CYFIRMA Research

12-Day War update: Israel and Iran agree to a fragile ceasefire after America's bombing run on Tehran's nuclear facilities.

Link to the Research Report: https://www.cyfirma.com/research/12-day-war-update/

#OperationRisingLion #MidnightHammer #IsraelIran #Geopolitics #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MiddleEastWar #MilitaryAffairs #CYFIRMA #ExternalThreatLandscapeManagement 

https://www.cyfirma.com/

Odyssey Stealer, a rebranded version of Poseidon Stealer, targets macOS users through the Clickfix technique—tricking victims into copy-pasting malicious scripts into their terminal.
 
With capabilities to steal hardware details, keychains, browser cookies, crypto wallets, and plugins, the stolen data is sent to the stealer's hosted infrastructure. During our analysis, we observed it creating a directory in the /tmp folder named "lovemrtrump."
 
Interestingly, earlier versions avoided CIS countries, and this trend may still continue. Stay vigilant!

Link to the Research Report: https://www.cyfirma.com/research/odyssey-stealer-the-rebrand-of-poseidon-stealer/
 
#CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM #lovemrtrump

https://www.cyfirma.com/

Cyber Threat Alert: APT36 Targets Indian Defense with a Sophisticated Phishing Campaign!
 
CYFIRMA has uncovered a targeted cyber-espionage operation by APT36 (Transparent Tribe), a Pakistan-based threat actor. This group is exploiting phishing emails embedded with malicious PDFs mimicking official NIC documents to infiltrate Indian defense systems.
 
What’s Happening:
 · Victims receive a fake “protected” PDF (PO-003443125.pdf).
 · Clicking the button redirects to a fraudulent site, downloading a disguised malware-laden ZIP file.
 · Upon execution, the malware conducts credential theft, data exfiltration, and persistent access.
 · Uses anti-debugging, fileless execution, and clipboard/keylogging techniques.
 · Communications were observed with low-reputation C2 domains via encrypted channels.
 
 Key Défense Recommendations:
 · Enforce file extension visibility on endpoints.
 · Train personnel to detect phishing lures.
 · Monitor for anomalous process trees and network traffic.
 · Apply proactive threat hunting and behavior-based detection.
 
 APT36’s campaign is a stark reminder of the evolving sophistication of state-sponsored cyber threats. Awareness, detection, and rapid response remain our best defenses. 

Link to the Research Report: https://www.cyfirma.com/research/apt36-phishing-campaign-targets-indian-defense-using-credential-stealing-malware/

#CyberSecurity #APT36 #Phishing #ThreatIntel #India #Defense #Infosec #TransparentTribe #CYFIRMA #MalwareAlert #CYFIRMA #CYFIRMAResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay ahead of evolving ransomware threats with CYFIRMA’s May 2025 Ransomware Report.

May witnessed a 15.95% spike in ransomware attacks compared to April, with 545 incidents logged globally. New actors like SafePay and SilentRansomGroup rapidly gained ground, while established groups like Qilin deployed advanced loaders like NETXLOADER and SmokeLoader. Attackers leveraged tools such as Kickidler for stealthy credential theft and embedded ransomware in JPEG files to evade detection. Vulnerabilities in SAP NetWeaver were exploited by multiple groups, deploying payloads like PipeMagic. Meanwhile, emerging groups like IMN Crew and J Group began naming victims on their leak sites.

As attackers shift to evasive techniques and exploit enterprise software, our report provides timely insights to defend critical systems.

Link to the Research report: https://www.cyfirma.com/research/tracking-ransomware-may-2025/

#CyberSecurity #RansomwareReport #ThreatIntelligence #DigitalDefense #ETLM #ThreatLandscape #StaySecure #CYFIRMA #CyberResilience #Qilin #Play #Manufacturing #IT #SafePay #Qilin #JGroup #IMNCrew

https://www.cyfirma.com/

CYFIRMA’s latest research report analyses a stealthy Windows-based malware known as CyberEye, which is posing a significant threat across systems by offering attackers full remote control through a Telegram Bot API. Once executed, it silently harvests browser-stored passwords, cookies, credit card details, Wi-Fi credentials, and session tokens from apps like Telegram, Discord, and Steam. It monitors clipboard activity in real time, hijacking cryptocurrency wallet addresses to redirect funds.
 
The malware disables Windows Defender protections using PowerShell, evades analysis, and exfiltrates stolen data instantly via Telegram chats. It can log keystrokes, capture screenshots, record desktop activity, and steal entire folders like Minecraft profiles or desktop files. Designed to blend in with legitimate software, it can persist silently, avoid detection, and respond to attacker commands over encrypted channels.
 
A private Telegram channel run by the developer suggests the existence of a premium variant with extended capabilities. This malware highlights the growing sophistication of commodity threats and their increasing distribution across underground channels.
 
Link to the Research Report: https://www.cyfirma.com/research/understanding-cybereye-rat-builder-capabilities-and-implications/

#CyberSecurity #MalwareAlert #StaySafeOnline #CYFIRMA #CYFIRMAResearch

#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Ukraine’s daring drone strike reshapes warfare! CYFIRMA’s research team examines how cheap tech took on Russia’s nuclear air force and what it means for global militaries.
 
Link to the Reseach Report: https://www.cyfirma.com/blogs/ukraines-attack-on-russias-strategic-air-force-live-feed-from-a-revolution-in-military-affairs/
 
 #Geopolitics #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #AirForce #UkraineWar #MilitaryAffairs #OperationSpidersWeb #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

A highly modular Windows Remote Access Trojan (RAT), DuplexSpy, written in C#, has surfaced with advanced surveillance and system control capabilities.

Features include keylogging, remote shell access, screen & webcam spying, audio eavesdropping, and live C2 chat.

•  It uses fileless execution, UAC bypass, registry persistence, and DLL injection to evade detection.
•  Logs keystrokes in real time, records system audio, and hijacks webcams for covert monitoring.
•  Comes with a GUI builder, making it accessible to low-skilled attackers. 
•  Communication is secured via RSA and AES encryption, complicating detection and analysis.
•  First seen on April 15th, with ongoing updates expected, including browser data stealing and AD enumeration. 

Link to the Research Report: https://www.cyfirma.com/research/duplexspy-rat-stealthy-windows-malware-enabling-full-remote-control-and-surveillance/

#DuplexSpy #CyberThreat #Malware #RemoteAccessTrojan #ThreatIntel 

#InfoSec #CyberSecurity #RAT #CYFIRMA #CYFIRMAResearch 

#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

As tensions between India and Pakistan escalated in early 2025, the conflict spilled into cyberspace. In the wake of the April 22nd Kashmir attack and India’s Operation Sindoor, dozens of hacktivist groups launched a wave of digital assaults — from DDoS attacks and defacements to claimed data breaches — targeting critical infrastructure and government entities on both sides.

While the technical impact of many attacks was limited, the volume and coordination signalled a new era of hybrid conflict. CYFIRMA’s latest report breaks down how this cyber escalation unfolded, who was involved, and what it means for the future of digital warfare.

Link to the Research Report: https://www.cyfirma.com/research/firewalls-and-frontlines-the-india-pakistan-cyber-battlefield-crisis/

#CYFIRMAResearch #CYFIRMA #CyberConflict #CyberHacktivist  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Critical Alert: CVE-2025-34027 – Authentication Bypass + RCE in Versa Concerto!
 

Organizations using Versa Concerto for network orchestration must take immediate action. This newly disclosed vulnerability allows unauthenticated attackers to bypass login mechanisms and gain remote code execution through exposed REST APIs. The flaw affects key authentication flows, exposing internal configurations and allowing full takeover of the orchestrator.
 

Given its low complexity and potential to impact critical infrastructure and telecom networks, this vulnerability represents a high-priority risk. Restrict API access and monitor for suspicious activity to mitigate threats. Stay vigilant.

Link to the Research Report: https://www.cyfirma.com/research/versa-concerto-understanding-and-mitigating-cve-2025-34027/
 
 #CyberSecurity #VulnerabilityManagement #CVE202534027 #VersaConcerto #CYFIRMAResearch #ExternalThreatLandscapeManagement #ETLM #ZeroTrust #CYFIRMA

https://www.cyfirma.com/

A new ransomware! Lyrix Ransomware targets Windows systems, encrypting files and appending random 10-character extensions. Victims receive a README.txt ransom note demanding payment, threatening to leak stolen data.
 
Strengthen robust defenses & comprehensive incident response now!
 
Link to the Research Report: https://www.cyfirma.com/research/lyrix-ransomware/

#LyrixRansomware #CYFIRMA #CYFIRMAresearch 

#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/