CYFIRMA Research

A new concern is beginning to surface as part of the instability in the vital Red Sea shipping corridor: the Houthis or other threat actors may target the numerous subsea cables that transport almost all of the data and financial communications between Europe and Asia. In our blog, we highlight how subsea infrastructure is vulnerable to attack and how important the infrastructure is in the context of global #security.

 Link to the Research Report: THREAT TO UNDERSEA INFRASTRUCTURE - CYFIRMA

#Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #Houthis #ExternalThreatLandscapeManagement #Cyfirma #subsea

https://www.cyfirma.com/

Cyfirma research team discovered a new document stealer Sync-Scheduler, a potent malware written in C++ boasting defense evasion and anti-analysis capabilities. It is being distributed as an embedded component in the Office document file. Malware code is hidden under the page title of the first slide of the PowerPoint presentation and file-nesting is used to hide the PowerPoint presentation in the Word document as an embedded component.

 Link to the Research Report: https://www.cyfirma.com/research/sync-scheduler-a-dedicated-document-stealer/

#CYFIRMA #CYFIRMAResearch #CyberSecurity #MalwareAlert #DataProtection #CyberThreats #StaySecure #SecurityUpdates #Stealer #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

A critical vulnerability, CVE-2024-21762, has been identified in Fortinet's FortiOS/FortiProxy, posing a severe global threat to digital security. CYFIRMA researchers have conducted an exhaustive analysis of the vulnerability. Immediate action is strongly advised. Apply the latest patches provided by Fortinet to secure your systems. Enhance access controls, bolster your digital infrastructure defenses, and maintain heightened vigilance. Stay informed about potential threats and continuously monitor trusted sources for updates to ensure robust cybersecurity.

 Link to the Research Report: FortiOS/FortiProxy (CVE-2024-21762)- Vulnerability Analysis and Exploitation - CYFIRMA

#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #CyberThreats #StaySecure #FortinetSecurity #SecurityUpdates #CVE-2024-21762 #FortiOS #FortiProxy #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

An individual, formerly known for defacing websites, has transitioned to selling a Discord stealer called Nikki Stealer, developed using the Electron framework. 

With a moderate level of confidence, we assess the developer is from either Brazil or Portugal. This individual has a history of website defacement and is now engaged in selling this stealer.

The recent advancements in Nikki Stealer v9 underscore the rapid pace of its development. Through analysis of the chat logs within the Nikki Stealer Discord server, users are observed providing feedback on its low detection rate. Furthermore, the developer of the stealer is seen openly discussing drug use in the chat. Notably, similarities have been observed between Fewer Stealer and Nikki Stealer.

Link to the Research Report: NIKKI STEALER: EX-DEFACER TURNS SELLER OF DISCORD STEALER - CYFIRMA

#NikkiStealer #FewerStealer #CyfirmaResearch #Cyfirma #Malware #DiscordStealer #ExternalThreatLandscapeManagement #ETLM 

https://www.cyfirma.com/

The CYFIRMA Research team embarked on an investigation to uncover activities linked to the banned organization Islamic State. We aimed to gain access to the group or identify individuals endorsing its ideology. During our investigation we infiltrated a Telegram channel promoting Islamic State’s beliefs, which was also part of a private RocketChat server exclusively used by ISIS.

Additionally, we uncovered a donation program operating through a Telegram channel, the "WhispersOfTheForgotten". Our team engaged with the admin of the channel to in order to understand their intentions and the true purpose behind the donation program.

Link to the Research Report: Islamic State's Telegram Hustle: How a Terrorist Organization Raises Funds - CYFIRMA 

#CounterTerrorism #IslamicState #TechHaven #CYFIRMA #RocketChat #Telegram #ISIS #stopterrorism #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay informed on the evolving cybersecurity landscape with CYFIRMA's February 2024 Monthly Ransomware Report. LockBit leads the charts despite a takedown by law enforcement, showcasing resilience and technical prowess. Manufacturing takes the hit, recording a 40% rise in attacks. The USA remains a prime target, followed by the UK, Canada, France, and Spain.

The evolution of ransomware tactics becomes apparent as LockBit aggressively returns, and RansomHouse introduces 'MrAgent' for automated attacks.

Emerging threats include Alpha's sophistication and the mysterious Blackout group.

February witnessed significant events: Knight ransomware's source code for sale, Hyundai Motor hit by Black Basta, and warnings on BlackCat's healthcare attacks. Arrests of SugarLocker members highlight the urgent need for enhanced cybersecurity measures. Stay protected, stay informed. Fortify your defenses against evolving cyber threats.

Link to the Research Report: TRACKING RANSOMWARE February 2024 - CYFIRMA

#Cybersecurity #RansomwareReport #SecurityInsights#CybersecurityInsights #ThreatLandscape#StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #lockbit #RansomHouse #BlackBasta #Alpha#Blackout #Alphv #Blackcat #Knight #USA #Manufacturing #CyfirmaResearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

The CYFIRMA research team has uncovered a new and highly destructive malware, WinDestroyer. It lacks ransom demands, is geopolitically motivated, and is developed for hacktivism against the backdrop of the Russia-Ukraine conflict. The malware employs DLL reload attacks, API hammering, and lateral movement capabilities, rendering systems unusable. During our investigation, we have been able to attribute WinDestroyer to a threat actor residing in Saint Petersburg, Russia.

Link to the Research Report: A Ransomware That Doesn't Extort Money WinDestroyer & Its Origin - CYFIRMA

#Cybersecurity #ThreatIntelligence #Ransomware #ETLM 

https://www.cyfirma.com/

Our latest cyber threat research at Cyfirma reveals a complex stego-campaign, showcasing a malicious .docx file that's raising serious concerns in the cybersecurity landscape. Our dedicated team unearthed a sophisticated attack chain that employs template injection, effectively bypassing conventional email security measures.

The malicious .docx file, distributed possibly through phishing emails, sets off a multi-stage attack upon opening. The attack involves the deployment of the Remcos Remote Access Trojan (RAT) and the notorious Agent Tesla malware, each with its set of malicious functionalities. Notably, the document, seemingly benign on the surface, contains a targeted approach, hinting at a potential focus on Taiwan.

 Our research dives deep into the sophisticated process, unraveling the use of Visual Basic and PowerShell scripts, legitimate binaries like "RegAsm" and "WinRm," and the exploitation of the Equation Editor Vulnerability (CVE-2017-11882). The attack showcases a high level of sophistication, utilizing Living Off the Land Binary (LoLBin) binaries to accomplish malicious objectives.

As we consistently monitor emerging threats, our team unveiled similar samples with a common upload date, indicating a coordinated effort rather than random activity. This underlines the possibility of a purposeful campaign orchestrated by threat actors.

 Our commitment at Cyfirma is to anticipate and scrutinize evolving cyber threats, providing insights to fortify the cybersecurity landscape. The detailed report sheds light on the entire attack chain, emphasizing the need for proactive measures against such advanced threats.

Link to the Research Report: Exploiting Document Templates: Stego-Campaign Deploying Remcos RAT and Agent Tesla - CYFIRMA

#CyberThreat #MalwareResearch #StegoCampaign #CyberSecurity #ThreatIntelligence #CyfirmaInsights #Remcos RAT #AgentTesla #Malicious.docx #CyfirmaResearch #Cyfirma #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Dive into the cybersecurity storm as ScreenConnect vulnerabilities (CVE-2024-1709 & CVE-2024-1708) open the door to a looming LockBit ransomware threat. With over 95,311 instances at risk, organizations worldwide must act swiftly. Discover the nuances of this critical connection. 

Link to the Research Report: The ScreenConnect Saga: A Deep Dive into the LockBit Connection - CYFIRMA

#ScreenConnectSaga #LockBitConnection #CybersecurityDeepDive #StaySecure #CyfirmaResearch #Cyfirma #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Read our Cyfirma Research report, which explores why Ivanti Connect Secure & Policy Secure users, should be cautious of a critical SSRF vulnerability (CVE-2024-21893) which affects your systems, enabling attackers to bypass mitigations and execute remote code. Exploits, like CVE-2023-46805 & CVE-2024-21887, demonstrate the severity.

Ivanti has released a second mitigation and patches to address all vulnerabilities. Ensure your systems are up to date and protected against these threats. Stay vigilant and take action to safeguard your network.

Link to the Research Report: Exploit Analysis: SSRF and Command Injection for Unauthenticated RCE in Ivanti Connect Secure - CYFIRMA

#CyberSecurity #Vulnerability #Ivanti #SSRF #PatchNow # CVE-2023-46805 #CVE-2024-21887 #CVE-2024-21893 #IvantiConnectSecure #CyfirmaResearch #Cyfirma #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/