CYFIRMA Research

CYFIRMA's investigation uncovered a major data breach at Cisco, led by the notorious threat actor IntelBroker. On October 14, 2024, IntelBroker posted on BreachForum, revealing that critical data such as source code, hard-coded credentials, SSL certificates, API tokens, and confidential documents were stolen. This breach impacts Cisco's B2B clients, with over 26 client source codes compromised.
 
Our investigation also found that despite Cisco’s efforts to block access, the hackers regained entry using hard-coded credentials found in previously exfiltrated data. This exposes serious security risks and highlights the need for immediate remediation.
 
Link to the Research Report: Data Breach Investigation on Cisco - CYFIRMA

#DataBreach #CyberSecurity #CYFIRMAInvestigation #CiscoBreach #ThreatIntel #SupplyChainRisk #HackerAlert #CyberDefense #Breachforum #DataLeak #CYFIRMA #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The proliferation of stealers, particularly those masquerading as open-source projects, poses significant risks to users. With capabilities to steal sensitive information, such as passwords, cryptocurrency wallets, and browser data, these malware variants not only threaten individual privacy but also create broader cybersecurity challenges.

As developers continue to leverage and modify existing stealers, users must remain vigilant and aware of the potential dangers associated with seemingly benign software, particularly those offered for free.

Link to the Research Report: The Will of D: A Deep Dive into Divulge Stealer, Dedsec Stealer, and Duck Stealer - CYFIRMA

#CyberSecurity #CyberThreat #DivulgeStealer #Dedsec #DuckStealer #CYFIRMA 

#CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The Israeli invasion of Lebanon began with the declared goal to remove Hezbollah's military infrastructure from the south of the country so that Israelis living in northern Israel could return to their homes, from which they have been driven by the low-intensity conflict raging on the border since Hamas' raid on Gaza last year.

The Israeli army has hit thousands of Hezbollah targets in Lebanon and Syria and has eliminated Hezbollah’s leader Hassan Nasrallah. After a brief hesitation, Iran finally carried out a large-scale ballistic missile strike on Israel in retaliation, and the whole world is now waiting for Israel's response. The targets could be Iran's nuclear program and spark a war that would affect the whole region and have secondary consequences for the entire world.

Link to the Research Report: WORLD ON THE BRINK : WAR IN THE MIDDLE EAST THREATENS TO ENTER A NEW DESTRUCTIVE PHASE - CYFIRMA

#Geopolitics #CYFIRMAresearch #ThreatIntelligence #Cybersecurity #ETLM #currentaffairs #ExternalThreatLandscapeManagement #ETLM #CYFIRMA #HassanNasrallah

https://www.cyfirma.com/

Stay ahead of cybersecurity trends with CYFIRMA's September 2024 Ransomware Report. This month’s analysis highlights significant shifts among top ransomware groups like Medusa, which saw a 525% surge in victims, while others like RansomHub and Meow experienced declines.
 
Key industries such as IT and transportation saw notable increases, while sectors like manufacturing and finance recorded drops. The report also explores emerging threats like Kransom, a ransomware disguised as a popular game and highlights the impact of ransomware groups leveraging vulnerabilities in SonicWall systems. Don’t miss out—read the full report to understand the evolving threat landscape and how you can protect your organization.
 
Link to the Research Report: TRACKING RANSOMWARE - SEPTEMBER 2024 - CYFIRMA

#ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Ransomhub #Medusa #orca #kransom #USA #Manufacturing #CyfirmaResearch #ExternalThreatLandscapeManagement #StayProtected #DataProtection

https://www.cyfirma.com/

Immediate action is required for all organizations using iTunes for Windows! CVE-2024-44193 is a critical local privilege escalation vulnerability that could lead to unauthorized system access. Attackers exploit misconfigured permissions in the AppleMobileDeviceService.exe to elevate privileges and gain control. Given the widespread use of iTunes, this poses a significant risk. Update iTunes to version 12.13.3 or later, monitor systems for anomalies, and review permissions to prevent exploitation. Stay proactive and secure your systems now! Check CYFIRMA Research's latest report. 

Link to the Research Report: iTunes Local Privilege Escalation (CVE-2024-44193) Vulnerability Analysis and Exploitation - CYFIRMA

#CyberSecurity #VulnerabilityManagement #iTunes #CVE202444193 #CYFIRMAResearch #VulnerabilitySummary #ExternalThreatLandscapeManagement #ETLM #Cyfirma

https://www.cyfirma.com/

Our latest research dives deep into Yunit Stealer, a sophisticated malware designed to steal sensitive data, such as credentials, cookies, and cryptocurrency wallets. This malware employs advanced evasion techniques, including obfuscation and persistence methods, making it a formidable threat to cybersecurity. Yunit Stealer can disable Windows Defender, modify registry keys, and use scheduled tasks to maintain its presence on infected systems. It exfiltrates data via Telegram and Discord webhooks, ensuring the stolen information reaches the attacker securely.
 
 The developer has connections to various gaming platforms, indicating a possible link between gaming interests and the creation of this malware. Our analysis highlights the importance of staying informed and vigilant to protect your systems from such threats. Stay informed and protect your systems with our comprehensive insights!

Link to the Research Report: YUNIT STEALER - CYFIRMA

#CyberSecurity #Malware #YunitStealer #DataProtection #CyberThreats #TechNews #CYFIRMA #StaySafe #CyberAwareness #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

A new malware threat, Vilsa Stealer, has surfaced. Discovered on GitHub, this malware is designed to quietly steal your most sensitive information, everything from browser passwords to cryptocurrency wallets and even Discord credentials. What makes it particularly scary is its ability to sneak past security measures and hide in your system, all the while sending your stolen data to a remote server.
 
Stay vigilant, update your security tools, and educate your teams about recognizing and avoiding suspicious activity.

Link to the Research Report: VILSA STEALER - CYFIRMA

#CyberSecurity #MalwareAlert #DataProtection #CyberThreat #VilsaStealer #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA's latest report delves into a crucial investigation targeting the malicious infrastructure linked to the APT group "Transparent Tribe." Employing open-source intelligence (OSINT), we thoroughly tracked the command-and-control (C2) servers utilized by this persistent threat actor. By leveraging advanced techniques such as JARM fingerprinting, we identified a network of 15 servers hosted by DigitalOcean, primarily aimed at malicious activities against individuals in India, reflecting the group's historical focus on Indian government sectors.

This investigation reveals the group's innovative use of Linux desktop entry files as attack vectors, highlighting their continuous adaptation in the dynamic cyber landscape. Additionally, the report details their evolving tactics, including the deployment of Mythic Poseidon binaries as malicious payloads, underscoring the sophistication of this threat.
 
Link to the Research Report: OSINT Investigation: Hunting Malicious Infrastructure Linked to Transparent Tribe - CYFIRMA

#CyberThreat #OSINT #TransparentTribe #APT36 #CyfirmaResearch #MaliciousInfrastructure #ExternalThreatLandscapeManagement #ETLM #CYFIRMA   #CyfirmaResearch

https://www.cyfirma.com/

As the U.S. presidential election in November approaches and the campaigns of former President Trump and Vice President Harris ramp up, hackers from Washington's adversaries are intensifying their efforts to disrupt or influence voting. Among these adversaries, Iran is emerging as an increasingly significant player.

Link to the Research Report: IRAN STEPS UP EFFORTS IN U.S. ELECTION MEDDLING - CYFIRMA

  #Geopolitics #CYFIRMAresearch #ThreatIntelligence #Cybersecurity #ETLM #currentaffairs #ExternalThreatLandscapeManagement #ETLM #CYFIRMA

https://www.cyfirma.com/

Critical Alert: Organizations using Apache OFBiz must act now! 
 
CVE-2024-38856 presents a severe risk of remote code execution. With millions of users potentially affected globally, immediate action is crucial. This flaw allows unauthenticated users to bypass security restrictions and execute screen rendering code via specially crafted requests through unauthenticated endpoints if some pre-conditions are met, such as when the screen definitions fail to properly check user permissions. Users are urged to upgrade to version 18.12.15.
 
Link to the research Report: CVE 2024-38856 – Pre-authentication Remote Code Execution (RCE) - Vulnerability Analysis and Exploitation - CYFIRMA

#CyberSecurity #VulnerabilityManagement #RCE #CVE202438856   #CyfirmaResearch #VulnerabilitySummary   #ExternalThreatLandscapeManagement #ETLM #CYFIRMA

https://www.cyfirma.com/