CYFIRMA Research

Quishing, a dangerous combination of QR codes and phishing, is emerging as a significant threat that can lead to unauthorized access to sensitive information. Cybercriminals exploit the increasing prevalence of QR codes to trick users into scanning malicious links, resulting in credential theft and data breaches. Given the rapid rise in QR code phishing incidents from 2023 to 2024, organizations m...

CYFIRMA's latest research highlights the G700 RAT, a potent malware targeting Android devices, especially in the cryptocurrency and finance sectors. With advanced techniques like privilege escalation, SMS hijacking, and phishing injection, G700 RAT can bypass security and compromise sensitive data. Strengthen your defenses to stay protected! Link to the Research Report: G700 : The Next Genera...

Critical Alert: Organizations using TeamViewer's Remote Client and Remote Host products on Windows must act now! CVE-2024-7479 and CVE-2024-7481 present a severe risk of privilege escalation. With millions of users potentially affected globally, immediate action is crucial. Both flaws involve improper cryptographic signature verification during driver installation. Specifically, CVE-2024-7479...

Our Q3 2024 APT Quarterly Highlights Report reveals intensified cyber activities from APT groups in Iran, Russia, China, and North Korea, indicating heightened espionage efforts. Iran’s MuddyWater and APT34 leveraged custom malware like BugSleep, while Russia’s APT29 and APT28 capitalized on zero-day vulnerabilities for sophisticated infiltration. China’s APT41 and Earth Baku shifted focus towards...

Ivanti Virtual Traffic Manager (vTM) users – A critical authentication bypass flaw (CVSS 9.8) is now being actively exploited! This vulnerability allows unauthenticated attackers to gain admin control over your systems. Patch now to prevent unauthorized access, data theft, or malware deployment. Public exploit code is already circulating. Stay secure! Link to the Research Report:  CVE-2024-7593 Vu...

CYFIRMA's investigation uncovered a major data breach at Cisco, led by the notorious threat actor IntelBroker. On October 14, 2024, IntelBroker posted on BreachForum, revealing that critical data such as source code, hard-coded credentials, SSL certificates, API tokens, and confidential documents were stolen. This breach impacts Cisco's B2B clients, with over 26 client source codes compr...

The proliferation of stealers, particularly those masquerading as open-source projects, poses significant risks to users. With capabilities to steal sensitive information, such as passwords, cryptocurrency wallets, and browser data, these malware variants not only threaten individual privacy but also create broader cybersecurity challenges. As developers continue to leverage and modify existing st...

The Israeli invasion of Lebanon began with the declared goal to remove Hezbollah's military infrastructure from the south of the country so that Israelis living in northern Israel could return to their homes, from which they have been driven by the low-intensity conflict raging on the border since Hamas' raid on Gaza last year. The Israeli army has hit thousands of Hezbollah targets in L...

Stay ahead of cybersecurity trends with CYFIRMA's September 2024 Ransomware Report. This month’s analysis highlights significant shifts among top ransomware groups like Medusa, which saw a 525% surge in victims, while others like RansomHub and Meow experienced declines.   Key industries such as IT and transportation saw notable increases, while sectors like manufacturing and finance recorded...

Immediate action is required for all organizations using iTunes for Windows! CVE-2024-44193 is a critical local privilege escalation vulnerability that could lead to unauthorized system access. Attackers exploit misconfigured permissions in the AppleMobileDeviceService.exe to elevate privileges and gain control. Given the widespread use of iTunes, this poses a significant risk. Update iTunes to ve...

Our latest research dives deep into Yunit Stealer, a sophisticated malware designed to steal sensitive data, such as credentials, cookies, and cryptocurrency wallets. This malware employs advanced evasion techniques, including obfuscation and persistence methods, making it a formidable threat to cybersecurity. Yunit Stealer can disable Windows Defender, modify registry keys, and use scheduled task...

A new malware threat, Vilsa Stealer, has surfaced. Discovered on GitHub, this malware is designed to quietly steal your most sensitive information, everything from browser passwords to cryptocurrency wallets and even Discord credentials. What makes it particularly scary is its ability to sneak past security measures and hide in your system, all the while sending your stolen data to a remote server...

CYFIRMA's latest report delves into a crucial investigation targeting the malicious infrastructure linked to the APT group "Transparent Tribe." Employing open-source intelligence (OSINT), we thoroughly tracked the command-and-control (C2) servers utilized by this persistent threat actor. By leveraging advanced techniques such as JARM fingerprinting, we identified a network of 15 ser...

As the U.S. presidential election in November approaches and the campaigns of former President Trump and Vice President Harris ramp up, hackers from Washington's adversaries are intensifying their efforts to disrupt or influence voting. Among these adversaries, Iran is emerging as an increasingly significant player. Link to the Research Report: IRAN STEPS UP EFFORTS IN U.S. ELECTION MEDDLING...

Critical Alert: Organizations using Apache OFBiz must act now!    CVE-2024-38856 presents a severe risk of remote code execution. With millions of users potentially affected globally, immediate action is crucial. This flaw allows unauthenticated users to bypass security restrictions and execute screen rendering code via specially crafted requests through unauthenticated endpoints if some pre-condi...

The CYFIRMA research team has examined a variant of the Gomorrah stealer malware, a .NET-based malware that targets a range of sensitive data on infected systems. This report provides a comprehensive analysis of its operational methods and evasion techniques to remain undetected. This information-stealing malware operates within a malware-as-a-service (MaaS) framework and highlights the evolving s...

CVE-2024-40725 and CVE-2024-40898 are critical vulnerabilities in Apache’s HTTP Server. CVE-2024-40725 affects the mod_proxy module and enables HTTP Request Smuggling attacks, while CVE-2024-40898 allows authentication bypass due to improper SSL configuration. With widespread exposure, these vulnerabilities pose severe risks globally. Immediate patching is crucial to safeguard sensitive systems fr...

The CYFIRMA research team presents an analysis of a new malware, the BLX Stealer, also known as XLABB Stealer, which is targeting sensitive data like credentials, browser information, cryptocurrency wallets, and Discord tokens. Actively promoted on Telegram and Discord, this malware can persist through system reboots and even uses Discord Webhook for data exfiltration.   Stay protected by updating...

Stay informed with CYFIRMA's Tracking Ransomware-August 2024 Report, highlighting critical shifts in ransomware activities. Emerging groups like RansomHub and Lynx surged, with RansomHub seeing a 57.78% rise in victims and Lynx skyrocketing by 900%. In contrast, established actors like LockBit3 faced a 23.68% decline. The Manufacturing, Finance, and FMCG sectors were hit the hardest, while th...

The CYFIRMA research team explores a new malware, dubbed "Ailurophile Stealer" that targets sensitive browser data, such as passwords, cookies, and browsing history. Distributed via GitHub, this threat uses advanced tactics like UPX packing and command-and-control communication via Telegram to evade detection. The attackers, likely operating from Vietnam, are using multiple platforms to...

The rise of Deepfake technology brings both opportunities and challenges. Our new report, Deepfake Defense: Strategic Solutions, explores the complex risks Deepfakes pose to privacy, security, and public trust and offers actionable strategies to defend against them. Discover how we can safeguard society in this new digital age. Read the full report now! Link to the Research Report: DEEPFAKE DEFENS...

The CYFIRMA research team presents an analysis of a new keylogger that uses PowerShell scripts to silently capture sensitive information, such as passwords and credit card details. This sophisticated malware employs techniques, including system discovery, command execution, and encrypted C2 communication. The attackers also use anonymized networks like Tor, making it difficult to trace their activ...

Since Israel launched its invasion of Gaza following the October 7 Hamas attack on Israel, Israel, and Hezbollah have also traded blows on the southern border of Lebanon in a low-intensity conflict. Many Israeli officials see full-scale war as inevitable. The situation could quickly change and escalate into a war, inadvertently based on miscalculation in mutual attacks. It would not be the first t...

The CYFIRMA research team provides an analysis of the Mekotio Trojan. Our study uncovers how it conceals its operations, interacts with command-and-control servers, and maintains persistence on infected systems. Check out our full report to gain a better understanding and combat this evolving threat.   Link to the Research Report: Analyzing the Mekotio Trojan - CYFIRMA #CyberSecurity #ThreatIntel...

The CYFIRMA research team presents their latest report! Organizations using Microsoft Windows Wi-Fi Drivers must act now! CVE-2024-30078 presents a severe risk of remote code execution. With billions of Microsoft Windows Wi-Fi Drivers potentially affected globally, immediate action is crucial.   Learn more with insights into this vulnerability. Safeguard your systems to prevent exploitation. Link...