CYFIRMA Research

By the end of June 2023, Wagner, a Russian mercenary organization mutinied against its state backers. The Russian government has been using the PMC for its dirty work for years. The rebellion seriously shook the political system in Russia and weakened the position of President Putin, even though the mercenaries stood down and agreed to a deal offered by the Kremlin. The full extent of the damage i...

This research by the CYFIRMA Research team investigates a critical vulnerability, tracked as CVE-2023-27997, affecting FortiOS and FortiProxy SSL-VPN, a popular operating system and VPN, used in their security products. The vulnerability, known as XORTIGATE, has the potential for remote code execution (RCE) and is being exploited in recent attacks. The XORTIGATE vulnerability arises from an insecu...

CYFIRMA researchers have uncovered a new infostealer builder called "Blank Grabber" that poses a significant threat to Windows operating systems. It was released in 2022, however since then, it has been frequently updated – with 85 contributions to the project in the last one month alone. It’s sophisticated and is evolving, with frequent updates and a growing list of features, aimed at s...

Information stealers remain an enduring and evolving security concern for individuals and organizations alike. CYFIRMA’s Research team has recently uncovered an advanced information stealer, known as “WISE REMOTE Stealer,” that functions as both a stealer and a Remote Access Trojan (RAT). This sophisticated malware has gained significant traction through promotion in underground forums. Continual...

The loss of intellectual property (IP) through cyber espionage and cyber crime constitutes the greatest transfer of wealth in history. U.S. companies alone loose around a quarter to half a trillion dollars annually through intellectual property theft, with over a hundred billion lost due to cyber crime – a number that can be tripled when the costs of downtime are taken into account. There are many...

Detecting SEO poisoning attacks can be a significant challenge due to the ever-changing nature of search engine algorithms and the sophisticated techniques used by attackers. Cybercriminals are constantly evolving their tactics, and they're even leveraging advanced technologies like AI and ChatGPT to make their SEO poisoning attacks more convincing. This report provides valuable insights into...

The CYFIRMA research team has identified a new marketplace run by unknown threat actors, known as the Zero-Day Shop. It serves as a one-stop destination for threat actors, offering a range of dangerous tools and services.  Zero Day Shop acts as a middleman between initial access brokers, offers malware and exploit software to launch devastating cyber-attacks.    The consequences of the products on...

Typosquatting, also known as URL hijacking or domain mimicry, exploits the typing errors made by internet users when entering website URLs, aiming to redirect them to malicious websites.  Attackers register domain names that closely resemble popular or legitimate websites, capitalizing on common misspellings or slight variations.  By luring unsuspecting users to typosquatted websites, threat actor...

​​​​​​​The team at CYFIRMA recently obtained suspicious Android apps hosted on the Google Play Store under the account “SecurITY Industry”. Further technical analysis revealed that the apps have malware characteristics and belong to the notorious Advanced Persistent Threat Group; “DoNot”.    A total of three Android apps were hosted with the name Device Basic Plus, nSure Chat, and iKHfaa VPN, with...

Information stealers pose an ongoing and dynamic threat to the security of both individuals and organizations. CYFIRMA’s Research team recently discovered an information stealer called “Mystic Stealer” being promoted in an underground forum, with the threat actor utilizing a Telegram channel for their operations. This threat actor continuously enhances the malware, incorporating new features to en...

Cyfirma recently interviewed the DeltaBoys; a threat actor group that specialises in mass defacements. Following our recent research report; 'DeltaBoys- Black Hats on the Rise’ , our insightful and unique interview explores the DeltaBoys’ ideological and geopolitical motivations, affiliations, their financial motivations, and gives them the chance to have their voices heard across the world....

Blubrry PowerPress, a popular plugin used by podcasters to enhance their websites, has recently come under scrutiny due to a security vulnerability. Cybersecurity researchers at CYFIRMA discovered the security vulnerability, specifically affecting versions 10.2.3 and earlier. The vulnerability identified is a zero-day authenticated stored cross-site scripting (XSS) exploit, found within the “Show...

The Group of Seven (G7) singled out China on issues including Taiwan; non-market policies; malign business and cyber practices (such as illegitimate technology transfer, or data disclosure / human rights abuses), which naturally underscores the wide-ranging tensions between Beijing and the group of major industrialized democracies. Beijing has responded in a fiery way, with Chinese state media ber...

DeltaBoys have been operating since December 2021, initially starting out as database brokers and carders. However, in August 2022, their operation evolved into mass defacement and the ‘initial access’ broking market, providing webshells to sensitive websites. To fund their geopolitically motivated operations, they built a diverse catalogue of recently compromised databases, ‘zero-days’, ‘exploits...

A year and a half into the Russian war in Ukraine, the defending Ukrainians are now reconstituting their attrited forces for an imminent counter-attack, which might be the last opportunity the Ukrainian commanders will get to push the occupiers out of the country, before the external support, the country is relying on gets exhausted. The future of the country hinges on the success of the counter-o...

Recently KILLNET creator; ‘KillMilk’, announced that they were building a global team of operators from the darknet and special services members, with financially motivated destructive capabilities. Their operation went full circle from offering services to hackers and competing businessmen, to taking orders from private and state persons, along with defending the interests of the Russian Federati...

The PowerPress plugin, which allows WordPress users to publish and manage podcasts, was found to contain a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability allowed authenticated threat actors with contributor-level permissions or higher to inject malicious web scripts into pages, using the plugin’s shortcode, potentially leading to the theft of sensitive information, manipulation...

SarinLocker is written by NecroSys, who is associated with FusionCore group. The threat actor group known as FusionCore is a relatively new and determined group, originating from Europe. The group is running Malware-as-a-service, along with hacker-for-hire services. They have a wide range of skills and rely on open-source tools to increase evasiveness in their malware toolkit. The current version...

The threat actor’s named “DoNot”, also known by the name APT-C-35, is active since 2016 and has been carrying out cyber-attacks in the South Asian region.  https://www.cyfirma.com/

In this Podcast, we'll be talking about "The impact of unauthorized access to large AI language models and their impact on the external threat landscape". Hackers have shown a growing interest in AI models such as ChatGPT, as they seek to exploit the technology for their criminal activities. The potential use of ChatGPT by cybercriminals is concerning, as it could lead to an increas...

CYFIRMA observed a new European threat actor group known as FusionCore. Running Malware-as-a-service, along with the hacker-for-hire operation, they have a wide variety of tools and services that are being offered on their website, making it a one-stop-shop for threat actors looking to purchase cost-effective yet customizable malware. The operators have started a ransomware affiliate program that...

ARES, is a new threat actor group identified by CYFIRMA Research. ARES is involved in selling corporate and government authority databases. CYFIRMA Research has observed cartel-like behaviour, affiliations with other threat actors, and connections with established hacking groups like RANSOMHOUSE ransomware group, KelvinSecurity, and Adrastea hacker group. ARES Leaks is potentially becoming an alte...