CYFIRMA Research

Palo Alto Networks has uncovered CVE-2024-3400, a critical vulnerability exploited by threat actor 'UTA0218' in a sophisticated two-stage attack. This flaw allows unauthorized command execution on vulnerable PAN-OS devices via a backdoor mechanism.

Adding to the urgency, CISA has promptly listed CVE-2024-3400 in its Known Exploited Vulnerabilities catalogue. The risk of data breaches is high, with reports of sensitive data for sale on underground forums. Stay vigilant and safeguard
your digital assets! 

Link to the Research Report: Emerging Security Threats : Analysis of CVE-2024-3400 - CYFIRMA

#Cybersecurity #ThreatAlert #CVE20243400 #PatchNow #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

At CYFIRMA, we provide timely insights into prevalent threats and malicious tactics affecting organizations and individuals. Our research team have identified an open directory listing URLs containing highly obfuscated malicious Windows batch scripts in the wild, which executes a stealthy Monero (XMR) crypto miner as the final payload.

This payload is unfolded after 5 stages of unpacking, with capabilities such as Anti analysis /debugging, privilege escalation, defense evasion, stealth execution, file-less execution, and mining cryptocurrency. This malware has a very low to zero malicious reputation on known anti-malware tools.

Link to the Research Report: https://www.cyfirma.com/research/obfuscated-batch-scripts-journey-to-monero-mining/

#CYFIRMA #CyberSecurity #MinerMalware #MalwareAnalysis #CyfirmaResearch #ThreatIntelligence #ExternalThreatLandscapeManagement #ETLM #Monero #XMR #CryptoMiner #AMSIBypass

https://www.cyfirma.com/

Cyfirma research team discovered a new information stealer named Fletchen Stealer. It is a sophisticated information-stealing malware, offered by its creator as stealer-as-a-service for free that poses a significant threat to cybersecurity. A potent malware written in Rust which boasts advanced anti-analysis capabilities exhibits a high degree of resilience against detection and analysis. Its primary function is to steal sensitive data from compromised systems, including passwords, financial information, and cryptocurrency wallets. This malware is persistence-capable and uses scheduled tasks and auto-run registry entries to achieve this.

Link to the Research Report: https://www.cyfirma.com/research/fletchen-stealer-an-information-stealer-with-sophisticated-anti-analysis-measures/

#CYFIRMA #CyberSecurity #Fletchen Stealer #Malware-as-a-Service #MalwareAnalysis #CyfirmaResearch #ThreatIntelligence #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Our Q1 2024 APT Quarterly Highlights Report unveils a surge of dynamic and innovative cyber activities from APT groups from Iran, Russia, China, and North Korea, challenging the global cybersecurity landscape. 

Detailed analysis reveals escalating cyber threats, with Iranian groups like Homeland Justice and Mint Sandstorm targeting governmental and academic institutions, Russian actors such as APT29 focusing on high-value entities like Microsoft and German political parties, and Chinese APTs leveraging geopolitical tensions. Meanwhile, North Korean groups like Kimsuky and Lazarus Group enhance their espionage tactics. This highlights the urgent need for continuous vigilance, user education, and prompt software updates to bolster cybersecurity defenses.

Link to the Research Report: APT Quarterly Highlights : Q1 - 2024 - CYFIRMA

#CyberSecurity #APTHighlights #Q1APTReport #ThreatIntelligence #Cybersecurity #Q12024Report #APTActivities #cyberthreats #externalthreatlandscape #AdvancedPersistentThreat #Iran #Russia #China #NorthKorea #HomelandJustice #MintSandstorm #APT29 #ChineseAPTs #Kimsuky #Lazarus Group #ETLM #CYFIRMA #CYFIRMAResearch

https://www.cyfirma.com/

A shadow war between Israel and Iran is escalating, but despite unprecedented attacks, both sides are so far trying to keep the conflict below the level of an all-out-war. Israel has vowed to respond to Iran's unprecedented attack; however, the war cabinet seems to be divided over the issue of retaliation. Political considerations are increasingly opening the possibility of a large-scale cyber exchange between the two countries with a strong risk of spillover.

Link to the Research Report: The Shadow War between Israel and Iran Escalates - CYFIRMA

#Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #Israel #Iran #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

A critical vulnerability, CVE-2024-21894, has been discovered in Ivanti's Connect Secure and Policy Secure gateways, posing a severe global threat to digital security. CYFIRMA’s research team have conducted a thorough analysis of this vulnerability. Immediate action is strongly advised: apply the latest patches provided by Ivanti to secure your systems. Additionally, enhance access controls, bolster your digital infrastructure defenses, and maintain heightened vigilance. Stay informed about potential threats and continuously monitor trusted sources for updates to ensure robust cybersecurity.

Link to the Research Report: Ivanti RCE (CVE-2024-21894) Vulnerability Analysis and Exploitation - CYFIRMA

#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #CyberThreats #StaySecure #IvantiSecurity #SecurityUpdates #CVE202421894 #ConnectSecure #PolicySecure #ETLM #ExternalThreatLandscapeManagement #PolicySecureGateways

https://www.cyfirma.com/

The most important evolving threat to the electric grids is cyber threats and physical security. The power grid in the US and more so in Europe is experiencing a transformation, as the world shifts to sustainable energy, which entails increased reliance on offshore wind farms and undersea infrastructure that are going to supply large chunks of the sustainable power needed by the modern power-hungry economies of developed nations.

Link to the Research Report: Threat to Offshore Infrastructure in a Maritime-Centric Century - CYFIRMA
 
#Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #ExternalThreatLandscapeManagement #Offshore

https://www.cyfirma.com/

Stay ahead of cybersecurity trends with CYFIRMA's March 2024 Ransomware Report. Lockbit, despite a decline in infections, continues to dominate. The manufacturing sector is a primary target across the globe. Notably, the USA remains a primary victim, trailed by Canada, the UK, Germany, and Spain.

Witness the evolution of ransomware tactics as groups like RA World expand their global reach, while StopCrypt evolves to evade detection. GhostLocker 2.0 emerges with enhanced encryption, and Qilin advances with a Rust-based variant targeting VMware servers.

New threats surface with Donex encrypting data and Kill Security listing fresh victims. March’s key events include Qilin's strike on The Big Issue, INC Ransom targeting NHS Scotland, Rhysida hitting Lurie Children's Hospital, and Nissan's battle with Akira ransomware.

Stay vigilant against emerging cyber threats. Read the full report for actionable insights to bolster your defenses.

Link to the Research Report: CYFIRMA Research : Tracking Ransomware MARCH-2024 - CYFIRMA

#ThreatLandscape#StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #CYFIRMA #ETLM #lockbit #Play #BlackBasta #Donex #KillSecurity #USA #Manufacturing #CYFIRMAResearch #ExternalThreatLandscapeManagement #StayProtected

https://www.cyfirma.com/

Cyfirma’s latest research uncovers a sophisticated cyber threat targeting individuals in South Asia. Our research team identified a malicious campaign involving a deceptive SFX archive executable. These files, embedded in the malicious binary and decoy PDF, are part of a multifaceted attack aimed at infiltrating systems and executing malicious actions. Further analysis hints at collaboration with Russian cybercriminals, raising concerns about C2 infrastructure targeting individuals in South Asia.

Stay informed with our detailed report shedding light on the tactics and techniques employed by threat actors. Arm yourself with knowledge to defend against the ever-evolving cyber landscape.

Link to the Research Report: New Campaign Identified Targeting Individuals in South Asia - CYFIRMA

#CyberSecurity #ThreatIntelligence #MalwareResearch #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM #Cyfirma #CyfirmaResearch 

https://www.cyfirma.com/

Our latest report sheds light on CVE-2024-27198, a severe vulnerability that has been exploited for unauthorized admin access and privilege escalation in JetBrains TeamCity, marked by CISA on March 7, 2024, as a significant threat. This breach has led to Jasmin ransomware attacks and unauthorized user setups, linked to the BianLian and Jasmin families. The Shadowserver Foundation's dashboard reports nearly 500 devices are still at risk, with our investigations uncovering 241 publicly accessible, vulnerable instances. The engagement of North Korean group Kimsuki and others in exploiting this vulnerability underscores the pressing need for comprehensive security measures and awareness among cybersecurity communities.

Link to the Research Report: Vulnerability Analysis and Exploitation : Understanding CVE-2024-27198 in JetBrains TeamCity - CYFIRMA

#JetBrains #TeamCity #CVE-2024-27198 #CyberSecurity #CYFIRMA #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/