CYFIRMA Research

The CYFIRMA research team provides a comprehensive analysis of how diplomacy, defense, and digital strategy are colliding:

As trade friction intensifies especially under the 2025 U.S. tariff regime, cyberspace is becoming the frontier of quiet competition between traditional allies. While full-scale cyber warfare remains unlikely, behind-the-scenes intelligence gathering is rising fast.

Our latest report explores:

• U.S. and allied cyber espionage trends
• How economic policy shapes digital posturing
• The role of non-state actors and hacktivists
• Why restraint still (mostly) prevails

Link to the Research Report: https://www.cyfirma.com/research/cyber-espionage-among-allies-strategic-posturing-in-an-era-of-trade-tensions/

#Cybersecurity #Geopolitics #Espionage #Alliances #TradeTensions    #CyberDiplomacy #CYFIRMA #CYFIRMAresearch        #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

U.S. President Donald Trump, once a critic but now a supporter of TikTok, is granting the app’s China-based parent company, ByteDance, a second 75-day extension to finalize a deal that would transfer ownership of TikTok to an American entity. While the legislation allowed only one extension for a sale, the U.S. Congress has yet to push back against Trump’s decision to offer another. However, the most important issue is tied to the nature of TikTok and its weaponization in Beijing’s war against the West as part of its Three Warfare doctrine.

Link to the Research Report: https://www.cyfirma.com/research/tik-tok-chinas-digital-weapon-system/
 
#UnrestrictedWarfare #ThreeWarfares #TikTokBAN #Geopolitics #CyfirmaResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #China #disinformation #censorship #propaganda #CYFIRMA #ExternalThreatLandscapeManagement 

https://www.cyfirma.com/

Stay ahead of evolving ransomware threats with CYFIRMA’s Monthly Ransomware Report – March 2025. 

The month of March saw shifting dynamics, with Safepay experiencing a huge surge of 223%, while RansomHub and Akira declined. Babuk2 has possibly leveraged fake extortion claims. Manufacturing, IT, and Consumer sectors remained prime targets as total incidents dropped 30.7% from February. The U.S. led victim counts, followed by Germany and Canada. Notably, Black Basta’s automated brute-force tool BRUTED, Qilin’s use by North Korean APTs, and Akira’s IoT exploitation underscored evolving tactics.

New custom malware like Betruger, Medusa’s BYOVD attack, and multi-OS ransomware like Albabat highlight growing sophistication. Emerging groups like Mora_001 and threats like Arkana and RALord further complicate the threat landscape. 

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-march-2025/

#Ransomware #ThreatIntelligence #DigitalResilience
#ThreatLandscape#StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #CYFIRMA #ETLM #RansomHub #BlackBasta #Clop #USA #Manufacturing #CyfirmaResearch #ExternalThreatLandscapeManagement #Arkana #RALord

https://www.cyfirma.com/

CYFIRMA researchers have identified a dangerous new version of Neptune RAT being actively shared online. This malware spreads through GitHub, Telegram, and YouTube, often advertised as the "Most Advanced RAT." The attack starts when victims run malicious PowerShell commands. First, the "irm" command downloads harmful code from the file hosting website. Then "iex" executes this code, installing the malware in the AppData folder. The malware connects back to the attackers, giving them full control of infected computers.
 
Neptune RAT is packed with dangerous features. It can steal passwords from over 270 applications, hijack cryptocurrency transactions, lock files for ransom, and even spy on users through their webcams. The malware uses clever tricks to hide from security software and stay on infected machines. While the creator claims this is just for education, the malware is clearly being used for attacks. A free version circulates online.
 
To stay safe, never run PowerShell commands from untrusted sources, Be careful downloading software from GitHub or Telegram, and keep your antivirus updated. 

Link to the Research Report: https://www.cyfirma.com/research/neptune-rat-an-advanced-windows-rat-with-system-destruction-capabilities-and-password-exfiltration-from-270-applications/

#CyberSecurity #MalwareAlert #StaySafeOnline #CYFIRMA #CYFIRMAResearch #ExternalThreatLandscapeManagement #ETLM 

https://www.cyfirma.com/

CYFIRMA’s research team has conducted an in-depth investigation into Konni RAT,  a sophisticated remote access trojan (RAT) that uses advanced evasion techniques to bypass detection. It exploits Windows features, such as file extension hiding and the 260-character limit for LNK files, to conceal malicious activity. After gaining access, Konni RAT maintains persistence through registry modifications and collects sensitive data from infected systems, and exfiltrates this information to remote servers while using modular batch scripts to perform tasks like payload execution and file deletion.

Due to its stealth and adaptability, Konni RAT poses a significant threat, and users are advised to keep systems updated and exercise caution with unknown files and links. 

Link to the Research Report: https://www.cyfirma.com/research/analysis-of-konni-rat-stealth-persistence-and-anti-analysis-techniques/

#CYFIRMAresearch #KonniRAT #Malware #Cybersecurity #RAT #ThreatAnalysis #Infosec #CyberThreat #ExternalThreatLandscapeManagement #ETLM #CYFIRMA

https://www.cyfirma.com/

Hackers are leveraging Python-based Discord RATs to exploit Discord’s API as a Command and Control (C2) platform. This sophisticated malware allows attackers to gain complete control over compromised systems, making it a serious cybersecurity risk.

• Steals credentials from browsers
• Execute remote system commands
• Capture live screenshots for surveillance
• Manipulate Discord servers for persistence

With Discord increasingly targeted by cybercriminals, awareness is key.

Link to the Research Report: https://www.cyfirma.com/research/analysis-of-a-discord-based-remote-access-trojan-rat/

#CyberSecurity #PythonRAT #DiscordMalware #ThreatIntelligence #Infosec #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The CYFIRMA research team has identified a fake Indian Post Office website leveraging the Clickfix technique to target Indian users. The report details how a Pakistani threat actor is targeting both Windows and Android users by dropping APK files for Android devices, copying PowerShell commands to the clipboard, and dropping Clickfix instructions pdf file.

Link to the Research Report: https://www.cyfirma.com/research/turning-aid-into-attack-exploitation-of-pakistans-youth-laptop-scheme-to-target-india/

#CyberSecurity #Clickfix #APT36 #ExternalThreatLandscapeManagement 

#ETLM #CYFIRMA #CyfirmaResearch

https://www.cyfirma.com/

Critical Alert: Immediate action is required for all organizations using Apache Tomcat!

CVE-2025-24813 is a critical Remote Code Execution (RCE) vulnerability that allows attackers to bypass security controls via a path equivalence flaw, leading to arbitrary code execution. Active exploitation has been observed, with public PoC exploits available, increasing the urgency for mitigation. Given Tomcat’s widespread use in enterprise and cloud environments, this poses a severe security risk.

Stay proactive - secure your systems now! 

Link to the Research Report: https://www.cyfirma.com/research/cve-2025-24813-apache-tomcat-rce-vulnerability-analysis/

#CyberSecurity #VulnerabilityManagement #CVE202524813 #ApacheTomcat #CYFIRMAResearch #ExternalThreatLandscapeManagement #ETLM #CyberThreats #ZeroDay #RemoteCodeExecution

https://www.cyfirma.com/

Stay ahead of evolving ransomware threats with CYFIRMA’s Monthly Ransomware Report – February 2025. Ransomware activity surged by 87.45% in February month, with Cl0p witnessing an alarming 453% rise. Manufacturing, FMCG, and Transportation sectors faced the highest spike in attacks. The U.S. remained the top target, followed by Canada, the U.K., Germany, and France. Notably, China-linked actors exploited a Check Point vulnerability to deploy ShadowPad and ransomware. 

New ransomware groups, including Anubis, Linkc Pub, and RunSomeWares, emerged, while law enforcement dismantled the 8Base ransomware group. Ghost ransomware continues to target critical sectors, and Black Basta’s attack on Southern Water cost £4.5M. With sophisticated tactics such as zero-day exploits, multi-stage infections, and sophisticated phishing, ransomware groups are evolving rapidly. 

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-february-2025/

#Cybersecurity #Ransomware #ThreatIntelligence #DigitalResilience
#ThreatLandscape#StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #CYFIRMA #ETLM #RansomHub #BlackBasta #Clop #USA #Manufacturing #CyfirmaResearch #ExternalThreatLandscapeManagement #StayProtected #Anubis #RunSomeWare

https://www.cyfirma.com/

Hacktivists often become active participants in cyber conflicts whenever geopolitical tensions arise. This has been evident during events like the Israel-Palestine conflict and the Russia-Ukraine war. Recently, tensions flared between Malaysia and Indonesia following the death of a migrant worker attempting to cross the Malaysian border with four others. This incident sparked public outrage against Malaysian authorities, prompting Indonesian hacktivists to launch cyberattacks on Malaysian websites. In retaliation, Malaysian hacktivists responded with their own attacks, escalating the digital conflict. 

Link to the Research Report: https://www.cyfirma.com/research/geopolitical-conflicts-and-the-unpredictable-nature-of-hacktivist-operations/

https://www.cyfirma.com/