CYFIRMA Research

CYFIRMA researchers have uncovered a malware campaign exploiting a spoofed Telegram Premium site—telegrampremium[.]app—to distribute a new variant of Lumma Stealer . Key Findings : • Drive-by download delivers malicious start.exe without user interaction • Targets browser credentials, crypto wallets, system info • Employs obfuscation, DGA-based domains, public DNS evasion • Uses legitimate platfor...

Critical Alert: CVE-2025-8671 – HTTP/2 “MadeYouReset” DoS Vulnerability Organizations operating HTTP/2-enabled infrastructure—such as Apache Tomcat, Netty, F5 BIG-IP, Jetty, and other affected stacks—must act swiftly. This newly uncovered flaw enables attackers to bypass HTTP/2 stream-concurrency protections and trigger unbounded backend processing by exploiting mismatched stream reset handling, l...

Stay ahead with CYFIRMA’s Monthly Ransomware Report – July 2025. CYFIRMA’s July 2025 Ransomware Report recorded 504 global victims, a 7.5% rise from June, reflecting sustained threat levels. Qilin remained the most active, while Incransom and SafePay surged. Interlock introduced FileFix, a stealthy Windows UI-based delivery method; GLOBAL GROUP launched an AI-powered RaaS; and Gunra expanded to Li...

CYFIRMA’s latest report explores Infos3c Grabber Stealer, a Python-based grabber malware that steals passwords, wallets, gaming accounts & Discord/Telegram data, captures screenshots, and exfiltrates via Discord.  Use endpoint security + traffic monitoring to stay safe. Link to the Research Report: https://www.cyfirma.com/research/unveiling-a-python-stealer-inf0s3c-stealer/ #CyberSecurity #Thr...

New Threat Model: Executionless Persistence Across Endpoints & AI Layers REVENANT introduces a forward-looking multi-stage attack framework that chains stealthy, executionless techniques to persist not just on systems, but in the operational memory of AI assistants. Key Highlights: Executionless delivery via fonts, clipboard state, and localization strings, no exploits, macros, or dropped bina...

CYFIRMA has uncovered Salat Stealer (WEB_RAT) — a Go-based infostealer targeting Windows. It exfiltrates browser credentials, cryptocurrency wallets, and Telegram session data while evading detection through advanced persistence. Attributed to Russian-speaking actors, it operates under a MaaS model. Explore our in-depth analysis and mitigation strategies in the full report. Link to the Research Re...

  China's Cyber Shift: From espionage to sabotage, Targeting Global Infrastructure – check out, the newest CYFIRMA blog on Beijing's ambitions in the Fifth Domain. Link to the Research Report : https://www.cyfirma.com/blogs/typhoon-in-the-fifth-domain-chinas-evolving-cyber-strategy/ #Geopolitics #CYFIRMAresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MilitaryAffairs #S...

CYFIRMA identified TinkyWinkey, a stealthy Windows keylogger, capable of capturing keystrokes, system info, and active windows. It leverages DLL injection and persistent services to evade detection and maintain long-term presence. Link to the Research Report: https://www.cyfirma.com/research/tinkywinkey-keylogger/   #CyberSecurity   #ThreatIntelligence   #Keylogger   #MalwareAnalysis   #CYFIRMA  ...

CYFIRMA has uncovered an ongoing cyber-espionage campaign orchestrated by APT36 , a Pakistan-linked threat actor, targeting Indian Government entities . Key Highlights: Initial Access: Spear-phishing emails delivering weaponized .desktop files disguised as PDFs. Target Platforms: Windows & Linux BOSS OS. Malware Behavior: Downloads & executes ELF payloads, establishes persistence via cron/...

CYFIRMA research exposes Lazarus Stealer — a stealthy Android banking malware targeting Russian financial institutions.   Key Attack Vectors: Overlay Attack: Displays fake banking login screens to steal card details & account credentials. Silent SMS Notification Blocking: Obtains default SMS handler rights to suppress OTP alerts from the victim’s view. Real-Time OTP Harvesting: Captures verifi...

Posing as Indian banking apps, this Android malware deploys a hidden main payload that silently installs, maintains stealthy persistence, and facilitates credential theft. It harvests SMS, steals debit card details, and hijacks call forwarding all while leveraging Firebase Cloud Messaging (FCM) as its Command & Control (C2) channel. Link to the Research Report: https://www.cyfirma.com/research...

CYFIRMA research explores the Raven Stealer, a stealthy info-stealing malware written in Delphi & C++, designed to harvest passwords, cookies, payment info and autofill data from Chromium-based browsers like Chrome & Edge.  Link to the Research Report: https://www.cyfirma.com/research/raven-stealer-unmasked-telegram-based-data-exfiltration/ #CyberSecurity #InfoStealer #RavenStealer #Threat...

CYFIRMA research provides an analysis of a newly identified Remote Access Trojan, EdskManager RAT, which exhibits stealthy infection mechanisms and covert control using HVNC. Key Capabilities: ·      Multi-stage infection using signed binaries and encrypted config ·      HVNC-based hidden window interaction ·      Browser extension profiling (Chrome, Edge, Brave) ·      Dynamic C2 switching with z...

Critical Alert: CVE-2025-5777 – Pre-Auth Memory Leak in Citrix NetScaler (CitrixBleed 2)! Organizations relying on Citrix NetScaler ADC and Gateway for secure remote access must act immediately. This newly uncovered vulnerability allows unauthenticated attackers to leak sensitive memory—including session tokens—by sending malformed authentication requests. Exploited in the wild and backed by publi...

CYFIRMA exposes Octalyn Forensic Toolkit, a malicious GitHub-hosted tool masquerading as a legitimate forensic utility. In reality, it functions as a credential stealer with Telegram-based C2, targeting browser data, crypto wallets, Discord, and VPN configs.   Built with Delphi and C++, Octalyn enables even low-skilled actors to exfiltrate sensitive data using Telegram bots. It uses PowerShell scr...

Stay ahead with CYFIRMA’s Monthly Ransomware Report – June 2025. June saw 463 ransomware victims globally, a 15% decline from May. Qilin led the threat landscape, exploiting Fortinet flaws and adding legal pressure tactics. New players like Fog and Anubis adopted stealthy, modular toolkits and file-wipers for maximum damage.     Emerging groups Teamxxx, Warlock, and kawa4096 are gaining traction,...

New Threat Model: Zero-Click Compromise via File Rendering Automation  RenderShock introduces a powerful new attack framework that leverages trusted file previewing, indexing, and sync mechanisms to trigger payloads — without exploits, macros, or even opening the file.   Key Highlights:  Zero-click execution using passive system features.  Payloads delivered via LNKs, polyglots, CHMs, EXIF beacons...

CYFIRMA Research's latest report explores a fake "Free VPN for PC" app hosted on GitHub, delivering a packed DLL payload using obfuscated Base64 hidden in junk strings. It uses P/Invoke to load a hidden DLL, executes GetGameData, and injects into legit processes like MSBuild.exe. Packed, evasive, and anti-debug. Link to the Research Report: https://www.cyfirma.com/research/github-ab...

CYFIRMA uncovers a sophisticated phishing campaign by APT36 (Transparent Tribe) leveraging Linux-specific malware on BOSS Linux systems (widely used by Indian government agencies). Attackers use malicious .desktop files to deploy stealthy ELF binaries while distracting users with fake PowerPoint files.  Stay vigilant and safeguard critical infrastructure!  Link to the Research Report: https://www....

12-Day War update: Israel and Iran agree to a fragile ceasefire after America's bombing run on Tehran's nuclear facilities. Link to the Research Report: https://www.cyfirma.com/research/12-day-war-update/ #OperationRisingLion #MidnightHammer #IsraelIran #Geopolitics #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MiddleEastWar #MilitaryAffairs #CYFIRMA #Externa...

Odyssey Stealer, a rebranded version of Poseidon Stealer, targets macOS users through the Clickfix technique—tricking victims into copy-pasting malicious scripts into their terminal.   With capabilities to steal hardware details, keychains, browser cookies, crypto wallets, and plugins, the stolen data is sent to the stealer's hosted infrastructure. During our analysis, we observed it creating...

Cyber Threat Alert: APT36 Targets Indian Defense with a Sophisticated Phishing Campaign!   CYFIRMA has uncovered a targeted cyber-espionage operation by APT36 (Transparent Tribe), a Pakistan-based threat actor. This group is exploiting phishing emails embedded with malicious PDFs mimicking official NIC documents to infiltrate Indian defense systems.   What’s Happening:  · Victims receive a fake “p...

Stay ahead of evolving ransomware threats with CYFIRMA’s May 2025 Ransomware Report. May witnessed a 15.95% spike in ransomware attacks compared to April, with 545 incidents logged globally. New actors like SafePay and SilentRansomGroup rapidly gained ground, while established groups like Qilin deployed advanced loaders like NETXLOADER and SmokeLoader. Attackers leveraged tools such as Kickidler f...

CYFIRMA’s latest research report analyses a stealthy Windows-based malware known as CyberEye, which is posing a significant threat across systems by offering attackers full remote control through a Telegram Bot API. Once executed, it silently harvests browser-stored passwords, cookies, credit card details, Wi-Fi credentials, and session tokens from apps like Telegram, Discord, and Steam. It monito...

Ukraine’s daring drone strike reshapes warfare! CYFIRMA’s research team examines how cheap tech took on Russia’s nuclear air force and what it means for global militaries.   Link to the Reseach Report : https://www.cyfirma.com/blogs/ukraines-attack-on-russias-strategic-air-force-live-feed-from-a-revolution-in-military-affairs/     #Geopolitics #ThreatIntelligence #cybersecurity #ETLM #currentaffai...