CYFIRMA Research

Cybercriminals are stepping up their game with Bizfum Stealer, a highly sophisticated malware targeting sensitive data such as browser credentials, files, and Discord tokens. It utilizes advanced encryption techniques and Telegram bots for stealthy data exfiltration.
 
 1. It extracts browser passwords, cookies, and saved credentials.
 2. Screenshots and clipboard data theft.
 3. Sensitive files (.jpg, .pdf, .docx, etc.) exfiltrated silently.
 4. Hijacks Discord tokens and other authentication data
 
Stay vigilant and protect your digital assets. Awareness is your first line of defense.

Link to the Research Report- https://www.cyfirma.com/research/bizfum-stealer/
 
 #CyberSecurity #ThreatIntel #BizfumStealer #Malware #DataProtection #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The UK faces an escalating cyber threat landscape dominated by sophisticated Russian actors, including state-affiliated groups like Sandworm and APT29, as well as privateer entities operating with Kremlin leniency. To learn more about the Russian cyber threat to the UK, read the full report.

Link to the Research Report: RUSSIA AS A THREAT ACTOR IN THE UK - CYFIRMA
 
#Geopolitics #CyfirmaResearch #ThreatIntelligence #cybersecurity #ExternalThreatLandscapeManagement #currentaffairs #ETLM #CYFIRMA

https://www.cyfirma.com/

Stay ahead of cybersecurity trends with CYFIRMA's November 2024 Ransomware Report. Ransomware incidents rose by 15.65%, affecting 606 victims worldwide. Emerging groups like Chort, Ymir, and SafePay deployed advanced techniques. Ransomware groups are seen exploiting critical vulnerabilities like Veeam Backup systems and targeting weekends for reduced detection.
 
Key sectors such as Manufacturing, Healthcare, and Finance experienced significant attacks, while the USA led with 326 victims. Notable events included SafePay's breach of 1.2 TB of data, disrupting logistics services, and RansomHub’s attack on Bologna FC, leaking sensitive financial and operational details.
 
The evolving threat landscape highlights the urgency of robust defenses, timely patching, and proactive risk management. Ransomware remains a global challenge, targeting critical industries and exploiting vulnerabilities.
 
Stay informed and secure - read the full report for detailed insights.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-november-2024/
 
#ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #CYFIRMA #ETLM #Ransomhub #Safepay #Chort #USA #Manufacturing #CyfirmaResearch #Akira #ExternalThreatLandscapeManagement #StayProtected

https://www.cyfirma.com/

Our team at CYFIRMA analyzed a malicious Android sample used in a targeted attack leveraging the Spynote Remote Administration Tool (RAT). We believe that the threat actor behind the targeted attack could be an APT. Delivered via WhatsApp with payloads disguised as apps like "Best Friend" and "Friend," the attack aimed to compromise high-value assets. All payloads were linked to the same command-and-control server and featured obfuscation techniques. While specific target details remain confidential, this case underscores the evolving tactics of threat actors. 

Link to the Research Report: Unidentified Threat Actor Utilizes Android Malware to Target High-Value Assets in South Asia - CYFIRMA

#CyberSecurity #MobileThreats #MalwareAnalysis #APT #spynote #androidmalware #craxrat   #spymax #mobilesecurity

https://www.cyfirma.com/

Taking control of the White House and Congress gives Republicans a rare opportunity to change the course of the country. How will Donald Trump wield that power during a second term, and will that impact cyber? The following blog post will try to summarize what we know so far, what we can likely expect, and what will be the fallout in the cyber realm.
 
Link to the Research Report: https://www.cyfirma.com/research/trump-2-0-whats-in-store/

#Geopolitics #CyfirmaResearch #ThreatIntelligence #cybersecurity #ETLM 

#currentaffairs #CYFIRMA

https://www.cyfirma.com/

CYFIRMA's latest research highlights the emerging threat of the Parano Malware Family, which includes Parano Stealer, Ransomware, and Screen Locker. Developed by the cybercriminal group Paranodeus, these tools target sensitive data using advanced techniques for persistence and evasion. Despite bans on their initial distribution channels, Paranodeus has shown adaptability by aligning with new threat groups like CyberVolk and DarkAssault. This evolving threat continues to pose significant risks to individuals and organizations. 

Link to the Research Report: https://www.cyfirma.com/research/exploration-of-parano-multiple-hacking-tools-capabilities/ 

#ParanoMalware #CyberSecurity #DataTheft #Ransomware #screenlocker #ThreatIntelligence #StaySecure #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Cyberattacks Hit Morocco: A Wake-Up Call for Cybersecurity!
 
Morocco has been hit with a series of cyberattacks from groups like Anonymous Algeria and EvilBbyte, with motives rooted in the long-standing dispute over the Western Sahara region. These hackers are targeting everything from government websites to critical infrastructure, and it’s all tied to growing geopolitical tensions between Morocco and Algeria. Explore our report to learn more!

Link to the Research Report: Decoding Cyberattacks on Morocco - CYFIRMA

#CyberSecurity #CyberAttack #Morocco #Geopolitics #DigitalDefense #StaySafe #CyberAwareness #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Helldown ransomware is spreading fast, targeting key industries like Real Estate, IT, Manufacturing, and Healthcare. The ransomware targets both Windows and Linux systems, exploits known vulnerabilities, and encrypts files.

First spotted in August 2024 by CYFIRMA, Helldown has already impacted businesses in 11 countries, with the USA and Germany being hit the hardest. It uses advanced techniques to avoid detection and disrupt operations. Researchers have found it linked to vulnerabilities in Zyxel firewalls for gaining access.

Link to the Research- Investigation into Helldown Ransomware - CYFIRMA

#Helldown #Ransomware #US #Manufacturing #IT #Healthcare #Threatintelligence
#CYFIRMA #ETLM #CyfirmaResearch #ExternalThreatLandscapeManagement  #StayProtected #Vulnerability

https://www.cyfirma.com/

Hexon Stealer is a variant of Stealit Stealer, which itself is derived from Fewer Stealer. Rebranding and code reuse are common practices among malware developers. Stealer devs often create Telegram or Signal channels to market their stealers, attracting a significant user base by promoting them across various platforms. The CYFIRMA research team’s investigation, identified patterns linking Stealit and Hexon Stealer, ultimately uncovering that the developers behind these tools are Turkish speakers.

Link to the Research Report: HEXON STEALER: THE LONG JOURNEY OF COPYING, HIDING, AND REBRANDING - CYFIRMA

#CyberSecurity #InfoSec #CyberThreats #CYFIRMA #CyfirmaResearch  #ExternalThreatLandscapeManagement #ETLM #StealitStealer #HexonStealer

https://www.cyfirma.com/

The CYFIRMA Research team provides insights into a severe flaw in Grafana (versions <11.0.5, 11.1.6, 11.2.1), which allows low-privilege users to execute arbitrary commands, risking sensitive data exposure and system compromise. Threat actors are also actively discussing and sharing exploits in underground forums.

Link to the Research Report: CVE-2024-9264: A Critical Vulnerability in Grafana : Vulnerability Analysis and Exploitation - CYFIRMA

#CyberSecurity #CVE20249264 #Grafana #PatchNow #InfoSec #CyberThreats
#CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/