CYFIRMA has uncovered an ongoing cyber-espionage campaign orchestrated by APT36, a Pakistan-linked threat actor, targeting Indian Government entities.

Key Highlights:

• Initial Access: Spear-phishing emails delivering weaponized .desktop files disguised as PDFs.
• Target Platforms: Windows & Linux BOSS OS.
• Malware Behavior: Downloads & executes ELF payloads, establishes persistence via cron/systemd, and communicates with C2 servers (modgovindia[.]space, securestore[.]cv).
• Impact: Data exfiltration, sustained access, and evasion of security controls.
• Malware Identifiers: Meeting_Ltr_ID1543ops.pdf.desktop, Meeting_Ltr_ID1543ops.pdf-.elf (MD5: 10b7139952e3daae8f9d7ee407696ccf, 5bfeeae3cc9386513dc7c301c61e67a7).

This campaign reflects APT36’s increasing sophistication, tailoring malware to exploit indigenous technologies like Linux BOSS OS, and ensuring persistent, covert access to critical government infrastructure.

Organizations must stay vigilant, strengthen phishing defenses, and continuously monitor for malicious infrastructure and anomalous activity.

Link to the Research Report: https://www.cyfirma.com/research/apt36-targets-indian-boss-linux-systems-with-weaponized-autostart-files/

#CyberSecurity #ThreatIntel #APT36 #CyberEspionage #Linux #Windows #Phishing #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA research exposes Lazarus Stealer — a stealthy Android banking malware targeting Russian financial institutions.

 Key Attack Vectors:

• Overlay Attack: Displays fake banking login screens to steal card details & account credentials.
• Silent SMS Notification Blocking: Obtains default SMS handler rights to suppress OTP alerts from the victim’s view.
• Real-Time OTP Harvesting: Captures verification codes instantly to bypass multi-factor authentication.
• Covert C2 Communication: Sends stolen data to attacker-controlled servers.

Link to the Research Report: https://www.cyfirma.com/research/lazarus-stealer-android-malware-for-russian-bank-credential-theft-through-overlay-and-sms-manipulation/

#AndroidMalware #BankingTrojan #OverlayAttack #SMSInterception #OTPTheft #CyberThreatIntel #MobileSecurity #CYFIRMAResearch #CYFIRMA #ETLM #ExternalThreatLandscapeManagement 

https://www.cyfirma.com/

Posing as Indian banking apps, this Android malware deploys a hidden main payload that silently installs, maintains stealthy persistence, and facilitates credential theft. It harvests SMS, steals debit card details, and hijacks call forwarding all while leveraging Firebase Cloud Messaging (FCM) as its Command & Control (C2) channel.

Link to the Research Report: https://www.cyfirma.com/research/android-malware-posing-as-indian-bank-apps/

#AndroidThreat #FCMCommandControl #MalwareAnalysis #MobileSecurity #CyberThreat #BankingMalware #ThreatHunting #AndroidMalware #CyberSecurity #CYFIRMA #ExternalThreatLandscapeManagement #ETLM #BankingTrojan #Infosec #ThreatIntel

https://www.cyfirma.com/

CYFIRMA research explores the Raven Stealer, a stealthy info-stealing malware written in Delphi & C++, designed to harvest passwords, cookies, payment info and autofill data from Chromium-based browsers like Chrome & Edge. 

Link to the Research Report: https://www.cyfirma.com/research/raven-stealer-unmasked-telegram-based-data-exfiltration/

#CyberSecurity #InfoStealer #RavenStealer #ThreatIntel #Malware #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA research provides an analysis of a newly identified Remote Access Trojan, EdskManager RAT, which exhibits stealthy infection mechanisms and covert control using HVNC.

Key Capabilities:
·      Multi-stage infection using signed binaries and encrypted config
·      HVNC-based hidden window interaction
·      Browser extension profiling (Chrome, Edge, Brave)
·      Dynamic C2 switching with zlib-compressed communication
·      Persistence via Scheduled Tasks, Run Registry keys, and Startup shortcuts

This malware represents a growing threat with advanced evasion and surveillance features. Read our full report to stay informed!

Link to the Research Report: https://www.cyfirma.com/research/edskmanager-rat-multi-stage-malware-with-hvnc-and-evasion-capabilities/

#CyberDefense #CYFIRMA #CYFIRMAresearch #ETLM 

#ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Critical Alert: CVE-2025-5777 – Pre-Auth Memory Leak in Citrix NetScaler (CitrixBleed 2)!

Organizations relying on Citrix NetScaler ADC and Gateway for secure remote access must act immediately. This newly uncovered vulnerability allows unauthenticated attackers to leak sensitive memory—including session tokens—by sending malformed authentication requests.

Exploited in the wild and backed by public PoC code, this flaw enables session hijacking, MFA bypass, and potential lateral movement inside enterprise networks. Given its low complexity and global attack surface, CVE-2025-5777 is a high-priority threat for critical sectors like government, finance, and telecom.
Apply patches, terminate active sessions, restrict exposure, and monitor for abnormal authentication flows!

Link to the Research Report: https://www.cyfirma.com/research/cve-2025-5777-pre-auth-memory-leak-in-citrix-netscaler-citrixbleed-2/

#CyberSecurity #CitrixBleed2 #CVE20255777 #NetScaler #ThreatIntel 

#ExternalThreatLandscapeManagement #ZeroTrust #VulnerabilityAlert 

#SessionHijack #MFABypass #ETLM #CYFIRMA #CYFIRMAresearch

https://www.cyfirma.com/

CYFIRMA exposes Octalyn Forensic Toolkit, a malicious GitHub-hosted tool masquerading as a legitimate forensic utility. In reality, it functions as a credential stealer with Telegram-based C2, targeting browser data, crypto wallets, Discord, and VPN configs.
 
Built with Delphi and C++, Octalyn enables even low-skilled actors to exfiltrate sensitive data using Telegram bots. It uses PowerShell scripts for stealthy second-stage payloads, making it modular and easily customizable.

Stay ahead of emerging threats with CYFIRMA.

Link to the Research Report: https://www.cyfirma.com/research/octalyn-stealer-unmasked/
 
#CyberSecurity #ThreatIntel #Octalyn #MalwareAnalysis #TelegramC2 #CredentialStealer #CYFIRMA #ETLM #OSINT #RedTeam #MalwareDetection #Infosec #ExternalThreatLandscapeManagement #CYFIRMA #CYFIRMAresearch

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s Monthly Ransomware Report – June 2025. June saw 463 ransomware victims globally, a 15% decline from May. Qilin led the threat landscape, exploiting Fortinet flaws and adding legal pressure tactics. New players like Fog and Anubis adopted stealthy, modular toolkits and file-wipers for maximum damage. 
 
 Emerging groups Teamxxx, Warlock, and kawa4096 are gaining traction, each demonstrating unique behaviors from Chaos-based payloads to single-system attacks without data exfiltration. The U.S., Canada, and the UK were top targets, with professional services, IT, and healthcare sectors most affected. Dragonforce surged, while Play and Safepay activity dropped. Attackers now blend open-source tools, cloud abuse, and RMM exploits to evade detection.
 
Get CYFIRMA’s insights to stay one step ahead.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-june-2025/
 
 #CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #Teamxxx #Warlock #kawa #Play #Dragonforce #safepay #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

New Threat Model: Zero-Click Compromise via File Rendering Automation 
RenderShock introduces a powerful new attack framework that leverages trusted file previewing, indexing, and sync mechanisms to trigger payloads — without exploits, macros, or even opening the file.
 
Key Highlights:

•  Zero-click execution using passive system features.
•  Payloads delivered via LNKs, polyglots, CHMs, EXIF beacons, and remote Office templates.
•  Targets Windows/macOS preview handlers, indexing engines, and cloud sync daemons.
• Demonstrates execution chains without user interaction or CVE exploitation.
• Includes MITRE mapping, detection guidance, and red team-ready payload chains.

Link to the Research Report: https://www.cyfirma.com/research/rendershock-weaponizing-trust-in-file-rendering-pipelines/

#RenderShock #CyberSecurity #ZeroClick #AdversarySimulation #ThreatResearch #RedTeam #EDREvasion #FileAbuse #PassiveExecution #TrustAbuse #CyberDefense #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA Research's latest report explores a fake "Free VPN for PC" app hosted on GitHub, delivering a packed DLL payload using obfuscated Base64 hidden in junk strings. It uses P/Invoke to load a hidden DLL, executes GetGameData, and injects into legit processes like MSBuild.exe. Packed, evasive, and anti-debug.

Link to the Research Report: https://www.cyfirma.com/research/github-abused-to-spread-malware-disguised-as-free-vpn/

#MalwareAnalysis #CyberSecurity #DLLInjection #FakeVPN      #ReverseEngineering #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/