CYFIRMA Research

Stay informed about the latest trends in the ransomware landscape with CYFIRMA's May 2024 Ransomware report. This edition highlights significant increases in ransomware activity, with LockBit3 surging tremendously and Play rising by 10.34%. Incransom's activity doubled, while RansomHub and Medusa also showed notable activity.
 
Manufacturing, real estate, banking, and healthcare sectors saw increased targeting. The US remains the top geographical target. Emerging groups like SpiderX, Fakepenny, and Arcusmedia present new threats. Stay vigilant and explore the full report for actionable insights.

Link to the Research Report: Tracking Ransomware May 2024 - CYFIRMA
 
#ThreatLandscape#StaySecure#CyberSecurity#RansomwareReport#ThreatIntelligence#Ransomware#DigitalDefense#Cyfirma#ETLM#Lockbit#Lockbit3#Incransom#Play#SpiderX#RansomHub#Medusa#Fakepenny#Arcusmedia#USA#UK#Manufacturing

https://www.cyfirma.com/

CYFIRMA research team has examined a variant of Vidar Stealer malware, and this in-depth examination explores the tactics employed by threat actor to evade detection on the system and over the network, as well as their techniques for concealing malicious code and activities. Additionally, it describes the use of social media platforms to procure command and control details for data exfiltration and updates. Vidar Stealer, a potent malware written in C++, is capable of stealing a wide range of data from compromised systems.

To mitigate the risks associated with Vidar Stealer, users are advised to exercise caution when accessing files from untrustworthy sources or clicking on unfamiliar links. Implementing robust cybersecurity measures, including reputable antivirus software, regular software updates, and awareness of social engineering tactics, is crucial in fortifying protection against such threats. Stay vigilant, stay secure. 

 Link to the Research Report: Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware - CYFIRMA

#Cyfirma #CyberSecurity #Vidar Stealer #Malware-as-a-Service #MalwareAnalysis #CyfirmaResearch #ThreatIntelligence #ExternalThreatLandscapeManagement #ETLM 

https://www.cyfirma.com/

Urgent Alert: Hackers are actively exploiting CVE-2024-3273, a critical vulnerability in D-Link NAS devices, with affected device IP addresses being shared on underground forums. With over 90,000 potentially impacted devices globally and inclusion in CISA's Known Exploited Vulnerabilities list, immediate action is crucial to secure data and prevent unauthorized access. Users worldwide, especially in the UK, Russia, Germany, Italy, USA, and France, should update firmware, change default credentials, and consider retiring older devices to mitigate risks.

Link to the Research Report: Threat Actors Actively Exploiting CVE-2024-3273 : Underground Forums Share IP Addresses of Vulnerable D-Link NAS Devices - CYFIRMA

#DLink #CVE20243273 #DataSecurity #CyberSecurity #ThreatAlert #InfoSec #CyberThreats #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The notorious Nikki Stealer group has transitioned into the Iluria Stealer group, maintaining a strong presence with a predominantly Portuguese-speaking user base. Both their websites are hosted by Hostinger, and the current owner, as per his Discord bio, claims to be the former CEO of Nikki Stealer. Dynamic analysis reveals that Iluria Stealer has capabilities to steal browser passwords, autofill data, and cookies, indicating a serious threat. Recently, on May 11, 2024, "Ykg," the developer of Iluria Stealer, announced the release of version 2. This evolution and expansion of the group's activities highlight the need for ongoing vigilance and robust security measures.

Link to the Research Report: Iluria Stealer; a Variant of Another Discord Stealer - CYFIRMA

#CYFIRMA #CyfirmaResearch #NikkiStealer #IluriaStealer #Hostinger #EpsilonStealer #ExternalThreatLandscapeManagement #ETLM #ThreatIntelligence ##DigitalDefense #CyberSecurity

https://www.cyfirma.com/

 Meet Synapse ransomware, the newest digital threat on the block. This latest threat, emerging in February 2024, operates under a Ransomware-as-a-Service model, distributing its malicious payload via the dark web. Our research sheds light on the internal working of this malware. Discover how it selectively avoids encrypting Iranian systems, raising questions about potential connections to certain threat groups.

 Link to the Research Report: SYNAPSE : Ransomware Technical Analysis - CYFIRMA

#Synapse #SynapseCrypter #Ransomware #RaaS #MalwareResearch #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM #ThreatIntelligence #CyberSecurity #CYFIRMA

https://www.cyfirma.com/

Critical Alert:  Organizations relying on Tinyproxy must act now!

CVE-2023-49606 poses a grave risk of remote code execution. With 1.6M+ servers potentially affected globally; swift action is imperative. Attackers exploit HTTP requests to trigger memory corruption, risking unauthorized access or service disruptions. Update Tinyproxy, monitor for anomalies, and implement access controls immediately. Proactive security is paramount. Protect your systems now to thwart exploitation.

Link to the Research Report: Tinyproxy (CVE-2023-49606) - Vulnerability Analysis and Exploitation - CYFIRMA

#CyberSecurity #VulnerabilityManagement #Tinyproxy #CVE202349606 #CYFIRMAResearch #VulnerabilitySummary #ExternalThreatLandscapeManagement #ETLM #Cyfirma

https://www.cyfirma.com/

Our latest report dives into the information stealer SamsStealer, a newly identified information stealer targeting Windows systems. This stealer is written in .NET, is designed to extract sensitive data stealthily from a variety of browsers and applications, including Chrome, Microsoft Edge, Discord, and cryptocurrency wallets. Once it has gathered the data, SamsStealer compresses it into a ZIP file and uploads it to a file-sharing service, sending the link to attackers via Telegram.

Our research team at CYFIRMA has analyzed SamsStealer’s execution flow, data exfiltration techniques, and targeted platforms. With its stealthy operation and extensive data theft capabilities, SamsStealer poses a significant threat to user privacy and security. This report is crucial for understanding the malware's behavior and implementing robust cybersecurity measures to protect against such evolving threats. 

Link to the Research Report: SamsStealer: Unveiling the Information Stealer Targeting Windows Systems - CYFIRMA

#Cybersecurity #MalwareAnalysis #SamsStealer #InfoStealer #CyberThreats #DataProtection #CYFIRMAResearch 

https://www.cyfirma.com/

India's Loksabha Elections 2024 hold immense significance, not only for the nation but also for the global democratic landscape. The scale and complexity of the electoral process make it susceptible to cyberattacks, especially with the proliferation of generative AI and deepfake technologies.

Link to the Research Report: The Indian Election : The Grandest Spectacle of Democracy under AI Threat - CYFIRMA

#Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM   #currentaffairs #GeneralElections #LokSabha #cyberattacks #generativeAI #deepfake 

https://www.cyfirma.com/

Stay informed about the latest developments in cybersecurity with CYFIRMA's April 2024 Ransomware Report. This edition highlights a shift in the ransomware landscape, with Hunter group now dominating while LockBit's influence declined. The manufacturing sector emerges as a prime target globally, with the USA, Canada, the UK, Germany, and Brazil experiencing significant impacts.

The report underscores the evolving tactics of ransomware groups, including rebranding efforts by HelloKitty and the launch of leak sites by C3RB3R. Additionally, emerging groups like SEXi, APT73, and DarkVault are gaining attention for their distinct tactics and choice of targets. Notable incidents include ransomware attacks on Hoya Corporation and Omni Hotels, as well as Akira's substantial earnings from victims.

It's crucial to remain vigilant against emerging cyber threats. Delve deeper into the full report to uncover actionable insights that can fortify your defenses and mitigate risks effectively.

Link to the Research Report: TRACKING RANSOMWARE : APRIL 2024 - CYFIRMA

#ThreatLandscape #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Hunters #Play #Lockbit #Akira #SEXi #DarkVault #APT73 #USA #UK #Manufacturing 

https://www.cyfirma.com/

CYFIRMA’s Research team embarked on a mission to uncover a targeted attack on Indian defense personnel via WhatsApp Messenger. Suspected to originate from Pakistan, the threat actor deployed malicious Android apps disguised as "MNS NH Contact" and "Posted out off," aiming to gain unauthorized access to sensitive information.

Our Investigation revealed the use of sophisticated social engineering tactics, with malicious apps designed to exploit vulnerabilities and evade detection. Notably, the attacker employed a Spynote Android remote administration tool or possibly a modified version known as 'Craxs Rat', showcasing their advanced evasion tactics.

This incident serves as a stark reminder of the ongoing cyber conflicts between nations and underscores the importance of robust cybersecurity measures. Stay informed, stay vigilant. 

 Link to Research Report: New Pakistan-based Cyber Espionage Group’s Year-Long Campaign Targeting Indian Defense Forces with Android Malware - CYFIRMA

#CyberSecurity #DigitalThreats #Geopolitics #maliciousAndroid #Indiandefense #socialengineering #espionage #cyberespionage #IndiaPakistan #threatintel #advancedpersistent #CYFIRMA #CyfirmaRsearch #ExteralThreatLandscapeManagement #ETLM

https://www.cyfirma.com/