CYFIRMA Research

Read CYFIRMA’s latest geo-political analysis, regarding Trump’s continued disruption of the world order, calling U.S. alliances into question while an emboldened China prepares for war over Taiwan.

Link to the Research Report: https://www.cyfirma.com/research/while-trump-disrupts-the-world-order-china-prepares-for-war-over-taiwan/

#Geopolitics #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM   #currentaffairs #invasionfleet #CYFIRMA   #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

A high-risk Android malware poses a serious threat by targeting banking apps, bypassing screenshot protections through UI reconstruction to steal sensitive financial data. It records live screen activity, captures video, and audio in real time, SMS, Contacts, Call logs, files and silently auto-grants all permissions. Once installed, it takes full control of the device, monitoring every action while staying hidden. Any attempt to uninstall is blocked as it hijacks system dialogs, displays fake full-screen warnings, and locks out users from settings. This stealthy malware ensures deep persistence, making it nearly impossible to remove. This malware is being widely promoted via YouTube and Telegram channels.

Link to the Research Report: https://www.cyfirma.com/research/ghostspy-web-based-android-rat-advanced-persistent-rat-with-stealthy-remote-control-and-uninstall-resistance/

#CyberSecurity #MalwareAlert #StaySafeOnline #CYFIRMA #CYFIRMAResearch#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay ahead of evolving ransomware threats with CYFIRMA’s April 2025 Ransomware Report.

Last month revealed shifting dynamics—Qilin surged by 71%, while Play and DragonForce increased by 75% and 25% respectively. Despite a 29% drop in total incidents from March, the Manufacturing, IT, and Consumer sectors remained heavily targeted.

The U.S. topped the victim chart, followed by the UK and Canada. New threats emerged with FOG, Interlock, and ELENOR-corp using phishing lures, fake IT tools, and stealth tactics. Storm-2460 exploited a Windows zero-day, while DragonForce and Nova expanded affiliate models driving modular, widespread ransomware campaigns. Emerging Groups like Silent and Gunra are further complicating the landscape.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-april-2025/

#CyberSecurity #RansomwareReport #ThreatIntelligence #DigitalDefense 

#ETLM #ThreatLandscape #StaySecure #Cyfirma #CyberResilience #USA 

#UK #Qilin #Play #Manufacturing #IT #Silent #Gunra #Fog #Interlock  #CYFIRMA #CyfirmaResearch

https://www.cyfirma.com/

CYFIRMA’s latest threat report reveals the workings of PupkinStealer, a .NET-based information stealer designed to extract a focused set of sensitive data from victim systems. Targeting browser credentials, desktop files, Telegram and Discord sessions, and screenshots, the malware compresses all stolen content into a ZIP archive and exfiltrates it using the Telegram Bot API, making attribution and detection more challenging. Our report includes a full technical analysis, Indicators of Compromise (IoCs), MITRE ATT&CK mapping, and a custom YARA rule for detection. 

Stay informed and enhance your defenses.
 
Link to the Research Report: https://www.cyfirma.com/research/pupkinstealer-a-net-based-info-stealer/

#CyberSecurity #CYFIRMAResearch #ThreatIntel #Infostealer #PupkinStealer   #MalwareAnalysis #CYFIRMA #ExternalThreatLanscapeManagement #ETLM

https://www.cyfirma.com/

Geopolitical tensions between Algeria and Morocco have reignited over the Western Sahara issue. Hacktivist groups have exacerbated the situation by targeting each other’s critical infrastructure. Algerian hacktivists claimed to have breached Morocco's CNSS, while Moroccan hacktivists alleged, they had hacked and leaked data from Algeria's MGPTT. However, such claims often prove to involve old or publicly accessible data rather than new breaches. Despite this, these actions significantly disrupt everyday life, such as through DDoS attacks on websites essential for daily activities, thereby impacting ordinary citizens.

Link to the Research Report: https://www.cyfirma.com/research/explainer-the-algeria-morocco-tensions/

#CyberThreat #ThreatIntel #Cybersecurity #CYFIRMA #CyfirmaResearch  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

A new threat is on the rise - Gunra Ransomware. This sophisticated ransomware not only encrypts files but also exfiltrates sensitive data, threatening to leak the data unless the ransom is paid.

Read the latest report from the CYFIRMA research team to learn more! Stay informed and safeguard your systems! 

Link to the Research Report: https://www.cyfirma.com/research/gunra-ransomware-a-brief-analysis/

#CyberSecurity #Ransomware #Gunra #DataProtection #CyberThreats  #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Donald Trump’s new tariff promises to revive American manufacturing, but evidence shows they are more likely to raise prices, reduce competitiveness, deter investment, and fuel geopolitical instability. The vision of millions of factory jobs ignores automation, labor shortages, and global supply chains. Instead of revitalizing the industry, tariffs risk slowing growth and driving inflation, putting greater pressure on businesses and consumers. 

Critically, the turbulence is likely to extend into cyberspace. Economic strain and heightened geopolitical tensions are expected to trigger a sharp increase in cyberattacks! Read CYFIRMA’s latest report to learn more.

Link to the Research Report: https://www.cyfirma.com/research/us-manufacturing-relocation-and-threats/

#CyberSecurity #Geopolitics #CYFIRMAresearch #ThreatIntelligence  #cybersecurity #ETLM #currentaffairs #ExternalThreatLandscapeManagement #CYFIRMA

https://www.cyfirma.com/

Read CYFIRMA’s report on the Hannibal Stealer, a rebranded variant of SHARP and TX Stealers, which has re-emerged with expanded data exfiltration capabilities and an updated command-and-control infrastructure. Hannibal Stealer is built in C# on the .NET framework. It targets a wide range of data sources, including browsers, cryptocurrency wallets, VPN configurations, FTP credentials, and system information. It incorporates clipboard hijacking and geofencing techniques to maximize impact. The malware is managed through a Django-based control panel, enabling real-time log monitoring and payload distribution. Current promotion across Telegram and underground forums points to sustained activity.

Link to the Research Report: https://www.cyfirma.com/research/hannibal-stealer-a-rebranded-threat-born-from-sharp-and-tx-lineage/
 
 #CyberThreat #HannibalStealer #InfoStealer #ThreatIntel #MalwareAnalysis #C2Infrastructure #Cybersecurity #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

A New Breed of Python-Based RATs is Abusing Discord for C2
 
The CYFIRMA research team has investigated an emerging class of Python malware that is turning popular platforms into weaponized control panels. One recent variant showcases just how accessible and disruptive these tools have become.
 
This lightweight Remote Access Trojan (RAT) uses Discord bots and interactive UI buttons to control infected systems — no shell commands, no fancy exploits, just real-time remote control through a familiar interface.
 
 Key Capabilities:

• Locks the user’s screen with an unclosable fullscreen GUI
• Forces system crashes (BSOD) via low-level Windows API calls
• Randomly moves the mouse to confuse or disable users
• Collects system and geolocation data through public APIs
• Embeds directly into Windows Startup for persistence

 
 This serves as a critical reminder: The line between trusted apps and abuse is thinner than ever.

Link to the Research Report: https://www.cyfirma.com/research/technical-malware-analysis-report-python-based-rat-malware/
 
 #CyberSecurity #MalwareAnalysis #PythonRAT #ThreatIntel #InfoSec #RedTeam #BlueTeam #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Cybercriminals are impersonating trusted business executives and financial experts to trap unsuspecting investors. These scammers are creating fake investment firms with fraudulent registration details, professional-looking websites and manipulated social media engagement to appear legitimate. They are actively using Telegram channels, WhatsApp groups, and fake company domains to lure victims.
 
Most of these scams involve UPI payments, making it easier for fraudsters to collect and launder money swiftly. Many operate through fake mobile apps that look like real investment platforms, where users are tricked into depositing funds they can never withdraw. These schemes often function as Ponzi scams — offering early returns funded by new investors before collapsing.
 
Victims are also pressured into making fast decisions with tactics like “limited-time offers” and “VIP access.” Alarming developments show that attackers are exploiting vulnerabilities in Indian Government and educational institution websites to redirect users to malicious domains. Evidence links the developers of these fake sites to foreign courtiers , suggesting potential international involvement.
 
Stay alert. Always verify investment opportunities!
 
Link to the Research Report: https://www.cyfirma.com/research/scamonomics-the-dark-side-of-stock-crypto-investments-in-india/ 

#CyberSecurity #InvestmentScam #CYFIRMA #OnlineFraud #UPIScam 

#PonziAlert #ThreatIntel #FakeApps #StaySafeOnline #CyfirmaResearch 

#ExternalThreatLandscapeManagement

https://www.cyfirma.com/