CYFIRMA Research

The Cyfirma research team has investigated the Flame Stealer, which is maintaining a strong presence with predominantly Portuguese speakers. This malware is designed to stealthily extract data from a wide range of sources, including discord tokens, browser cookies, credentials, etc.

Flame Stealer employs advanced techniques such as covert data extraction, persistence mechanisms, detection evasion, and data exfiltration via Discord webhooks.

Link to the the Research Report:  FLAME STEALER - CYFIRMA

#CyberSecurity #InfoStealer #FlameStealer #ThreatDetection #CyberThreats 

#StaySafe #CYFIRMA #CYFIRMAResearch #ExternalThreatLandscapeManagement 

#ETLM

https://www.cyfirma.com/

 Our Q2 2024 APT Quarterly Highlights report reveals a surge of dynamic and innovative cyber activities from Iranian, Russian, Chinese, and North Korean APT groups, challenging the global cybersecurity landscape.

Detailed analysis reveals escalating cyber threats from Iran's Void Manticore and APT42 targeting critical sectors, to Russia's APT28 and Sandworm focusing on cyber-espionage and ransomware, China's RedJuliett and APT41 exploiting vulnerabilities, to North Korea's Kimsuky and Moonstone Sleet intensifying their espionage efforts. This highlights the urgent need for continuous vigilance, user education, and prompt software updates to bolster cybersecurity defenses.

Link to the Research Report: APT Quarterly Highlights : Q2 2024 - CYFIRMA

#CyberSecurity #APTHighlights #Q2APTReport #ThreatIntelligence #Cybersecurity #Q22024Report #APTActivities #cyberthreats #externalthreatlandscape #AdvancedPersistentThreat #Iran #Russia, #China, #NorthKorea #ETLM

https://www.cyfirma.com/

A critical vulnerability (CVE-2024-24919) with a CVSS score of 8.6 has been discovered in EOL Check Point devices, allowing remote attackers to read arbitrary files.

The Hacktivist group "Ghost Clan Malaysia" has shared affected IP addresses worldwide. Upgrade to supported versions and apply necessary hotfixes immediately to protect your data and infrastructure. CISA has added this to its Known Exploited Vulnerabilities catalog. Stay vigilant!

Link to the Research Report: Threat Actors Actively Exploiting CVE-2024-24919: Underground Forums Share IP Addresses of Vulnerable Check Point Security Gateway Devices - CYFIRMA

#CyberSecurity #DataProtection #CVE202424919 #Cybersecurity #ThreatAlert  #CyfirmaResearch #Cyfirma #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Braodo Info Stealer, a Python-based malware, is targeting users in Vietnam and several other countries. This sophisticated threat spreads possibly through phishing emails, uses GitHub for hosting malicious code, and exfiltrates stolen data via Telegram channels. Learn more about this emerging threat impacting global cybersecurity.

Link to the Research Report: Braodo Info Stealer Targeting Vietnam and Abroad - CYFIRMA

#CyberSecurity #InfoStealer #Malware #BraodoinfoStealer #ThreatDetection
#Vietnam #CyberThreats #Threatintelligence #StaySafe #CYFIRMA
#CYFIRMAResearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Stay informed about the latest developments in cybersecurity with CYFIRMA's Tracking Ransomware-June 2024 Report.

This month's report highlights key trends, including a decrease in ransomware attacks by groups like Play and RansomHub, while Akira and Qilin increased their operations. Discover significant changes in targeted industries, with most sectors experiencing a decline in attacks. Notably, ransomware incidents were reduced by approximately 38.27% from May to June 2024.

Link to the Research Report: TRACKING RANSOMWARE - JUNE 2024 - CYFIRMA

#ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Play #Lockbit #Akira #USA #UK#Manufacturing #CyfirmaResearch #ExternalThreatLandscapeManagement 

https://www.cyfirma.com/

Critical Alert: Organizations using PHP in CGI mode must act now! CVE-2024-4577 presents a severe risk of remote code execution. With millions of websites potentially affected globally, immediate action is crucial. Attackers can exploit CGI argument injection to execute arbitrary commands, leading to unauthorized access or server compromise.
 
Update PHP configurations, monitor for unusual activity, and enforce strict input validation immediately. Proactive security measures are essential. Safeguard your systems now to prevent exploitation. Check CYFIRMA Research's latest report.

Link to the Research Report: PHP CGI Argument Injection (CVE-2024-4577)- Vulnerability Analysis and Exploitation - CYFIRMA

#CyberSecurity#VulnerabilityManagement#PHP#CVE20244577#CYFIRMAResearch#VulnerabilitySummary#ExternalThreatLandscapeManagement#ETLM#Cyfirma

https://www.cyfirma.com/

The CYFIRMA team has uncovered "Kematian-Stealer," a sophisticated info stealer targeting Windows systems, hosted on GitHub. This open-source malware is designed to stealthily extract data from a wide range of sources, including browsers, cryptocurrency wallets, messaging apps, gaming platforms, VPNs, and email clients.
 
Kematian-Stealer employs advanced techniques such as covert data extraction, persistence mechanisms, detection evasion, in-memory execution, and data exfiltration via Discord webhooks. It can also download and execute additional scripts and payloads directly into memory. The builder for Kematian-Stealer, also hosted on GitHub, allows users to customize and deploy the malware. Features and C2 server details can be configured through a web interface.

Link to the Research Report: Kematian-Stealer : A Deep Dive into a New Information Stealer - CYFIRMA
 
#CyberSecurity#InfoStealer#KematianStealer#ThreatDetection#CyberThreats#StaySafe#CYFIRMA#CYFIRMAResearch

https://www.cyfirma.com/

This year’s Olympic games come at a heightened moment for international conflict & terrorism. The potential for a jihadi group or individuals inspired by one to take the world’s attention with a potential attack or for Russia to try to embarrass France with acts of sabotage are very high.

Link to the Research Report: Paris Olympics - CYFIRMA
 
#Geopolitics#Cyfirmaresearch#ThreatIntelligence#cybersecurity#ETLM#currentaffairs

https://www.cyfirma.com/

Cyfirma research team has examined a variant of Lumma Stealer malware, and this report provides a comprehensive analysis of this advanced information-stealing malware, explores the tactics employed by threat actor to evade detection on the system and over the network, as well as their techniques for concealing malicious code and activities. Lumma Stealer targets sensitive data by employing sophisticated techniques, and utilizes counterfeit websites posing as legitimate antivirus software for distribution and promotion.

Lumma Stealer, a potent malware written in C, is designed to surreptitiously steal a wide array of data from compromised systems. It has rapidly gained notoriety for its ability to target and steal critical data such as cryptocurrency wallets, web browser information, email credentials, financial data, sensitive files within user directories, personal data, FTP client data and more by employing sophisticated techniques including event-controlled write operations and encryption to evade detection and maximize its impact.

Link to the Research Report: Lumma Stealer: Tactics, Impact, and Defense Strategies - CYFIRMA

#Cyfirma #CyberSecurity #Lumma Stealer #Malware-as-a-Service #MalwareAnalysis #CyfirmaResearch #ThreatIntelligence #ExternalThreatLandscapeManagement #ETLM 

https://www.cyfirma.com/

CYFIRMA's latest investigation reveals how terrorist groups in Kashmir are still exploiting digital platforms to spread propaganda and influence people. Their psychological operations (Psy Ops) aim to manipulate public perception, spread fear, and destabilize the region. Despite a reduction in physical presence, groups like TRF and Kashmir Tigers are ramping up their digital efforts post Article 370 abrogation.

 Link to the Research Report: Digital Warfare: Pakistan-Based Terrorist Organizations Utilize Digital Platforms in J&K for Psy Ops - CYFIRMA

#CyberSecurity #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM #DigitalThreats #PsyOps #StaySafe #Telegram #Propaganda #Kashmir #Kashmirdispute #CYFIRMA #Terrorism #Terror #India

https://www.cyfirma.com/