CYFIRMA Research

China's South China Sea ambitions stalled: ASEAN Fights Back Amid U.S. Distractions – check out the latest CYFIRMA report on Beijing's ambitions hitting a wall in the South China Sea, and the fallout in cyberspace. 

Link to the Research Report: https://www.cyfirma.com/research/grey-zone-warfare-in-chinas-stalled-south-china-sea-ambitions/

#Geopolitics #CYFIRMAresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MilitaryAffairs #GreyZoneCoertion #UNCLOS #MischiefReef #Spratlys #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA researchers have uncovered a malware campaign exploiting a spoofed Telegram Premium site—telegrampremium[.]app—to distribute a new variant of Lumma Stealer.

Key Findings:

• Drive-by download delivers malicious start.exe without user interaction

• Targets browser credentials, crypto wallets, system info

• Employs obfuscation, DGA-based domains, public DNS evasion

• Uses legitimate platforms (e.g., t.me, Steam) for stealthy C2

• Windows-focused, written in C/C++, and uses advanced evasion techniques

Stay vigilant. Threat actors are innovating—brand impersonation and drive-by downloads are on the rise.

Link to the Research Report: https://www.cyfirma.com/research/fake-telegram-premium-site-distributes-new-lumma-stealer-variant/

#CyberSecurity #ThreatIntelligence #Malware #LummaStealer #Telegram #CYFIRMA #InfoStealer #CyberThreat #APT

https://www.cyfirma.com/

Critical Alert: CVE-2025-8671 – HTTP/2 “MadeYouReset” DoS Vulnerability

Organizations operating HTTP/2-enabled infrastructure—such as Apache Tomcat, Netty, F5 BIG-IP, Jetty, and other affected stacks—must act swiftly. This newly uncovered flaw enables attackers to bypass HTTP/2 stream-concurrency protections and trigger unbounded backend processing by exploiting mismatched stream reset handling, leading to severe Denial-of-Service (DoS) conditions.

This vulnerability demands urgent attention—its low-complexity technique and global exposure pose a high-priority threat to web infrastructure availability.

Link to the Research Report: https://www.cyfirma.com/research/cve-2025-8671-http-2-madeyoureset-vulnerability-ddos-attack/

#CyberSecurity #MadeYouReset #CVE20258671 #HTTP2 #DoS #ThreatIntel #ExternalThreatLandscapeManagement #VulnerabilityAlert #StreamResetAttack #InfrastructureSecurity #CYFIRMA CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s Monthly Ransomware Report – July 2025.

CYFIRMA’s July 2025 Ransomware Report recorded 504 global victims, a 7.5% rise from June, reflecting sustained threat levels. Qilin remained the most active, while Incransom and SafePay surged. Interlock introduced FileFix, a stealthy Windows UI-based delivery method; GLOBAL GROUP launched an AI-powered RaaS; and Gunra expanded to Linux with multithreaded encryption. Emerging actors like Dire Wolf and D4RK4RMY focused on data leaks and ideological messaging, moving beyond traditional encryption. Scattered Spider escalated attacks on VMware ESXi through social engineering. The U.S., Canada, and the UK were top targets, with consumer services, professional services, and manufacturing sectors hit hardest. Attackers increasingly leverage native OS tools, cloud abuse, and MFA fatigue to evade detection.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-july-2025/

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #SafePay #Interlock #GLOBALGROUP #Gunra #DireWolf #D4RK4RMY #ScatteredSpider #CYFIRMAresearch #ExternalThreatLandscapeManagement #APT #LinuxRansomware

https://www.cyfirma.com/

CYFIRMA’s latest report explores Infos3c Grabber Stealer, a Python-based grabber malware that steals passwords, wallets, gaming accounts & Discord/Telegram data, captures screenshots, and exfiltrates via Discord. 

Use endpoint security + traffic monitoring to stay safe.

Link to the Research Report: https://www.cyfirma.com/research/unveiling-a-python-stealer-inf0s3c-stealer/

#CyberSecurity #ThreatIntel #Malware #DataTheft #InfoStealer #WindowsSecurity #EndpointProtection #ThreatHunting #Inf0s3c #grabber #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

New Threat Model: Executionless Persistence Across Endpoints & AI Layers REVENANT introduces a forward-looking multi-stage attack framework that chains stealthy, executionless techniques to persist not just on systems, but in the operational memory of AI assistants.

Key Highlights:

• Executionless delivery via fonts, clipboard state, and localization strings, no exploits, macros, or dropped binaries.
• AI-layer manipulation (inspired by real-world prompt injection research) to misclassify or suppress SOC alerts.
• Covert exfiltration through whitelisted telemetry channels, such as crash reporting.
• Chainable primitives that evade signature-based detection while surviving endpoint reimaging.
• Includes MITRE ATT&CK mapping, full kill chain simulation, and lab-safe PoC scenarios for blue team training.

REVENANT shows how trusted system features and AI-integrated workflows can be turned into long-lived footholds, bypassing traditional detection entirely. It’s a wake-up call for defenders: securing endpoints is no longer enough; the AI context layer is now part of the attack surface.

Link to the Research Report: https://www.cyfirma.com/research/revenant-executionless-self-assembling-threat-hidden-in-system-entropy/

#REVENANT #CyberSecurity #AIThreats #Executionless #AdversarySimulation #ThreatResearch #RedTeam #EDREvasion #AIsecurity #PassiveExecution #TrustAbuse #CyberDefense #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA has uncovered Salat Stealer (WEB_RAT) — a Go-based infostealer targeting Windows. It exfiltrates browser credentials, cryptocurrency wallets, and Telegram session data while evading detection through advanced persistence. Attributed to Russian-speaking actors, it operates under a MaaS model.

Explore our in-depth analysis and mitigation strategies in the full report.

Link to the Research Report: https://www.cyfirma.com/research/unmasked-salat-stealer-a-deep-dive-into-its-advanced-persistence-mechanisms-and-c2-infrastructure/

#CyberSecurity #ETLM #ExternalThreatLandscapeManagement
#CYFIRMA #CYFIRMAResearch #SalatStealer

https://www.cyfirma.com/

China's Cyber Shift: From espionage to sabotage, Targeting Global Infrastructure – check out, the newest CYFIRMA blog on Beijing's ambitions in the Fifth Domain.

Link to the Research Report: https://www.cyfirma.com/blogs/typhoon-in-the-fifth-domain-chinas-evolving-cyber-strategy/

#Geopolitics #CYFIRMAresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MilitaryAffairs #SaltTyphoon #VoltTyphoon #cyberesúionage #CYFIRMA #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA identified TinkyWinkey, a stealthy Windows keylogger, capable of capturing keystrokes, system info, and active windows. It leverages DLL injection and persistent services to evade detection and maintain long-term presence.

Link to the Research Report: https://www.cyfirma.com/research/tinkywinkey-keylogger/
 

#CyberSecurity #ThreatIntelligence #Keylogger #MalwareAnalysis 

#CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement 

#ETLM

https://www.cyfirma.com/

CYFIRMA has uncovered an ongoing cyber-espionage campaign orchestrated by APT36, a Pakistan-linked threat actor, targeting Indian Government entities.

Key Highlights:

• Initial Access: Spear-phishing emails delivering weaponized .desktop files disguised as PDFs.
• Target Platforms: Windows & Linux BOSS OS.
• Malware Behavior: Downloads & executes ELF payloads, establishes persistence via cron/systemd, and communicates with C2 servers (modgovindia[.]space, securestore[.]cv).
• Impact: Data exfiltration, sustained access, and evasion of security controls.
• Malware Identifiers: Meeting_Ltr_ID1543ops.pdf.desktop, Meeting_Ltr_ID1543ops.pdf-.elf (MD5: 10b7139952e3daae8f9d7ee407696ccf, 5bfeeae3cc9386513dc7c301c61e67a7).

This campaign reflects APT36’s increasing sophistication, tailoring malware to exploit indigenous technologies like Linux BOSS OS, and ensuring persistent, covert access to critical government infrastructure.

Organizations must stay vigilant, strengthen phishing defenses, and continuously monitor for malicious infrastructure and anomalous activity.

Link to the Research Report: https://www.cyfirma.com/research/apt36-targets-indian-boss-linux-systems-with-weaponized-autostart-files/

#CyberSecurity #ThreatIntel #APT36 #CyberEspionage #Linux #Windows #Phishing #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/