CYFIRMA Research

July 2026 Ransomware Threat Intelligence Briefing

Ransomware activity rebounded sharply in July 2026, with 883 publicly disclosed victims worldwide, a 21.3% increase from June and one of the highest monthly totals of the year, highlighting the continued resilience and expansion of the ransomware-as-a-service (RaaS) ecosystem.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-jul-2026/

#Ransomware #CyberSecurity #ThreatIntelligence #CYFIRMA #CyberThreats #RaaS #ThreatLandscape #CyberDefense #InfoSec #DigitalRisk #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

AI is changing the cybersecurity threat landscape and accelerating the speed, scale, and sophistication of cyberattacks.

CYFIRMA’s latest insights on Thailand’s AI-era cyber risk environment highlight a critical shift: AI is not necessarily creating entirely new attack categories. Instead, it is acting as a force multiplier, enabling threat actors to conduct reconnaissance, personalise phishing and social engineering, exploit vulnerabilities, and coordinate campaigns faster than ever.

From AI-enhanced phishing and deepfake impersonation to ransomware, credential attacks, supply-chain compromise, and Shadow AI risks, organisations must rethink cybersecurity beyond traditional reactive controls.

Link to the Research Report: https://www.cyfirma.com/research/thailands-ai-era-cybersecurity-threat-landscape-and-cyfirmas-solutions/

#CYFIRMA #Cybersecurity #ArtificialIntelligence #AI #CyberThreatIntelligence #ThreatIntelligence #CyberResilience #Ransomware #Thailand #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

UK & Ireland Threat Landscape Report 2026

The cyber threat landscape across the United Kingdom and Ireland continues to evolve as ransomware groups, data leak actors, and financially motivated adversaries refine their tactics and expand their operational reach.

Our latest The UK & Ireland Threat Landscape Report delivers an intelligence-led assessment of the region's evolving threat environment, providing actionable insights into the threats shaping today's cyber risk landscape.

As cyber threats become increasingly sophisticated, timely intelligence remains critical for strengthening organizational resilience, prioritizing defensive efforts, and supporting informed risk-based decision-making.

Link to the Research Report: https://www.cyfirma.com/research/cyber-threat-landscape-uk-ireland/

#ThreatIntelligence #CyberThreatIntelligence #CyberSecurity #Ransomware #ThreatLandscape #UnitedKingdom #Ireland #CYFIRMA #CYFIRMAresearch #ETLM

https://www.cyfirma.com/

The next industrial espionage campaign may not begin with malware.
It may begin with an AI-generated resume, a cloned executive's voice, or an employee asking a public chatbot for help.

Perhaps the biggest shift is not any individual technique, but how these capabilities combine. The report explores emerging risks around AI coding assistants, software supply chains, overprivileged AI agents, and the growing importance of treating AI systems as critical business assets rather than productivity tools.

Organizations need to move beyond securing AI models alone. They must secure the entire ecosystem that surrounds them, including employees, vendors, AI agents, connectors, and the data flowing between them. As AI adoption accelerates, the question is no longer whether AI will reshape industrial espionage.

Link to the Research Report: https://www.cyfirma.com/research/aaie-how-artificial-intelligence-is-reshaping-the-theft-of-trade-secrets-models-and-access/

#CyberSecurity #ThreatIntelligence #ArtificialIntelligence #AI #IndustrialEspionage #CyberThreats #InformationSecurity #ThreatResearch #RiskManagement #EnterpriseSecurity

https://www.cyfirma.com/

CYFIRMA's latest assessment highlights a threat environment shaped by ransomware, state-aligned espionage, mobile banking fraud, AI-enabled attacks, and persistent botnet activity.

Key findings:
 🔹 Ransomware remains the most disruptive threat
 🔹 Mobile banking fraud is becoming increasingly sophisticated and scalable
 🔹 State-sponsored actors continue targeting government and critical infrastructure
 🔹 AI is accelerating phishing, deepfake fraud, and malware development
 🔹 Dark web activity involving Indonesian data remains persistently elevated

As Indonesia's digital economy expands, organizations must adopt intelligence-led security strategies and strengthen cyber resilience. Cyber resilience is no longer optional. It is a business imperative.

Link to the Research Report: http://cyfirma.com/research/threat-landscape-indonesia/

#CyberSecurity #ThreatIntelligence #Indonesia #CyberRisk #Ransomware #CyberResilience #ThreatLandscape #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement #CYFIRMA

https://www.cyfirma.com/

The June 2026 edition of the CYFIRMA Ransomware Threat Intelligence Briefing is now available.

While publicly disclosed ransomware incidents declined during the month, threat actors continued to evolve their operations through Initial Access Brokers, ClickFix campaigns, custom malware, identity-focused attacks, and advanced defense-evasion techniques.

Tune in as the CYFIRMA Research Team analyzes the latest ransomware trends, emerging threats, and key recommendations to help organizations strengthen their cyber resilience.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-jun-2026/

#CYFIRMA #Ransomware #ThreatIntelligence #CyberSecurity #CyberThreats

https://www.cyfirma.com/

Artificial intelligence is reshaping the cyber threat landscape, and e-commerce platforms are increasingly becoming prime targets for AI-powered bot attacks. Unlike traditional bots, these advanced automated tools can mimic legitimate user behaviour, adapt to security controls, and execute large-scale attacks with greater speed and precision. From credential stuffing and account takeover to inventory hoarding, payment fraud, fake account creation, and web scraping, AI is enabling threat actors to automate and scale malicious operations like never before.

Our latest threat intelligence research explores how AI-powered bots are transforming the e-commerce threat landscape, examines the tactics and techniques employed by threat actors, assesses the potential business impact, and provides strategic recommendations to help organizations strengthen their defences against this rapidly evolving threat.

Link to the Research Report: https://www.cyfirma.com/research/ai-powered-bot-attacks-against-e-commerce-in-india/

#CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement #ThreatIntelligence #AIBots #BotAttacks #ECommerce #OnlineRetail #PaymentFraud 

https://www.cyfirma.com/

Saudi Arabia’s digital ecosystem is facing a convergence of escalating cyber risks.

Our latest threat landscape assessment highlights:

🔹 Intensified state-aligned espionage targeting Saudi Arabia 
 🔹 Ransomware operational maturity with multi-vector intrusion models
 🔹 AI-enabled phishing increasing credential harvesting success rates
 🔹 Rising dark web exposure of Saudi-linked datasets and access claims
 🔹 Sustained exploitation of edge infrastructure and critical vulnerabilities

As geopolitical volatility intersects with rapid digital transformation, Saudi Arabia remains a high-value cyber target across both public and private sectors.

Link to the Research Report: https://www.cyfirma.com/research/converging-threat-vectors-escalating-cyber-risk-and-strategic-exposure-in-saudi-arabias-digital-ecosystem-2025-2026/

#CyberThreatIntelligence #SaudiArabia #Ransomware #APT #Phishing #DarkWeb #CyberRisk #ThreatLandscape #CyberSecurity #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Hong Kong Cyber Threat Landscape 2025–26

CYFIRMA's latest intelligence assessment reveals a sharp rise in ransomware, state-aligned espionage, cloud abuse, and data-theft operations targeting Hong Kong.

Ransomware groups like RansomHouse, Cl0p, Sinobi, and advanced APTs such as Salt Typhoon, Lotus Panda, PlushDaemon, APT41, and Tropic Trooper continue to drive high-impact activity across finance, telecom, manufacturing, and critical infrastructure.

We’re also seeing:
• Increased exploitation of internet-facing vulnerabilities
• Growing use of cloud services for C2 to evade detection
• Surge in credential theft & infostealers
• Dark-web sale of Hong Kong-linked datasets
• Emerging risks from AI weaponization, IoT exploitation, and zero-click mobile attacks

Hong Kong’s cyber landscape is shifting toward stealthier, persistent, and intelligence-driven attacks demanding stronger detection, resilient security controls, and proactive threat intelligence.

Link to the Research Report: https://www.cyfirma.com/research/hong-kong-cybersecurity-threat-intelligence-report/

#CyberSecurity #HongKong #ThreatIntelligence #APT #Ransomware  #Geopolitics #InfoSec #CYFIRMA #CYFIRMAresearch  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Fake Income Tax Notice Delivers RAT Malware

CYFIRMA has identified a sophisticated malware distribution campaign leveraging a fraudulent Indian Income Tax Department assessment notice to infect users with a Remote Access Trojan (RAT)-like payload.

The campaign uses a convincing tax-themed lure hosted on a malicious domain to impersonate legitimate government communications, tricking victims into downloading a malware-laden archive disguised as official tax assessment documents.

Organizations and individuals should remain vigilant against unsolicited tax-related notifications and verify all government communications through official channels before downloading attachments or archives.

Link to the Research Report: https://www.cyfirma.com/research/an-income-tax-assessment-notice-phishing-campaign-delivering-malware/

#CyberSecurity #ThreatIntel #MalwareAnalysis #ThreatResearch #RAT #RemoteAccessTrojan #Phishing #SocialEngineering #IncomeTax #India #ThreatHunting #CyberThreats #CYFIRMA

https://www.cyfirma.com/