CYFIRMA Research

Cyberattacks Hit Morocco: A Wake-Up Call for Cybersecurity!   Morocco has been hit with a series of cyberattacks from groups like Anonymous Algeria and EvilBbyte, with motives rooted in the long-standing dispute over the Western Sahara region. These hackers are targeting everything from government websites to critical infrastructure, and it’s all tied to growing geopolitical tensions between Moroc...

Helldown ransomware is spreading fast, targeting key industries like Real Estate, IT, Manufacturing, and Healthcare. The ransomware targets both Windows and Linux systems, exploits known vulnerabilities, and encrypts files. First spotted in August 2024 by CYFIRMA, Helldown has already impacted businesses in 11 countries, with the USA and Germany being hit the hardest. It uses advanced techniques t...

Hexon Stealer is a variant of Stealit Stealer, which itself is derived from Fewer Stealer. Rebranding and code reuse are common practices among malware developers. Stealer devs often create Telegram or Signal channels to market their stealers, attracting a significant user base by promoting them across various platforms. The CYFIRMA research team’s investigation, identified patterns linking Steali...

The CYFIRMA Research team provides insights into a severe flaw in Grafana (versions <11.0.5, 11.1.6, 11.2.1), which allows low-privilege users to execute arbitrary commands, risking sensitive data exposure and system compromise. Threat actors are also actively discussing and sharing exploits in underground forums. Link to the Research Report: CVE-2024-9264: A Critical Vulnerability in Grafana :...

Our latest research has uncovered “Elpaco-team” ransomware, a new variant of the well-known Mimic ransomware. Elpaco employs similar tactics, primarily targeting Windows-based systems and leveraging legitimate tools. Once inside, Elpaco encrypts critical files with encryption algorithms, rendering them inaccessible to the user.  The ransomware also ensures persistence on compromised systems throug...

Stay vigilant against Black Basta’s sophisticated ransomware tactics! In our latest analysis, Black Basta continues to be a leading threat in the cyber landscape, targeting industries, such as healthcare, finance, and manufacturing. Known for exploiting vulnerabilities and using double extortion, this ransomware group applies social engineering to infiltrate systems, often posing as IT support via...

Stay ahead of cybersecurity trends with CYFIRMA's October 2024 Ransomware Report! This month saw a 42.78% increase in ransomware, led by groups like RansomHub, and new threats emerging, such as Hellcat and Playboy. Manufacturing and Healthcare were heavily impacted, while DragonForce expanded its Ransomware-as-a-Service model. Tactics like “Bring Your Own Vulnerable Driver” (BYOVD) and CVE-20...

CYFIRMA’s research team has uncovered a new strain of malware known as "Wish Stealer," a sophisticated Node.js-based program targeting Windows users. This malware is designed to steal sensitive information from popular platforms like Discord, various web browsers, and cryptocurrency wallets. It employs advanced techniques, including privilege escalation, clipboard manipulation, and sessi...

A recently discovered variant of the SpyNote Remote Access Trojan (RAT) is posing as "Avast Mobile Security for Android." Upon installation, it gains extensive control over your device, silently granting itself permissions and displaying fake system update notifications. This sneaky malware operates in the background, restarts if stopped, and prevents uninstallation. SpyNote targets cryp...

Quishing, a dangerous combination of QR codes and phishing, is emerging as a significant threat that can lead to unauthorized access to sensitive information. Cybercriminals exploit the increasing prevalence of QR codes to trick users into scanning malicious links, resulting in credential theft and data breaches. Given the rapid rise in QR code phishing incidents from 2023 to 2024, organizations m...

CYFIRMA's latest research highlights the G700 RAT, a potent malware targeting Android devices, especially in the cryptocurrency and finance sectors. With advanced techniques like privilege escalation, SMS hijacking, and phishing injection, G700 RAT can bypass security and compromise sensitive data. Strengthen your defenses to stay protected! Link to the Research Report: G700 : The Next Genera...

Critical Alert: Organizations using TeamViewer's Remote Client and Remote Host products on Windows must act now! CVE-2024-7479 and CVE-2024-7481 present a severe risk of privilege escalation. With millions of users potentially affected globally, immediate action is crucial. Both flaws involve improper cryptographic signature verification during driver installation. Specifically, CVE-2024-7479...

Our Q3 2024 APT Quarterly Highlights Report reveals intensified cyber activities from APT groups in Iran, Russia, China, and North Korea, indicating heightened espionage efforts. Iran’s MuddyWater and APT34 leveraged custom malware like BugSleep, while Russia’s APT29 and APT28 capitalized on zero-day vulnerabilities for sophisticated infiltration. China’s APT41 and Earth Baku shifted focus towards...

Ivanti Virtual Traffic Manager (vTM) users – A critical authentication bypass flaw (CVSS 9.8) is now being actively exploited! This vulnerability allows unauthenticated attackers to gain admin control over your systems. Patch now to prevent unauthorized access, data theft, or malware deployment. Public exploit code is already circulating. Stay secure! Link to the Research Report:  CVE-2024-7593 Vu...

CYFIRMA's investigation uncovered a major data breach at Cisco, led by the notorious threat actor IntelBroker. On October 14, 2024, IntelBroker posted on BreachForum, revealing that critical data such as source code, hard-coded credentials, SSL certificates, API tokens, and confidential documents were stolen. This breach impacts Cisco's B2B clients, with over 26 client source codes compr...

The proliferation of stealers, particularly those masquerading as open-source projects, poses significant risks to users. With capabilities to steal sensitive information, such as passwords, cryptocurrency wallets, and browser data, these malware variants not only threaten individual privacy but also create broader cybersecurity challenges. As developers continue to leverage and modify existing st...

The Israeli invasion of Lebanon began with the declared goal to remove Hezbollah's military infrastructure from the south of the country so that Israelis living in northern Israel could return to their homes, from which they have been driven by the low-intensity conflict raging on the border since Hamas' raid on Gaza last year. The Israeli army has hit thousands of Hezbollah targets in L...

Stay ahead of cybersecurity trends with CYFIRMA's September 2024 Ransomware Report. This month’s analysis highlights significant shifts among top ransomware groups like Medusa, which saw a 525% surge in victims, while others like RansomHub and Meow experienced declines.   Key industries such as IT and transportation saw notable increases, while sectors like manufacturing and finance recorded...

Immediate action is required for all organizations using iTunes for Windows! CVE-2024-44193 is a critical local privilege escalation vulnerability that could lead to unauthorized system access. Attackers exploit misconfigured permissions in the AppleMobileDeviceService.exe to elevate privileges and gain control. Given the widespread use of iTunes, this poses a significant risk. Update iTunes to ve...

Our latest research dives deep into Yunit Stealer, a sophisticated malware designed to steal sensitive data, such as credentials, cookies, and cryptocurrency wallets. This malware employs advanced evasion techniques, including obfuscation and persistence methods, making it a formidable threat to cybersecurity. Yunit Stealer can disable Windows Defender, modify registry keys, and use scheduled task...

A new malware threat, Vilsa Stealer, has surfaced. Discovered on GitHub, this malware is designed to quietly steal your most sensitive information, everything from browser passwords to cryptocurrency wallets and even Discord credentials. What makes it particularly scary is its ability to sneak past security measures and hide in your system, all the while sending your stolen data to a remote server...

CYFIRMA's latest report delves into a crucial investigation targeting the malicious infrastructure linked to the APT group "Transparent Tribe." Employing open-source intelligence (OSINT), we thoroughly tracked the command-and-control (C2) servers utilized by this persistent threat actor. By leveraging advanced techniques such as JARM fingerprinting, we identified a network of 15 ser...

As the U.S. presidential election in November approaches and the campaigns of former President Trump and Vice President Harris ramp up, hackers from Washington's adversaries are intensifying their efforts to disrupt or influence voting. Among these adversaries, Iran is emerging as an increasingly significant player. Link to the Research Report: IRAN STEPS UP EFFORTS IN U.S. ELECTION MEDDLING...

Critical Alert: Organizations using Apache OFBiz must act now!    CVE-2024-38856 presents a severe risk of remote code execution. With millions of users potentially affected globally, immediate action is crucial. This flaw allows unauthenticated users to bypass security restrictions and execute screen rendering code via specially crafted requests through unauthenticated endpoints if some pre-condi...

The CYFIRMA research team has examined a variant of the Gomorrah stealer malware, a .NET-based malware that targets a range of sensitive data on infected systems. This report provides a comprehensive analysis of its operational methods and evasion techniques to remain undetected. This information-stealing malware operates within a malware-as-a-service (MaaS) framework and highlights the evolving s...