CYFIRMA Research

The CYFIRMA research has identified a new ransomware variant named LithiumWare, showcasing advanced capabilities designed to disrupt, encrypt, and steal. 

Key Features of LithiumWare:

• Data Theft: Exhibits activities indicative of stealing personal data, including detecting crypto-addresses.
• Persistence: Creates files in the startup directory, manipulates desktop.ini for cloaking, and executes services like svchost.exe.
• Reconnaissance: Reads machine GUIDs, security settings, and environment variables to tailor attacks.
• Misuse of Legitimate Software: Drops and executes files via trusted programs like msedge.exe and WinRAR.exe to evade detection.

Link to the Research Report: LithiumWare Ransomware - CYFIRMA

#Cybersecurity #Ransomware #LithiumWare #ThreatIntelligence  #MalwareDetection #ExternalThreatLandscapeManagement #ETLM #CYFIRMA

https://www.cyfirma.com/

China's DeepSeek recently shocked the AI world, challenging US dominance and raising serious security concerns. Did US export controls backfire, fuelling China's AI rise and a new era of cyber threats? 

Link to the Research Report: https://www.cyfirma.com/blogs/deepfake-or-the-sputnik-moment-in-the-ai-race/

#Geopolitics #CyfirmaResearch #ThreatIntelligence #cybersecurity #ETLM   #currentaffairs #China #AIdominance #Nvidia #Datatheft #DeepSeek   #ExternalThreatLandscapeManagement #CYFIRMA

https://www.cyfirma.com/

Cybercriminals have developed a new sophisticated method to distribute malware via fake CAPTCHA pages, tricking users into executing malicious scripts. Our investigation reveals that the Lumma Stealer is leveraging this tactic to harvest sensitive data, including credentials, cryptocurrency assets, and credit card info.

Link to the Research Report: https://www.cyfirma.com/research/fake-captcha-malware-campaign-how-cybercriminals-use-deceptive-verifications-to-distribute-malware/

#CyberSecurity #MalwareAlert #ThreatIntelligence #Phishing #InfoSec 

#CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

This report explores a fake financial management app on the Google Play Store named Finance Simplified, which has been downloaded over 100,000 times. The app reportedly downloads an additional fraudulent loan application targeting Indian users. Once installed, users attempting to secure loans are subjected to cyber blackmail and bullying. 

The malicious app gains unauthorized access to sensitive user data, including Clipboard content, Files, SMS, Contacts, Camera, and more. The CYFIRMA research team’s investigation reveals that multiple fraudulent loan apps are hosted on a single IP address but operate through different ports. These scam apps are being aggressively promoted across various social media platforms.

Link to the Research Report: https://www.cyfirma.com/research/spylend-the-android-app-available-on-google-play-store-enabling-financial-cyber-crime-extortion/

#Cybersecurity #MalwareAlert #StaySafe #ProtectYourData #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The cyber threat landscape is evolving, with hackers deploying multi-stage malware using obfuscation, steganography, and covert communication channels to evade detection.

Attacks start with an Obfuscated JavaScript, fetching encoded commands from a URL and executing an obfuscated PowerShell script, downloading a JPG image and obfuscated text file concealing malicious MZ DOS executables. The Stealer malware is then deployed, extracting passwords, browser data, and system info. The stolen data is subsequently sent to the attackers via Telegram bots, bypassing traditional security.

Stay Safe! Avoid running unknown scripts & suspicious downloads.

Link to the Research Report: https://www.cyfirma.com/research/javascript-to-command-and-control-c2-server-malware/

#Cybersecurity #MalwareAlert #StaySafe #ProtectYourData #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay informed about the latest developments in cybersecurity with CYFIRMA's Tracking Ransomware – January 2025 Report.
  

January witnessed 510 ransomware victims globally, with Akira emerging as the most active group while new threats like MORPHEUS surfaced. The Manufacturing, sector is the most targeted, and the USA remained the top victim region with 259 reported cases.
  

Notably, Akira’s activity surged by 60%, while Lynx and Incransom saw exponential growth, rising by over 200%. Additionally, ransomware actors are now exploiting cloud platforms, collaboration tools, and even Microsoft Teams phishing schemes to gain unauthorized access. As threats grow more sophisticated, organizations must adopt robust security measures, including regular patching, multi-factor authentication, and network segmentation, to mitigate risks.
 
Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-january-2025/
 
 #Cybersecurity #Ransomware #ThreatIntelligence #DigitalResilience #ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #CYFIRMA #ETLM
#RansomHub #Akira #Clop #USA #Manufacturing #CyfirmaResearch #ExternalThreatLandscapeManagement #StayProtected #MORPHEUS

https://www.cyfirma.com/

Our Q4 2024 APT Quarterly Highlights Report unveils a surge of dynamic and innovative cyber activities from APT groups across Iran, North Korea, Russia, and China. These groups intensified operations with a sharp focus on credential theft through phishing, MFA push-bombing, and fake job scams. RomCom (Russia) and Lazarus (North Korea) exploited zero-day vulnerabilities in Mozilla, Windows, and Google Chrome for stealthy malware deployment, while Jumpy Pisces (Andariel) partnered with Play ransomware, signaling North Korea’s growing reliance on ransomware for revenue.

Evasive Panda (China) shifted towards cloud-based espionage, targeting Google Drive and Outlook with CloudScout malware. Meanwhile, Iranian APTs like Emennet Pasargad escalated hack-and-leak campaigns, blending cyber intrusions with disinformation against Israel, the U.S., and Europe. Across the board, APTs maintained persistent access to government, aerospace, energy, defense, and financial sectors, underscoring a strategic focus on intelligence collection and disruption. Stay ahead of emerging threats with CYFIRMA’s ongoing monitoring of APT Threat Landscape.

Link to the Research Report: https://www.cyfirma.com/research/apt-quarterly-highlights-q4-2024/

#CyberSecurity #APTHighlights #Q4APTReport #ThreatIntelligence #Cybersecurity
#Q42024Report  #APTActivities #cyberthreats  #ExternalThreatLandscapeManagement #AdvancedPersistentThreat
#CYFIRMA #CyfirmaResearch #ETLM

https://www.cyfirma.com/

A malware disguised as a banking app is spreading through phishing and unofficial app stores. Built with Kotlin, this malware steals personal info and card details, leaking everything to criminals via Telegram bots and hidden servers. Stay safe! Only download apps from official stores, check permissions and NEVER share sensitive info on unsecured platforms.
 
Link to the Research Report: https://www.cyfirma.com/research/finstealer/

#Cybersecurity #MalwareAlert #BankingSecurity #StaySafe #ProtectYourData  #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Flesh Stealer, a newly identified malware first observed in August 2024 and written in C#, targets browsers like Chrome, Firefox, and Edge to harvest saved passwords, cookies, and browsing history. It also extracts data from applications such as Telegram and Signal, including stored chats and databases. 

Interestingly, it avoids executing on systems configured with regional settings for CIS (Commonwealth of Independent States) countries, likely to evade local detection. It is equipped with anti-VM and anti-debugging mechanisms, along with the capability to bypass Chrome's encryption.

Link to the Research Report: https://www.cyfirma.com/research/flesh-stealer-unmasking-the-blue-masked-thief/

#CYFIRMAResearch #CyberSecurity #Fleshstealer #ExternalThreatLandscapeManagement #ETLM #CYFIRMA 

https://www.cyfirma.com/

Astral Stealer: A Sophisticated Threat! 

Our latest research uncovers Astral Stealer, a powerful malware designed to exfiltrate sensitive data using browser injections, credential dumping, and sophisticated evasion techniques. As a publicly available threat, it provides cybercriminals with the means to bypass security defenses and exploit vulnerable systems. The developer is potentially based in France with ties to multiple gaming platforms, suggesting a possible connection between gaming interests and malware development.

Our analysis highlights the critical need for awareness and proactive defense strategies to safeguard your systems against such evolving threats. Stay alert, stay secure!

Link to the Research Report: https://www.cyfirma.com/research/astral-stealer-analysis/

#CyberSecurity #ThreatIntel #Malware #AstralStealer #InfoSec #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/