CYFIRMA Research

In today's ever-evolving cybersecurity landscape, the role of malware detection solutions has become more critical than ever. As cybercriminals continually evolve their evasion tactics, it's essential to understand the intricate web of strategies they employ; from signature-based to behaviour-based and anti-analysis techniques. Discover why these evasion methods overlap and how they chal...

The CYFIRMA monthly Ransomware Report report thoroughly analyses ransomware activity in August 2023, covering significant attacks, the top five ransomware families, geographical distribution, targeted industries, evolution of attacks, new ransomware groups, vulnerabilities exploited by ransomware groups, and trends between July and August 2023. Organizations can leverage these insights to enhance...

CYFIRMA delves into the Prysmax  MaaS operations, currently promoting their new stealer- Prysmax Stealer. Almost all the builds of the infostealer have zero detections by signature-based solutions. The infostealer was released in June this year and has remained undetected by over 95% of antivirus vendors - no matter how many times it is scanned. It is a sophisticated tool designed to covertly stea...

When dealing with the question of the strategic relationship between China and Russia, the narrative often splits between camps of proponents of upcoming fortress EURASIA or inevitable future rift between historical rivals. In this research, CYFIRMA Researchers are looking at the relationship between the two cyber superpowers, their military and intelligence cooperation and the possible future of...

A critical unauthenticated remote code execution vulnerability, denoted as CVE- 2023-3519, has been exposed within the architecture of Citrix ADC and Citrix Gateway products. This flaw enables threat actors to execute arbitrary code on susceptible systems without the need for authentication: this signifies a grave security concern, impacting numerous Citrix instances on a global scale, with the po...

The latest report by CYFIRMA Research delves deep into the Remcos Remote Access Trojan (RAT). This analysis uncovers a complex ecosystem of tactics, IPs, and advanced payloads utilized by malicious actors. From initial infection to persistent control, we explore the dynamic landscape of cyber threats and the need for proactive defense measures.   Discover the evolving tactics of the Remcos RAT cam...

CYFIRMA Research analysis EVLF, the MaaS operator behind CypherRAT & CraxsRAT.    These malicious tools grant remote access to cameras, mics, filesystem and applications on victim devices. With features like live screen monitoring, shell access and Google play protect bypass features, CraxsRAT can be categorized as one of the most dangerous android RATs in the current threat landscape.    Over...

The latest CYFIRMA Monthly Ransomware report presents an evolving threat landscape marked by a surge in ransomware attacks, significantly impacting critical industries on a global scale. The 'Cl0p' group stands at the forefront, targeting 183 victims, while the IT and Manufacturing sectors endure the highest toll, each encountering 50 incidents. The United States faces the brunt with 186...

The Cyfirma Research team has recently discovered a disguised Stealthy MSI Loader being advertised in underground forums by Russian threat actor, showcasing its remarkable ability to evade detection by both Virus Total scan and Windows Defender. Additionally, through our investigation, we have established a link between this MSI Loader and the BatLoader campaign observed in March 2023, highlightin...

This report is Part 2 of a comprehensive analysis of ransomware activity in 2023. Part 1 covered major ransomware attacks, the top five prolific ransomware families since January 2023, and the geographical distribution of ransomware, whereas, this publication will delve into targeted industries, industrial trends analysis for H1-2022 and H1-2023, the ongoing evolution of ransomware attacks, notabl...

Since the beginning of 2023, a new hacking collective has appeared, claiming origins in Sudan; a war-torn African country with a pre-modern societal structure, limited internet connectivity, and very low per capita incomes. A Russian private military company which executes elements of foreign policy for the Kremlin has been operating in the country for years, and the self-described Islamist hackti...

This two-part report provides a comprehensive analysis of ransomware activity in 2023, where part 1 covers major ransomware attacks, the top five prolific ransomware families, since January 2023, and the geographical distribution of ransomware. ​​​​​​​In 2023, major companies and government departments such as, Yum! Brands, Royal Mail, and the US Marshals Service were amongst the victims of cyberc...

The team at CYFIRMA recently obtained advanced Android malware targeting individuals in the South Asia region. The suspicious Android malware is a dummy chatting app named SafeChat that was initially disguised as a harmless chatting app called Coverlm on WhatsApp. The user interface of this app is designed in such a convincing manner that it successfully deceives users into believing it to be auth...

CYRFIRMA Research examines a MAJOR threat - CVE-2023-3460 in Ultimate Member Plugin!   This flaw in the widely used Ultimate Member WordPress Plugin allows attackers to escalate privileges, bypassing regular security measures. By exploiting the zero-day vulnerability, attackers can manipulate user roles, leading to data breaches, content tampering, and worse. Don't let your website be the nex...

Cyfirma remains committed to tracking new threats and trends in the cybersecurity landscape. One noteworthy tool that has emerged is Attacker-Crypter. A crypter is a type of software that can encrypt, obfuscate and manipulate malicious code to make detection harder by the security tools, and is used by cybercriminals to create malware that can deceive security checks and AV detections.  Attacker-...

CYRFIRMA Research team has uncovered the recent activities of DEV-0970/Storm-0970, a financially motivated threat actor group. Armed with a ransomware builder, acquired from a Malware-as-a-Service operator, they unleash multiple ransomware variants to expand their malicious arsenal. Our report highlights the connection between Poop69 and BIG HEAD ransomware, which we attribute to DEV-0970/Storm-09...

By the end of June 2023, Wagner, a Russian mercenary organization mutinied against its state backers. The Russian government has been using the PMC for its dirty work for years. The rebellion seriously shook the political system in Russia and weakened the position of President Putin, even though the mercenaries stood down and agreed to a deal offered by the Kremlin. The full extent of the damage i...

This research by the CYFIRMA Research team investigates a critical vulnerability, tracked as CVE-2023-27997, affecting FortiOS and FortiProxy SSL-VPN, a popular operating system and VPN, used in their security products. The vulnerability, known as XORTIGATE, has the potential for remote code execution (RCE) and is being exploited in recent attacks. The XORTIGATE vulnerability arises from an insecu...

CYFIRMA researchers have uncovered a new infostealer builder called "Blank Grabber" that poses a significant threat to Windows operating systems. It was released in 2022, however since then, it has been frequently updated – with 85 contributions to the project in the last one month alone. It’s sophisticated and is evolving, with frequent updates and a growing list of features, aimed at s...

Information stealers remain an enduring and evolving security concern for individuals and organizations alike. CYFIRMA’s Research team has recently uncovered an advanced information stealer, known as “WISE REMOTE Stealer,” that functions as both a stealer and a Remote Access Trojan (RAT). This sophisticated malware has gained significant traction through promotion in underground forums. Continual...

The loss of intellectual property (IP) through cyber espionage and cyber crime constitutes the greatest transfer of wealth in history. U.S. companies alone loose around a quarter to half a trillion dollars annually through intellectual property theft, with over a hundred billion lost due to cyber crime – a number that can be tripled when the costs of downtime are taken into account. There are many...

Detecting SEO poisoning attacks can be a significant challenge due to the ever-changing nature of search engine algorithms and the sophisticated techniques used by attackers. Cybercriminals are constantly evolving their tactics, and they're even leveraging advanced technologies like AI and ChatGPT to make their SEO poisoning attacks more convincing. This report provides valuable insights into...

The CYFIRMA research team has identified a new marketplace run by unknown threat actors, known as the Zero-Day Shop. It serves as a one-stop destination for threat actors, offering a range of dangerous tools and services.  Zero Day Shop acts as a middleman between initial access brokers, offers malware and exploit software to launch devastating cyber-attacks.    The consequences of the products on...

Typosquatting, also known as URL hijacking or domain mimicry, exploits the typing errors made by internet users when entering website URLs, aiming to redirect them to malicious websites.  Attackers register domain names that closely resemble popular or legitimate websites, capitalizing on common misspellings or slight variations.  By luring unsuspecting users to typosquatted websites, threat actor...

​​​​​​​The team at CYFIRMA recently obtained suspicious Android apps hosted on the Google Play Store under the account “SecurITY Industry”. Further technical analysis revealed that the apps have malware characteristics and belong to the notorious Advanced Persistent Threat Group; “DoNot”.    A total of three Android apps were hosted with the name Device Basic Plus, nSure Chat, and iKHfaa VPN, with...