CYFIRMA Research

China's DeepSeek recently shocked the AI world, challenging US dominance and raising serious security concerns. Did US export controls backfire, fuelling China's AI rise and a new era of cyber threats?  Link to the Research Report: https://www.cyfirma.com/blogs/deepfake-or-the-sputnik-moment-in-the-ai-race/ #Geopolitics   #CyfirmaResearch   #ThreatIntelligence   #cybersecurity   #ETLM  ...

Cybercriminals have developed a new sophisticated method to distribute malware via fake CAPTCHA pages, tricking users into executing malicious scripts. Our investigation reveals that the Lumma Stealer is leveraging this tactic to harvest sensitive data, including credentials, cryptocurrency assets, and credit card info. Link to the Research Report: https://www.cyfirma.com/research/fake-captcha-mal...

This report explores a fake financial management app on the Google Play Store named Finance Simplified, which has been downloaded over 100,000 times. The app reportedly downloads an additional fraudulent loan application targeting Indian users. Once installed, users attempting to secure loans are subjected to cyber blackmail and bullying.  The malicious app gains unauthorized access to sensitive u...

The cyber threat landscape is evolving, with hackers deploying multi-stage malware using obfuscation, steganography, and covert communication channels to evade detection. Attacks start with an Obfuscated JavaScript, fetching encoded commands from a URL and executing an obfuscated PowerShell script, downloading a JPG image and obfuscated text file concealing malicious MZ DOS executables. The Steale...

Stay informed about the latest developments in cybersecurity with CYFIRMA's Tracking Ransomware – January 2025 Report.    January witnessed 510 ransomware victims globally, with Akira emerging as the most active group while new threats like MORPHEUS surfaced. The Manufacturing, sector is the most targeted, and the USA remained the top victim region with 259 reported cases.    Notably, Akira’s...

Our Q4 2024 APT Quarterly Highlights Report unveils a surge of dynamic and innovative cyber activities from APT groups across Iran, North Korea, Russia, and China. These groups intensified operations with a sharp focus on credential theft through phishing, MFA push-bombing, and fake job scams. RomCom (Russia) and Lazarus (North Korea) exploited zero-day vulnerabilities in Mozilla, Windows, and Goo...

A malware disguised as a banking app is spreading through phishing and unofficial app stores. Built with Kotlin, this malware steals personal info and card details, leaking everything to criminals via Telegram bots and hidden servers. Stay safe! Only download apps from official stores, check permissions and NEVER share sensitive info on unsecured platforms.   Link to the Research Report: https://w...

Flesh Stealer, a newly identified malware first observed in August 2024 and written in C#, targets browsers like Chrome, Firefox, and Edge to harvest saved passwords, cookies, and browsing history. It also extracts data from applications such as Telegram and Signal, including stored chats and databases.  Interestingly, it avoids executing on systems configured with regional settings for CIS (Commo...

Astral Stealer: A Sophisticated Threat!  Our latest research uncovers Astral Stealer, a powerful malware designed to exfiltrate sensitive data using browser injections, credential dumping, and sophisticated evasion techniques. As a publicly available threat, it provides cybercriminals with the means to bypass security defenses and exploit vulnerable systems. The developer is potentially based in F...

New Ransomware Alert: "Windows Locker" A new .NET-based ransomware strain, Windows Locker, is making waves with its advanced tactics, also read the CYFIRMA research team's full report for a comprehensive analysis: Encryption: Files are encrypted with the .winlocker extension.  Ransom Note: Victims receive a Readme.txt file with instructions to contact the attacker. Persistence: The...

A critical SQL injection vulnerability (CVE-2024-45387) has been discovered in Apache Traffic Control's Traffic Ops component, impacting versions 8.0.0 and 8.0.1. Attackers with high-level roles (admin, federation, operations, portal, steering) can execute malicious SQL queries, risking data compromise, privilege escalation, and service disruption. Link to the Research Report: https://www.cyf...

The CYFIRMA team has analyzed malware linked to the Indian APT group DONOT, uncovering its use of a deceptive app called “Tanzeem” to gather intelligence under the guise of a chat platform. The app shuts down after permissions are granted, suggesting a targeted approach. Two analyzed versions, from October and December, showed minimal differences, indicating consistent tactics. The misuse of the O...

The swift fall of the Syrian regime caught major players off guard, including Russia and Iran, who heavily invested in propping up the state. While the USA considers withdrawal, Turkey is positioned to greatly increase its influence, while Iran and Russia suffer a significant strategic blow and might start relying more heavily on its cyber capabilities and rocket forces including a potential push...

Stay informed about the latest developments in cybersecurity with CYFIRMA's Tracking Ransomware-December 2024 Report.    The report highlights key trends, including a 12.38% decrease in ransomware attacks compared to November, alongside the rise of new groups like Funksec, which targeted VMware ESXi hypervisors and Windows servers. Critical vulnerabilities, such as CVE-2023-46604 in Apache Ac...

At CYFIRMA, we continuously analyze the tactics and techniques employed by threat actors. One such technique is Remote Template Injection, which exploits Microsoft Word's template functionality to bypass traditional defenses. Used by Advanced Persistent Threat (APT) groups, this method disguises malicious payloads in seemingly harmless documents, making it a potent tool in spear-phishing camp...

At CYFIRMA, we continuously analyze the tactics and techniques employed by threat actors. One such technique is Remote Template Injection, which exploits Microsoft Word's template functionality to bypass traditional defenses. Used by Advanced Persistent Threat (APT) groups, this method disguises malicious payloads in seemingly harmless documents, making it a potent tool in spear-phishing camp...

Introducing FireScam: A New Android Malware Threat   The CYFIRMA research team have uncovered a new, sophisticated Android malware - FireScam, an advanced information-stealing malware with spyware capabilities. Disguised as a fake ‘Telegram Premium’ app, this malware is spread through phishing websites and targets users with the intent to steal sensitive information. Once installed, it stealthily...

A critical vulnerability, CVE-2024-10914, has been discovered in unsupported D-Link devices, including DNS-320, DNS-320LW, DNS-325, and DNS-340L. With over 60,000 devices potentially exposed and nearly 1,100 actively exploited since Nov 12, 2024, attackers are leveraging this flaw to steal data, deploy ransomware, and compromise networks. If you’re using legacy D-Link devices, it's crucial to...

The CYFIRMA research team is proud to offer insights into the increased cyber risks the holiday season brings! Stay alert, verify offers, and keep your information safe! As the year end of season approaches, watch out for scammers using advanced tactics. Phishing emails might offer irresistible deals but could contain malicious links - always verify before clicking! Be cautious of fake websites an...

Cybercriminals are stepping up their game with Bizfum Stealer, a highly sophisticated malware targeting sensitive data such as browser credentials, files, and Discord tokens. It utilizes advanced encryption techniques and Telegram bots for stealthy data exfiltration.    1. It extracts browser passwords, cookies, and saved credentials.  2. Screenshots and clipboard data theft.  3. Sensitive files (...

The UK faces an escalating cyber threat landscape dominated by sophisticated Russian actors, including state-affiliated groups like Sandworm and APT29, as well as privateer entities operating with Kremlin leniency. To learn more about the Russian cyber threat to the UK, read the full report. Link to the Research Report: RUSSIA AS A THREAT ACTOR IN THE UK - CYFIRMA   #Geopolitics #CyfirmaResearch #...

Stay ahead of cybersecurity trends with CYFIRMA's November 2024 Ransomware Report. Ransomware incidents rose by 15.65%, affecting 606 victims worldwide. Emerging groups like Chort, Ymir, and SafePay deployed advanced techniques. Ransomware groups are seen exploiting critical vulnerabilities like Veeam Backup systems and targeting weekends for reduced detection.   Key sectors such as Manufactu...

Our team at CYFIRMA analyzed a malicious Android sample used in a targeted attack leveraging the Spynote Remote Administration Tool (RAT). We believe that the threat actor behind the targeted attack could be an APT. Delivered via WhatsApp with payloads disguised as apps like "Best Friend" and "Friend," the attack aimed to compromise high-value assets. All payloads were linked t...

Taking control of the White House and Congress gives Republicans a rare opportunity to change the course of the country. How will Donald Trump wield that power during a second term, and will that impact cyber? The following blog post will try to summarize what we know so far, what we can likely expect, and what will be the fallout in the cyber realm.   Link to the Research Report: https://www.cyfi...

CYFIRMA's latest research highlights the emerging threat of the Parano Malware Family, which includes Parano Stealer, Ransomware, and Screen Locker. Developed by the cybercriminal group Paranodeus, these tools target sensitive data using advanced techniques for persistence and evasion. Despite bans on their initial distribution channels, Paranodeus has shown adaptability by aligning with new...