CYFIRMA Research

Our latest research has uncovered “Elpaco-team” ransomware, a new variant of the well-known Mimic ransomware. Elpaco employs similar tactics, primarily targeting Windows-based systems and leveraging legitimate tools. Once inside, Elpaco encrypts critical files with encryption algorithms, rendering them inaccessible to the user. 

The ransomware also ensures persistence on compromised systems through registry modifications in addition to disabling key security tools to avoid detection by traditional defense mechanisms. Elpaco then demands a ransom for the decryption key, threatening further damage to the encrypted files. This strain can target both individual users and organizations, making it a growing threat.

Understanding these tactics is crucial for mitigating the risks associated with this evolving threat. Stay vigilant and ensure your security measures are updated to defend against ransomware attacks like those of the Elpaco-team.

Link to the Research Report: ELPACO-team Ransomware: A New Variant of the MIMIC Ransomware Family - CYFIRMA

#CyberSecurity #Ransomware #Elpacoteam #MimicRansomware #MalwareAnalysis #ThreatIntelligence #InfoSec #DataProtection #CyberThreats  #CYFIRMA #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay vigilant against Black Basta’s sophisticated ransomware tactics! In our latest analysis, Black Basta continues to be a leading threat in the cyber landscape, targeting industries, such as healthcare, finance, and manufacturing. Known for exploiting vulnerabilities and using double extortion, this ransomware group applies social engineering to infiltrate systems, often posing as IT support via platforms like Microsoft Teams. Their operations involve deploying tools like AnyDesk, Cobalt Strike, and SystemBC to gain a foothold and maintain control, allowing them to extract sensitive data and demand ransom under the threat of exposure. With ransomware notes urging victims to act quickly, Black Basta’s tactics highlight the importance of strong cybersecurity defenses, regular employee training, and prompt incident response.
 
 Secure your organization by staying informed and proactive!

Link to the Research Report: BLACK BASTA : RANSOMWARE - CYFIRMA
 
#Cybersecurity #Ransomware #BlackBasta #ThreatLandscape #StaySecure #RansomwareReport #ThreatIntelligence #CYFIRMA #ETLM #ExternalThreatLandscapeManagement #CyfirmaResearch #CYFIRMA

https://www.cyfirma.com/

Stay ahead of cybersecurity trends with CYFIRMA's October 2024 Ransomware Report! This month saw a 42.78% increase in ransomware, led by groups like RansomHub, and new threats emerging, such as Hellcat and Playboy. Manufacturing and Healthcare were heavily impacted, while DragonForce expanded its Ransomware-as-a-Service model. Tactics like “Bring Your Own Vulnerable Driver” (BYOVD) and CVE-2024-40711 exploitation were highlighted, with advanced strains like Qilin.B enhancing encryption. Black Basta also refined social engineering attacks via Microsoft Teams, demonstrating the ransomware landscape's evolving sophistication.
 
Link to the Research Report: TRACKING RANSOMWARE : OCTOBER 2024 - CYFIRMA


#ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #ETLM #Ransomhub #Sarcoma #Interlock #USA #Manufacturing #CyfirmaResearch #Akira #ExternalThreatLandscapeManagement #StayProtected #CYFIRMA #DataProtection

https://www.cyfirma.com/

CYFIRMA’s research team has uncovered a new strain of malware known as "Wish Stealer," a sophisticated Node.js-based program targeting Windows users. This malware is designed to steal sensitive information from popular platforms like Discord, various web browsers, and cryptocurrency wallets. It employs advanced techniques, including privilege escalation, clipboard manipulation, and session hijacking, to capture valuable data, such as login credentials, cookies, and credit card information. Wish Stealer can also bypass two-factor authentication (2FA), allowing unauthorized access without alerting the victim. 

To stay hidden, the malware disables antivirus software and embeds itself deep within system folders, making it hard to detect. With its capability to persist on infected systems and evade standard security measures, Wish Stealer poses a significant threat. As malware threats like Wish Stealer continue to evolve, vigilance and proactive security measures are essential to protect sensitive information.
 
 Link to the Research Report: WISH STEALER - CYFIRMA

#Cybersecurity #MalwareAlert #CyberSecurity #CYFIRMA #CyfirmaResearch 

#WishStealer #ETLM #StaySafe

https://www.cyfirma.com/

A recently discovered variant of the SpyNote Remote Access Trojan (RAT) is posing as "Avast Mobile Security for Android." Upon installation, it gains extensive control over your device, silently granting itself permissions and displaying fake system update notifications. This sneaky malware operates in the background, restarts if stopped, and prevents uninstallation. SpyNote targets cryptocurrencies, steals data from other apps, and exfiltrates sensitive information to a command-and-control server. Stay alert and protect your devices.

Link to the Research Report: SpyNote: Unmasking a Sophisticated Android Malware - CYFIRMA

#CyberSecurity #CYFIRMA #CyfirmaResearch #SpyNote #ETLM #StaySafe #AndroidSecurity 

https://www.cyfirma.com/

Quishing, a dangerous combination of QR codes and phishing, is emerging as a significant threat that can lead to unauthorized access to sensitive information. Cybercriminals exploit the increasing prevalence of QR codes to trick users into scanning malicious links, resulting in credential theft and data breaches. Given the rapid rise in QR code phishing incidents from 2023 to 2024, organizations must act swiftly to mitigate this risk. Educate employees on the dangers of Quishing, implement robust verification processes for QR codes, and monitor for suspicious activity. Stay proactive and secure your digital interactions now! 

Link to the Research Report: QUISHING THE NEW AGE THREAT IN DIGITAL FRAUD - CYFIRMA

#CyberSecurity #Quishing #QRcodes #CyberThreats #CYFIRMAResearch   #VulnerabilityManagement #ExternalThreatLandscapeManagement #ETLM #CYFIRMA

https://www.cyfirma.com/

CYFIRMA's latest research highlights the G700 RAT, a potent malware targeting Android devices, especially in the cryptocurrency and finance sectors. With advanced techniques like privilege escalation, SMS hijacking, and phishing injection, G700 RAT can bypass security and compromise sensitive data. Strengthen your defenses to stay protected!

Link to the Research Report: G700 : The Next Generation of Craxs RAT - CYFIRMA

#CyberSecurity #ThreatIntelligence #MalwareAlert #G700RAT#AndroidSecurity #CYFIRMA #InfoSec

https://www.cyfirma.com/

Critical Alert: Organizations using TeamViewer's Remote Client and Remote Host products on Windows must act now!

CVE-2024-7479 and CVE-2024-7481 present a severe risk of privilege escalation. With millions of users potentially affected globally, immediate action is crucial. Both flaws involve improper cryptographic signature verification during driver installation. Specifically, CVE-2024-7479 pertains to VPN drivers, while CVE-2024-7481 relates to printer drivers. These vulnerabilities allow local, unprivileged attackers to escalate their privileges by exploiting TeamViewer's installation process and loading malicious drivers onto the system. Users should update to version 15.58.4 or later to mitigate this risk, check out CYFIRMA Research's latest report.

Link to the Research Report: CVE-2024-7479 and CVE-2024-7481 - Privilege Escalation - Vulnerability Analysis and Exploitation - CYFIRMA

#CyberSecurity #VulnerabilityManagement #PE #CVE20247479 #CVE20247481 #CYFIRMAResearch #VulnerabilitySummary #ExternalThreatLandscapeManagement #ETLM #CYFIRMA 

https://www.cyfirma.com/

Our Q3 2024 APT Quarterly Highlights Report reveals intensified cyber activities from APT groups in Iran, Russia, China, and North Korea, indicating heightened espionage efforts. Iran’s MuddyWater and APT34 leveraged custom malware like BugSleep, while Russia’s APT29 and APT28 capitalized on zero-day vulnerabilities for sophisticated infiltration. China’s APT41 and Earth Baku shifted focus towards critical network infrastructure using ShadowPad and VELVETSHELL, and North Korea’s Kimsuky and Lazarus expanded their campaigns targeting the Korean and Russian sectors. The evolving threat landscape demands proactive defenses and continuous threat monitoring.

Link to the Research Report: APT QUARTERLY HIGHLIGHTS - Q3 2024 - CYFIRMA
 
#CyberSecurity #APTHighlights #Q3APTReport #ThreatIntelligence #CyberEspionage #APTActivities #AdvancedPersistentThreat #Iran #Russia, #China #NorthKorea

https://www.cyfirma.com/

Ivanti Virtual Traffic Manager (vTM) users – A critical authentication bypass flaw (CVSS 9.8) is now being actively exploited! This vulnerability allows unauthenticated attackers to gain admin control over your systems. Patch now to prevent unauthorized access, data theft, or malware deployment. Public exploit code is already circulating. Stay secure!

Link to the Research Report: CVE-2024-7593 Vulnerability in Ivanti Virtual Traffic Manager : Vulnerability Analysis and Exploitation - CYFIRMA

#Cybersecurity #Ivanti #CVE20247593 #PatchNow #InfoSec#CyberThreats #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/