CYFIRMA Research

New Ransomware Alert: "Windows Locker"

A new .NET-based ransomware strain, Windows Locker, is making waves with its advanced tactics, also read the CYFIRMA research team's full report for a comprehensive analysis:

Encryption: Files are encrypted with the .winlocker extension. 

Ransom Note: Victims receive a Readme.txt file with instructions to contact the attacker.

Persistence: The ransomware modifies registry keys to stay active on compromised systems.

No Recovery: It deletes shadow copies, making it impossible to restore data through traditional methods.

Stay vigilant! Keep backups and security software up to date to protect your systems.

Link to the Research Report: https://www.cyfirma.com/research/windows-locker-ransomware/

#CyberSecurity #Ransomware #WindowsLocker #DataProtection #InfoSec #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

A critical SQL injection vulnerability (CVE-2024-45387) has been discovered in Apache Traffic Control's Traffic Ops component, impacting versions 8.0.0 and 8.0.1. Attackers with high-level roles (admin, federation, operations, portal, steering) can execute malicious SQL queries, risking data compromise, privilege escalation, and service disruption.

Link to the Research Report: https://www.cyfirma.com/research/cve-2024-45387-critical-vulnerability-in-apache-traffic-control/ 

#CVE202445387 #SQLInjection #ApacheTrafficControl #CyberSecurity #Vulnerability #PatchNow #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The CYFIRMA team has analyzed malware linked to the Indian APT group DONOT, uncovering its use of a deceptive app called “Tanzeem” to gather intelligence under the guise of a chat platform. The app shuts down after permissions are granted, suggesting a targeted approach. Two analyzed versions, from October and December, showed minimal differences, indicating consistent tactics. The misuse of the OneSignal platform, typically for legitimate notifications, to deliver phishing links highlights the group’s evolving methods to maintain persistence. These findings emphasize the need to understand such threats as the group continues adapting to target individuals across the region. Read the full analysis for more details.
 
Link to the Research Report: https://www.cyfirma.com/research/android-malware-in-donot-apt-operations/

 #CyberSecurity #APTGroup #ThreatIntelligence #donotapt #aptdonot #internalthreat #CYFIRMA #tanzeem #OneSignal #androidmalware #malware #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The swift fall of the Syrian regime caught major players off guard, including Russia and Iran, who heavily invested in propping up the state. While the USA considers withdrawal, Turkey is positioned to greatly increase its influence, while Iran and Russia suffer a significant strategic blow and might start relying more heavily on its cyber capabilities and rocket forces including a potential push for nuclear weapons in the case of Tehran.

Link to the Research Report: https://www.cyfirma.com/research/the-fall-of-syria-and-the-future-of-the-iran-threat/

#Geopolitics #CyfirmaResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #Hezbollah #ExternalThreatLandscapeManagement #CYFIRMA

https://www.cyfirma.com/

Stay informed about the latest developments in cybersecurity with CYFIRMA's Tracking Ransomware-December 2024 Report.
 
 The report highlights key trends, including a 12.38% decrease in ransomware attacks compared to November, alongside the rise of new groups like Funksec, which targeted VMware ESXi hypervisors and Windows servers. Critical vulnerabilities, such as CVE-2023-46604 in Apache ActiveMQ, were exploited to deploy ransomware like Mauri, enabling attackers to create backdoor accounts and gain persistent access to networks.
 
 Industries like FMCG and E-commerce faced increased targeting due to sensitive data and digital growth, while the United States led global attack figures with 283 incidents. Emerging threats like Bleubox and the evolving tactics of Black Basta further emphasize the sophistication of modern ransomware operations.
 
Gain actionable insights on these developments and learn how to strengthen defenses against evolving cyber threats in the full report.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-december-2024/
 
 #Cybersecurity #Ransomware #ThreatIntelligence #DigitalResilience
#ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #CYFIRMA #ETLM #RansomHub #BlackBasta #Clop #USA #Manufacturing

https://www.cyfirma.com/

At CYFIRMA, we continuously analyze the tactics and techniques employed by threat actors. One such technique is Remote Template Injection, which exploits Microsoft Word's template functionality to bypass traditional defenses. Used by Advanced Persistent Threat (APT) groups, this method disguises malicious payloads in seemingly harmless documents, making it a potent tool in spear-phishing campaigns.
 
Our latest report uncovers how attackers exploit Word’s XML-based OOXML format to inject malicious templates, bypassing email filters and endpoint detection. We detail the technical execution, risks, and mitigation strategies. Stay informed, stay secure. 
 
Link to the Research Report: https://www.cyfirma.com/research/living-off-the-land-the-mechanics-of-remote-template-injection-attack/

#CyberSecurity #ThreatIntelligence #APTAttacks #CYFIRMA #RemoteTemplateInjection #LivingofftheLand 

#ExternalThreatLandscapeManagement #ETLM #CyfirmaResearch

https://www.cyfirma.com/

At CYFIRMA, we continuously analyze the tactics and techniques employed by threat actors. One such technique is Remote Template Injection, which exploits Microsoft Word's template functionality to bypass traditional defenses. Used by Advanced Persistent Threat (APT) groups, this method disguises malicious payloads in seemingly harmless documents, making it a potent tool in spear-phishing campaigns.
 
Our latest report uncovers how attackers exploit Word’s XML-based OOXML format to inject malicious templates, bypassing email filters and endpoint detection. We detail the technical execution, risks, and mitigation strategies.

Link to the Research Report: https://www.cyfirma.com/research/noneclid-rat/
 
Stay informed, stay secure. Read the full report to protect against this sophisticated threat! 

https://www.cyfirma.com/

Introducing FireScam: A New Android Malware Threat
 
The CYFIRMA research team have uncovered a new, sophisticated Android malware - FireScam, an advanced information-stealing malware with spyware capabilities. Disguised as a fake ‘Telegram Premium’ app, this malware is spread through phishing websites and targets users with the intent to steal sensitive information. Once installed, it stealthily monitors notifications, text messages, and app activity, exfiltrating data via encrypted channels and Firebase services. By employing tactics like SSL pinning, obfuscation, and environment detection, FireScam evades security measures, making it a dangerous new threat for Android users.
 
Link to the Research Report: https://www.cyfirma.com/research/inside-firescam-an-information-stealer-with-spyware-capabilities/

#CYFIRMAResearch #CyberSecurity #MalwareAlert #FireScam #AndroidMalware   #Phishing #DataExfiltration #MobileSecurity #CyberThreats #ExternalThreatLandscapeManagement #ETLM #CYFIRMA #TelegramPremium #FireScam

https://www.cyfirma.com/

A critical vulnerability, CVE-2024-10914, has been discovered in unsupported D-Link devices, including DNS-320, DNS-320LW, DNS-325, and DNS-340L. With over 60,000 devices potentially exposed and nearly 1,100 actively exploited since Nov 12, 2024, attackers are leveraging this flaw to steal data, deploy ransomware, and compromise networks.

If you’re using legacy D-Link devices, it's crucial to retire and replace them immediately. These devices no longer receive security updates, leaving them vulnerable to ongoing attacks.

Prioritize mitigation efforts to safeguard your systems and data!

Link to the Research Report: CVE-2024-10914: A Critical Vulnerability in D-Link NAS Devices - CYFIRMA

#CyberSecurity #VulnerabilityAlert #DLink #CVE202410914 #DataProtection 

#InfoSec #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement 

#ETLM

https://www.cyfirma.com/

The CYFIRMA research team is proud to offer insights into the increased cyber risks the holiday season brings! Stay alert, verify offers, and keep your information safe!

As the year end of season approaches, watch out for scammers using advanced tactics. Phishing emails might offer irresistible deals but could contain malicious links - always verify before clicking! Be cautious of fake websites and typo-squatting domains that mimic popular retail sites; double-check URLs before purchasing. Scammers also use malicious ads and deepfake videos of celebrities promoting fake offers. Additionally, hacktivists may target high-traffic retail websites with DDoS attacks to gain attention.
 
Link to the Research Report- How Festive Events Have Become Prime Targets for Digital Exploitation and Fraud - CYFIRMA

#CYFIRMAResearch #CyberSecurity #Digitalexploitation #Fraud #ExternalThreatLandscapeManagement #ETLM #CYFIRMA

https://www.cyfirma.com/