CYFIRMA Research

The next gap in your AI agent’s security model may not be in its tool list. Most threat models for agentic AI ask one question: what is this agent allowed to use? Far fewer ask what the infrastructure around it does by default. Curious?

CYFIRMA’s new report, “Shadow Channels,” examines three architectural gaps that reviews focused on declared tools and permissions can miss:

1. Trace Drain: Observability pipelines capture prompts, completions, and tool arguments as part of normal operation. Could a trusted telemetry path become a quieter route for data to leave?
2. Sleeper Context: Saved memories can outlive the conversations that created them, making it harder to trace a later behavior change back to its source.
3. The Sighted Adversary: Computer-use agents can remove the human-attention cost that many UI friction controls quietly relied on.

Link to the Research Report: https://www.cyfirma.com/research/shadow-channels/

#CyberSecurity #ThreatIntelligence #ArtificialIntelligence #AgenticAI #AISecurity #ThreatModeling #SupplyChainSecurity #InformationSecurity #RiskManagement #EnterpriseSecurity #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA Research - September 2026 Ransomware Threat Intelligence Briefing

Ransomware activity in September 2026 settled at 862 publicly disclosed victims worldwide, down 26.3% from August's 1170, based on CYFIRMA's final full-month leak-site tracker count. Affiliate tradecraft around RMM abuse, edge access, BYOVD, and data extortion remained intact.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-september-2026/ 

#Ransomware #CyberSecurity #ThreatIntelligence #CYFIRMA #CyberThreats #RaaS #ThreatLandscape #CyberDefense #InfoSec #DigitalRisk #RansomWatch

https://www.cyfirma.com/

The CYFIRMA Research team has published its Australia & New Zealand Cyber Threat Landscape Report, examining cyber threat activity across Mining, Financial Services, Manufacturing, and Banking from January 2025 onward.

The research highlights a persistent identity and access-driven threat landscape, with credential-based attacks, ransomware, compromised access, and underground-market activity continuing to shape the regional risk environment. 

Link to the Research Report: https://www.cyfirma.com/research/healthcare-cyber-threat-landscape-australia-new-zealand/

#CYFIRMAResearch #CyberSecurity #ThreatIntelligence #CyberThreatLandscape #Australia #NewZealand #ANZ #ETLM #Ransomware #DarkWeb #CyberThreats #CyberRisk

https://www.cyfirma.com/

Tax-Themed Malware Campaign Abusing Indian Income Tax Department Identity

Researchers at CYFIRMA have identified and analysed a malware distribution campaign abusing the Indian Income Tax Department theme to target users in India. The campaign uses multiple fraudulent tax-themed domains, deceptive assessment notices, and a malicious VHDX disk image to deliver a staged malware payload. 

The campaign demonstrates a multi-stage malware delivery operation combining government impersonation, tax-themed social engineering, VHDX-based payload delivery, file masquerading, and process injection. CYFIRMA assesses with low confidence that the activity may be linked to a China-nexus threat actor or activity cluster targeting Indian entities; infrastructure geolocation alone is not sufficient to establish definitive attribution.

Link to the Research Report: https://www.cyfirma.com/research/fake-tax-themed-phishing-campaign-delivers-malware/

#CYFIRMA #ThreatIntelligence #CyberSecurity #MalwareAnalysis #ThreatResearch #IncomeTax #Phishing #Malware #CyberThreat

https://www.cyfirma.com/

August 2026 Ransomware Threat Intelligence Briefing

Ransomware activity rebounded in August 2026, with 1046 publicly disclosed victims worldwide, an 18.2% increase from July, highlighting the continued resilience and expansion of the ransomware-as-a-service (RaaS) ecosystem.

In this episode, we break down:

• The most active ransomware groups shaping the August threat landscape, including Qilin and Thegentlemen
• Industries and countries experiencing the highest levels of targeting
• The growing shift toward edge-device exploitation, identity-focused intrusion, and compressed attack timelines
• How data-centric extortion and trusted-platform abuse are expanding attacker reach
• Why ransomware is evolving into a highly specialized cybercriminal economy built on access brokers, extortion services, and criminal infrastructure providers

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-aug-2026/

#Ransomware #CyberSecurity #ThreatIntelligence #CYFIRMA #CyberThreats #RaaS #ThreatLandscape #CyberDefense #InfoSec #DigitalRisk #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

India BFSI Cyber Threat Landscape 2026

India’s BFSI ecosystem is entering a more complex cyber-risk environment where data exposure, ransomware, digital-payment fraud, identity compromise, AI-enabled social engineering, cloud/SaaS abuse and third-party risk are increasingly converging.

Our latest analysis of validated threat activity identified 46 data-breach incidents, 37 data-leak incidents and 33 credit-card-related incidents, alongside hacktivism, DDoS, web exploitation and ransomware activity during the reporting period.

The report examines how attackers are moving beyond traditional infrastructure compromise, leveraging employees, customers, identities, mobile channels, legitimate cloud platforms and interconnected technology providers to reach financial assets and sensitive data.

Key areas covered include:
▪️ APT & malware activity targeting BFSI
▪️ Ransomware and ecosystem exposure
▪️ Data breaches, leaks & financial information exposure
▪️ UPI, mobile banking & payment fraud
▪️ AI, deepfake & social-engineering risks
▪️ Cloud/SaaS and third-party abuse
▪️ Vulnerability and exploitation trends
▪️ CERT-In / DPDP-aligned incident response
▪️ Strategic, tactical and operational priorities for BFSI leaders

The central message: cybersecurity and fraud can no longer be managed as separate risks. Protecting India’s financial ecosystem requires an integrated approach to identity, data, payments, resilience, cloud security, third-party risk and intelligence-led detection.

From threat visibility to actionable resilience.

Link to the Research Report: https://www.cyfirma.com/research/cyber-threat-landscape-report-india-bfsi-2026/

#IndiaBFSI #CyberSecurity #ThreatIntelligence #BankingSecurity #FinancialServices #CyberThreats #Ransomware #DataBreach #DigitalPayments #AI #CyberRisk #BFSI #IndiaCyberSecurity

https://www.cyfirma.com/

Deepfakes didn't stay a disinformation problem; they've become a manufacturing supply chain risk.

Our latest cyber threat intelligence report breaks down what's actually happening on the ground:

Executive impersonation fraud is scaling fast: Arup lost $25M after attackers ran a live video call where every "executive" on screen was AI-generated. Pindrop tracked a 1,210% rise in AI-driven fraud attacks across major U.S. customers.

Blended-channel attacks are beating single-channel checks: a spoofed email + a deepfake "confirmation" call from the CEO is now enough to defeat standard verification — FBI IC3 logged a 312% YoY jump in deepfake-linked BEC losses.

The workforce itself is a threat vector: 300+ companies have unknowingly hired North Korean operatives who passed live video interviews using real-time deepfake overlays — sophisticated enough to beat conventional liveness detection.

No single fix closes the gap: even Microsoft and EU regulators agree — provenance standards, watermarking, and detection tools all have coverage gaps. The real defence is process: out-of-band verification, unscripted interview questions, and a default posture of "verify before you trust."

The clearest lesson for manufacturers: the exposure isn't a software flaw — it's the assumption that a familiar face or voice on a call is proof of identity.

Link to the Research Report: https://www.cyfirma.com/research/deepfake-risks-in-manufacturing-supply-chains/

#CyberThreatIntelligence #Deepfakes #ManufacturingSecurity #SupplyChainRisk #CyberSecurity #ThreatIntel #InfoSec #CYFIRMA #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

A stolen credential at one company just breached a completely different company.
 
No malware in that second half. No phishing email either. Just an OAuth grant nobody flagged as risky.

CYFIRMA's new report, "The Trust Cascade," walks through four real, documented intrusions from the past year and finds they aren't isolated incidents. They're the same attack surface, entered from different points.
 
* An infostealer hits one employee's laptop. A completely unrelated company's OAuth connection to that same AI tool becomes the way in.
* One AI sales-agent vendor gets compromised. Its stolen tokens grant MFA-bypassing access into 700+ downstream organizations' Salesforce environments. (Salesloft / Drift)
* Coordinated AI sub-agents run a dozen reconnaissance waves against government systems in days, not months. (Taiwan)
* A single crafted email hijacks an AI assistant's reasoning and exfiltrates data without a single credential being touched. (EchoLeak)
 
Four different entry points. One outcome: identity, SaaS integrations, and AI agents behaving as a single connected attack surface, not four separate ones.
  
As agentic AI adoption accelerates, the question isn't whether identity, SaaS platforms, and AI agents will keep converging into one exploitable surface. They already have. The question is whether security ownership is converging just as fast.

Link to the Research Report: https://www.cyfirma.com/research/the-trust-cascade/

#CyberSecurity #ThreatIntelligence #ArtificialIntelligence #AI #NonHumanIdentity #AgenticAI #ThreatResearch #RiskManagement #EnterpriseSecurity #CloudSecurity

https://www.cyfirma.com/

While conventional weapons in the Middle East may pause under a shaky ceasefire, the wires remain hot. Our latest analysis dives into the fragile U.S.–Iran conflict over the Hormuz Strait, exploring how a permanent grey-zone and cyber attrition are shaping a new era in the Middle East.

Link to the Research Report: https://www.cyfirma.com/research/permanent-attrition-and-the-shifting-grey-zone-in-the-strait-of-hormuz/

#IranWar #HormuzStrait #USForeignPolicy #CyberWarfare #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #CYFIRMA

https://www.cyfirma.com/

Technical Analysis: Lucid Stealer

Understanding how modern information stealers operate is essential for strengthening enterprise defenses.
 
Our comprehensive technical analysis of Lucid Stealer provides an in-depth breakdown of its complete execution lifecycle—from payload initialization and anti-analysis techniques to browser credential theft, cryptocurrency wallet targeting, PowerShell-based keylogging, privilege elevation, command-and-control (C2) communication, and data exfiltration.
 
The report also presents detailed reverse engineering findings, execution flow analysis, and practical detection and mitigation guidance to help security teams better understand and defend against this threat.

Link to the Research Report: https://www.cyfirma.com/research/technical-analysis-of-lucid-stealer-execution-capabilities-and-c2-infrastructure/

#MalwareAnalysis #InfoStealer #CYFIRMAResearch #ThreatIntelligence #CyberSecurity #InfoSec #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/