Plant in Japan.   The threat actor staged a suspected nation-state propaganda, claiming a 0-day RCE vulnerability...

When you look at the ongoing conflict in Gaza, what may not be visible to the naked eye is that beyond the action on the ground, the conflict has already spiked in cyberspace. This report will tell you everything you need to know and prepare for the defence of your organization and it’s Crown jewels against an uptick in cyberattacks motivated from this geopolitical phenomenon.   Link to the Resear...

The current flareup in the Middle East is taking place in a complex tapestry of relations in the region that can be described as a hotbed of geopolitics, where – despite the superficial media image – politics always takes primacy over religion. To understand the situation better and to learn why there is a cyber arms race going on in the region, read our comprehensive CYFIRMA research report. Link...

Our latest report unveils the pulse of cyber security threats in the Philippines! From the escalating risk of state sponsored espionage by global actors like China, North Korea, and Russia to the surge in ransomware attacks targeting key industries, including finance, government, healthcare, education, and retail, the nation is at a crossroads. Recent incidents, such as the widespread data breach...

September’s North Korea – Russia summit stoked fears that there could be increased weapons and technology transfers between the two nations, hostile to the West and its partners in Asia, with North Korea providing Russia with munitions for its war in Ukraine, in exchange for sensitive nuclear, missile and cyber knowhow. Both regimes have much to gain from each other at this particular geopolitical...

Stay ahead of ransomware threats with our September 2023 Ransomware Report, which provides essential insights into the evolving landscape. The latest monthly report from CYFIRMA reveals a dynamic threat landscape marked by widespread ransomware attacks that have had a significant impact on critical industries worldwide. The 'LockBit' group has taken the lead, targeting 79 victims, while...

Learn about the experience of a ransomware operator in their own words!   CYFIRMA Research recently published a report on a new threat actor group known as Fusion Core. In a follow-up, we were able to get in touch with “NecroSys”, who is the developer of SarinLocker ransomware and the current face of FusionCore. Read what NecroSys has to say about FusionCore's alleged links with APTgroups, th...

CYFIRMA Research's latest report unveils "The-Murk-Stealer," an open-source threat that covertly extracts a wide array of information designed to infiltrate systems and harvest sensitive data. From gaming files to cryptocurrency wallet details, this malware operates stealthily, underlining the importance of heightened vigilance and advanced cybersecurity strategies.   Furthermore, o...

CYFIRMA Research examines a MAJOR threat - CVE-2023-34468 in Apache NiFi! This vulnerability risks your data integration and automation tool, allowing remote code execution through manipulative H2 database connection strings. The implications are severe– unauthorized access, compromised data integrity, and the potential for remote code execution, all leading to substantial operational and reputati...

Japan's Threat Landscape ETLM Report reveals the dynamic challenges faced by this economic powerhouse. From state-sponsored giants to stealthy financial hackers, gain insights into the full spectrum of cyber threats impacting Japan's cutting-edge tech, automotive, and financial sectors. With an extensive network of overseas subsidiaries and proximity to cyber-capable neighbours, Japan st...

 CYFIRMA’s Research team is closely monitoring an evolving cyber conflict between independent hacktivist groups in Asia and the middle east. This isn't state backed, but it's impacting small businesses.   A surge in cyber-attacks from Islamic countries like Indonesia, Pakistan, Bangladesh, Afghanistan, and Malaysia, initially sparked by perceived injustices against Muslims in India, has...

CYFIRMA Research delves deep into the new variant of RedLine Stealer, investigating this novel strain of malware, disguising as a document packaged within a zip archive that houses a batch script file.   RedLine Stealer is designed to steal sensitive information from the compromised system and is available on underground forums as Malware-as-a-Service (MaaS).   The best way to protect organization...