CYFIRMA Research

The CYFIRMA research team reveals a critical update in the malware landscape: We have recently identified a dropper binary that deploys an information-stealing malware known as "Angry Stealer." This malware is making its rounds on various platforms, including websites and Telegram, where it's being advertised. Angry Stealer is essentially a rebranded version of Rage Stealer.  This m...

CYFIRMA research team’s latest report explores the tactics of hacktivists - ransomware variants, stealer logs, and strategic alliances - and examines their motivations; be they geopolitical, financial, cultural, or racial. It also shows how social media is being leveraged for recruitment, coordination, and monetization via theft or extortion, what are the implications for cybersecurity, and what t...

CYFIRMA’s research team have just published a new report on the QWERTY Info Stealer malware. Our analysis reveals how this malware collects and sends sensitive data from infected systems while using advanced techniques to avoid detection. Stay informed about this threat to better protect your data and systems. Link to the Research Report: QWERTY INFORMATION STEALER - CYFIRMA #Cyfirmaresearch   #Th...

U.S. water systems deliver safe and affordable drinking water to millions of people, while also supporting agriculture, industry, and power generation. However, this critical infrastructure faces significant challenges from aging facilities, increasing demand, and emerging cyberthreats. Our report outlines the key threats to water infrastructure, the potential consequences of cyberattacks, and the...

Stay informed with CYFIRMA's Tracking Ransomware-July 2024 Report, highlighting the latest cybersecurity trends. RansomHub and LockBit3 have seen significant surges in activity, with LockBit3 experiencing a remarkable 245.5% increase. While the manufacturing sector saw a 10.9% decline, Education faced a staggering 250% rise in attacks.   The US continues to be the primary target geographicall...

The CYFIRMA research team is actively monitoring the ongoing fallout from the CrowdStrike Blue Screen of Death (BSOD) incident. Our updated report offers a comprehensive analysis of the tactics, techniques, and procedures (TTPs) used by threat actors exploiting this situation. In this updated report, we provide further insights, including a detailed incident report, an examination of fraudulent at...

CVE-2024-6387 Alert! A critical vulnerability in OpenSSH's server (sshd) allows unauthenticated remote code execution with root access, affecting over 4.8 million internet-exposed instances. This flaw poses a significant risk across various industries and geographies and is being actively exploited in the wild, as confirmed by CISA’s Known Exploited Vulnerabilities catalog. Immediate patching...

The death of Hamas leader Ismail Haniyeh in Tehran, and the announcement of the death of Hamas military wing commander Muhammad Daif on the same day is likely to escalate the ongoing cyberwar as Iran vows revenge. The dire humanitarian situation in Gaza will continue to fuel pro-Palestinian sentiment and inspire further hacktivist action, while the actors in the international arena are weighing th...

Critical Alert: Organizations relying on ServiceNow must act now!  CVE-2024-4879 poses a grave risk of remote code execution and unauthorized data access. With extensive global use, swift action is imperative. Attackers exploit Jelly template injections to trigger code execution, risking sensitive data and service disruptions. Update ServiceNow, monitor for anomalies, and implement access controls...

The CYFIRMA research team has examined a variant of the Mint Stealer malware and provides a comprehensive analysis of this information-stealing malware operating within a malware-as-a-service (MaaS) framework. Designed to target sensitive data, Mint Stealer employs sophisticated techniques to evade detection. This report explores its evasion tactics, methods for concealing malicious activities, an...

The Cyfirma research team has investigated the Flame Stealer, which is maintaining a strong presence with predominantly Portuguese speakers. This malware is designed to stealthily extract data from a wide range of sources, including discord tokens, browser cookies, credentials, etc. Flame Stealer employs advanced techniques such as covert data extraction, persistence mechanisms, detection evasion,...

 Our Q2 2024 APT Quarterly Highlights report reveals a surge of dynamic and innovative cyber activities from Iranian, Russian, Chinese, and North Korean APT groups, challenging the global cybersecurity landscape. Detailed analysis reveals escalating cyber threats from Iran's Void Manticore and APT42 targeting critical sectors, to Russia's APT28 and Sandworm focusing on cyber-espionage an...

A critical vulnerability (CVE-2024-24919) with a CVSS score of 8.6 has been discovered in EOL Check Point devices, allowing remote attackers to read arbitrary files. The Hacktivist group "Ghost Clan Malaysia" has shared affected IP addresses worldwide. Upgrade to supported versions and apply necessary hotfixes immediately to protect your data and infrastructure. CISA has added this to it...

Braodo Info Stealer, a Python-based malware, is targeting users in Vietnam and several other countries. This sophisticated threat spreads possibly through phishing emails, uses GitHub for hosting malicious code, and exfiltrates stolen data via Telegram channels. Learn more about this emerging threat impacting global cybersecurity. Link to the Research Report: Braodo Info Stealer Targeting Vietnam...

Stay informed about the latest developments in cybersecurity with CYFIRMA's Tracking Ransomware-June 2024 Report. This month's report highlights key trends, including a decrease in ransomware attacks by groups like Play and RansomHub, while Akira and Qilin increased their operations. Discover significant changes in targeted industries, with most sectors experiencing a decline in attacks....

Critical Alert: Organizations using PHP in CGI mode must act now! CVE-2024-4577 presents a severe risk of remote code execution. With millions of websites potentially affected globally, immediate action is crucial. Attackers can exploit CGI argument injection to execute arbitrary commands, leading to unauthorized access or server compromise.   Update PHP configurations, monitor for unusual activit...

The CYFIRMA team has uncovered "Kematian-Stealer," a sophisticated info stealer targeting Windows systems, hosted on GitHub. This open-source malware is designed to stealthily extract data from a wide range of sources, including browsers, cryptocurrency wallets, messaging apps, gaming platforms, VPNs, and email clients.   Kematian-Stealer employs advanced techniques such as covert data e...

This year’s Olympic games come at a heightened moment for  international conflic t &  terrorism . The potential for a  jihadi group or individuals inspired by one to take the world’s attention with a potential  attack or for  Russia to try to embarrass  France with acts of  sabotage are very high. Link to the Research Report: Paris Olympics - CYFIRMA   #Geopolitics #Cyfirmaresearch #ThreatInte...

Cyfirma research team has examined a variant of Lumma Stealer malware, and this report provides a comprehensive analysis of this advanced information-stealing malware, explores the tactics employed by threat actor to evade detection on the system and over the network, as well as their techniques for concealing malicious code and activities. Lumma Stealer targets sensitive data by employing sophist...

CYFIRMA's latest investigation reveals how terrorist groups in Kashmir are still exploiting digital platforms to spread propaganda and influence people. Their psychological operations (Psy Ops) aim to manipulate public perception, spread fear, and destabilize the region. Despite a reduction in physical presence, groups like TRF and Kashmir Tigers are ramping up their digital efforts post Arti...

Stay informed about the latest trends in the ransomware landscape with CYFIRMA's May 2024 Ransomware report. This edition highlights significant increases in ransomware activity, with LockBit3 surging tremendously and Play rising by 10.34%. Incransom's activity doubled, while RansomHub and Medusa also showed notable activity.   Manufacturing, real estate, banking, and healthcare sectors...

CYFIRMA research team has examined a variant of Vidar Stealer malware, and this in-depth examination explores the tactics employed by threat actor to evade detection on the system and over the network, as well as their techniques for concealing malicious code and activities. Additionally, it describes the use of social media platforms to procure command and control details for data exfiltration an...

Urgent Alert: Hackers are actively exploiting CVE-2024-3273, a critical vulnerability in D-Link NAS devices, with affected device IP addresses being shared on underground forums. With over 90,000 potentially impacted devices globally and inclusion in CISA's Known Exploited Vulnerabilities list, immediate action is crucial to secure data and prevent unauthorized access. Users worldwide, especi...

The notorious Nikki Stealer group has transitioned into the Iluria Stealer group, maintaining a strong presence with a predominantly Portuguese-speaking user base. Both their websites are hosted by Hostinger, and the current owner, as per his Discord bio, claims to be the former CEO of Nikki Stealer. Dynamic analysis reveals that Iluria Stealer has capabilities to steal browser passwords, autofill...

 Meet Synapse ransomware, the newest digital threat on the block. This latest threat, emerging in February 2024, operates under a Ransomware-as-a-Service model, distributing its malicious payload via the dark web. Our research sheds light on the internal working of this malware. Discover how it selectively avoids encrypting Iranian systems, raising questions about potential connections to certain...