CYFIRMA Research

Information stealers pose an ongoing and dynamic threat to the security of both individuals and organizations. CYFIRMA’s Research team recently discovered an information stealer called “Mystic Stealer” being promoted in an underground forum, with the threat actor utilizing a Telegram channel for their operations. This threat actor continuously enhances the malware, incorporating new features to en...

Cyfirma recently interviewed the DeltaBoys; a threat actor group that specialises in mass defacements. Following our recent research report; 'DeltaBoys- Black Hats on the Rise’ , our insightful and unique interview explores the DeltaBoys’ ideological and geopolitical motivations, affiliations, their financial motivations, and gives them the chance to have their voices heard across the world....

Blubrry PowerPress, a popular plugin used by podcasters to enhance their websites, has recently come under scrutiny due to a security vulnerability. Cybersecurity researchers at CYFIRMA discovered the security vulnerability, specifically affecting versions 10.2.3 and earlier. The vulnerability identified is a zero-day authenticated stored cross-site scripting (XSS) exploit, found within the “Show...

The Group of Seven (G7) singled out China on issues including Taiwan; non-market policies; malign business and cyber practices (such as illegitimate technology transfer, or data disclosure / human rights abuses), which naturally underscores the wide-ranging tensions between Beijing and the group of major industrialized democracies. Beijing has responded in a fiery way, with Chinese state media ber...

DeltaBoys have been operating since December 2021, initially starting out as database brokers and carders. However, in August 2022, their operation evolved into mass defacement and the ‘initial access’ broking market, providing webshells to sensitive websites. To fund their geopolitically motivated operations, they built a diverse catalogue of recently compromised databases, ‘zero-days’, ‘exploits...

A year and a half into the Russian war in Ukraine, the defending Ukrainians are now reconstituting their attrited forces for an imminent counter-attack, which might be the last opportunity the Ukrainian commanders will get to push the occupiers out of the country, before the external support, the country is relying on gets exhausted. The future of the country hinges on the success of the counter-o...

Recently KILLNET creator; ‘KillMilk’, announced that they were building a global team of operators from the darknet and special services members, with financially motivated destructive capabilities. Their operation went full circle from offering services to hackers and competing businessmen, to taking orders from private and state persons, along with defending the interests of the Russian Federati...

The PowerPress plugin, which allows WordPress users to publish and manage podcasts, was found to contain a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability allowed authenticated threat actors with contributor-level permissions or higher to inject malicious web scripts into pages, using the plugin’s shortcode, potentially leading to the theft of sensitive information, manipulation...

SarinLocker is written by NecroSys, who is associated with FusionCore group. The threat actor group known as FusionCore is a relatively new and determined group, originating from Europe. The group is running Malware-as-a-service, along with hacker-for-hire services. They have a wide range of skills and rely on open-source tools to increase evasiveness in their malware toolkit. The current version...

The threat actor’s named “DoNot”, also known by the name APT-C-35, is active since 2016 and has been carrying out cyber-attacks in the South Asian region.  https://www.cyfirma.com/

In this Podcast, we'll be talking about "The impact of unauthorized access to large AI language models and their impact on the external threat landscape". Hackers have shown a growing interest in AI models such as ChatGPT, as they seek to exploit the technology for their criminal activities. The potential use of ChatGPT by cybercriminals is concerning, as it could lead to an increas...

CYFIRMA observed a new European threat actor group known as FusionCore. Running Malware-as-a-service, along with the hacker-for-hire operation, they have a wide variety of tools and services that are being offered on their website, making it a one-stop-shop for threat actors looking to purchase cost-effective yet customizable malware. The operators have started a ransomware affiliate program that...

ARES, is a new threat actor group identified by CYFIRMA Research. ARES is involved in selling corporate and government authority databases. CYFIRMA Research has observed cartel-like behaviour, affiliations with other threat actors, and connections with established hacking groups like RANSOMHOUSE ransomware group, KelvinSecurity, and Adrastea hacker group. ARES Leaks is potentially becoming an alte...