CYFIRMA Research

CYFIRMA’s research team has discovered a new Remote Access Trojan named Xeno-RAT, featuring sophisticated capabilities. Through comprehensive analysis, our report explores the various evasion techniques utilized by threat actors to circumvent detection, as well as elucidates the methods employed in creating robust malware payloads.

Xeno RAT, a potent malware written in C# with advanced capabilities, demonstrates an alarming trend as it continuously evolves to enhance its features. It exploits the DLL search order functionality in Windows to load malicious DLLs into trusted executable processes and employs process injection to inject malicious code into legitimate Windows processes. Employing a multi-stage infection process, it meticulously avoids detection by scrutinizing for debuggers, monitoring tools, and analysis software before executing its final stage. Equipped with anti-debugging techniques, it operates stealthily and ensures persistence by adding itself to scheduled tasks. Continuously monitoring compromised systems, it communicates with command-and-control servers for status updates and instructions at regular intervals. Extensive obfuscation techniques are utilized both within files/code and in network traffic to effectively evade detection.

To mitigate the risks associated with Xeno RAT malware, users are advised to exercise caution when accessing files from untrustworthy sources or clicking on unfamiliar links. Implementing robust cybersecurity measures, including reputable antivirus software, regular software updates, and awareness of social engineering tactics, is crucial in fortifying protection against such threats.

Link to the Research Report: Xeno RAT: A New Remote Access Trojan with Advance Capabilities - CYFIRMA

#Cyfirma #CyberSecurity #ThreatIntelligence #Xeno-RAT #InfoSec #MalwareAnalysis #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM #Malware 

https://www.cyfirma.com/

The recent acceleration in hostilities involving Iran-backed militias and the United States, coupled with a surge in Israeli strikes on Iranian positions in Syria, seems to have compelled Tehran to reassess elements of its regional strategy. These regional escalations come at an inopportune time for Iran. This report assesses the current situation in the Middle East, including Iran’s current posture and provides an assessment that Iran will diminish its overt military footprint and focus more on activity in Cyberspace.

Link to the Research Report: IRAN CONTRIBUTES TO THE ESCALATING GEO-POLITICAL THREAT LANDSCAPE - CYFIRMA

#Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs MuddyWater, #CottonSandstorm #Static Kitten #Syria #RedSea #MiddleEast #Cyfirma #Iran #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Urgent Security Advisory! A critical vulnerability, CVE-2024-23897, has surfaced in Jenkins, posing a global threat to digital security. CYFIRMA researchers have conducted an in-depth analysis and exploitation, Immediate action is advised - secure your systems with the latest Jenkins patches. Strengthen access controls, fortify your digital infrastructure, and remain vigilant. Stay informed about potential threats and regularly monitor trusted sources for updates to ensure robust cybersecurity.

Link to the Research Report: Jenkins (CVE-2024-23897) - Vulnerability Analysis and Exploitation - CYFIRMA

#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #CyberThreats #StaySecure #JenkinsSecurity #SecurityUpdates #CVE-2024-23897 #Jenkins #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Our latest report talks about the XSSLite Stealer; an infostealer born from a malware development competition on a Russian hacking forum. This infostealer comes with anti-sandbox & anti-debugging capabilities, in addition to a web panel's source code to receive the stealer logs from compromised victims.

 A hefty prize pool of tens of thousands of USD shows just how much these administrators earn by running the cybercriminal forum. Such competitions attract a larger audience, fostering increased participation and engagement from malware developers and black hats across the globe. This comradeship can lead to more sustained and meaningful interactions, contributing to the overall health of the forum. With another month to go, we expect the number of malwares seen in the competition to experience a steep rise, likely resulting in increased campaigns by threat actors using those respective tools.

Link to the Research Report: Malware Development Competition Fuels Creation of 20+ Malware - CYFIRMA

#Infostealer #Malware #CyfirmaResearch #Cyfirma #ExternalThreatLandscapeManagement #ETLM #Cybersecurity

https://www.cyfirma.com/

Uncover the latest trends in the cybersecurity landscape with CYFIRMA's January 2024 Monthly Ransomware Report. LockBit takes the lead with 64 victims, targeting diverse industries, notably Manufacturing. Despite a 20.51% dip in incidents from December 2023, the long-term trend indicates a persistent rise in ransomware threats. New players like Slug, Going Insane, and Kasseika bring fresh challenges to the forefront.

In January, the USA faced 140 ransomware incidents, emphasizing the importance of robust cybersecurity. Notable events include Akira's attack on a major IT firm and Blackcat impacting Fidelity National Financial. The report also uncovers the relationship between 3AM and other groups.

Link to the Research Report: TRACKING RANSOMWARE : January 2024 - CYFIRMA

#CyberSecurity #RansomwareThreats #CyberRisk #CyberIntelligence #SecurityInsights#CybersecurityInsights #ThreatLandscape#StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Cyfirmaresearch #Lockbit #DigitalSecurity #LockbitRansomware #3AM #Akira #Manufacturing #CYFIRMA #Slug, #GoingInsane #Kasseika #Blackcat #FidelityNationalFinancial

https://www.cyfirma.com/

In times of conflict, the cyber realm becomes a battleground too! Instances like the Russia-Ukraine war & Israel-Gaza conflict show how hacktivists are playing a role. They launch attacks using DDoS tools, deface websites, and even mentor others to disrupt organizations. In the ongoing Israel-Palestine conflict, hackers are wreaking havoc online too. They're creating custom tools, sharing tutorials on Telegram & GitHub, and targeting countries opposing their agenda. These attacks aren't always sophisticated and mostly target small businesses lacking cybersecurity measures. But they can still cause disruptions. It's a wake-up call for stronger cybersecurity, especially in times of global tension.

Link to the Research Report: Caught in the Crossfire : How International Relationships Generate Cyber Threats - CYFIRMA

#cybersecurity #CyfirmaResearch #Cyfirma #Russia-Ukraine #Israel-Gaza #ExternalThreatLandscapeManagement #ETLM #Glorysec #AnonymousCollective #CyberAv3ngers #Kromsec #Turkhackteam

https://www.cyfirma.com/

CYFIRMA’s research team, reveals a critical OS command injection vulnerability (CVE-2024-21833) affecting TP-Link Routers, demanding immediate attention. With a high CVSS score of 8.8, this flaw poses a significant risk, attracting state-sponsored entities and threat groups. Active exploitation is observed, emphasizing the need for prompt patching, proactive monitoring, and collaboration within the cybersecurity community. Organizations using TP-Link devices are urged to update firmware, strengthen passwords, and optimize configurations to fortify defenses against potential exploits. Stay vigilant to safeguard network infrastructure and prevent unauthorized access.

Link to the Research Report: Comprehensive Analysis of CVE-2024-21833 Vulnerability in TP-Link Routers : Threat Landscape, Exploitation Risks, and Mitigation Strategies - CYFIRMA

#Cybersecurity #ThreatAlert #CVE2024-21833 #CyfirmaResearch #Cyfirma #ExternalThreatLandscapeManagement ETLM #TP-LinkRouters

https://www.cyfirma.com/

The CYFIRMA research team reveals a Russian-origin Drainer-as-a-Service (DaaS) project gaining traction in the hacking community. This crypto drainer targets wallets on Ethereum, BNB, Polygon, etc with a massive affiliate network of 10k members. 

Our investigation reveals how the threat actors are creating phishing infrastructure at no cost, subsequently using compromised Twitter accounts to launch crypto phishing campaigns - making it a situation where the risk is low, the skill level required is minimal, but the potential rewards are high.

 Link to the Research Report: Russian Threat Actors Abuse Cloudflare and Freenom Services to run DaaS Program - CYFIRMA

#CYFIRMAresearch #CYFIRMA #DrainerasaService #DaaS # Ethereum #BNB #Polygon #phishing #Metamask #TrustWallet #Coinbase #WalletConnect #MyEtherWallet #Trezor #LedgerNano #ExternalThreatLandscapeManagement #ETLM #Cryptodrainer

https://www.cyfirma.com/

The geopolitical landscape in 2024 is at a critical juncture! As we begin the year, explore five key events may shape the course of global affairs and have profound effect on the Cyber Threat Landscape through this Cyfirma blog! Covering the below key events:  

·       World Goes to the Polls: Over four billion people in nearly 80 countries will participate in elections, with Taiwan's recent election raising tensions in the Taiwan Strait.

·       Stalemate in Ukraine: The conflict between Russia and Ukraine remains in an attritional phase, with cyber warfare becoming a pivotal element in the ongoing struggle.

·       Globalization Retreats: The fragility of the global trading system intensifies, driven by tensions over Chinese overproduction and investment, potentially leading to a resurgence of trade wars.

·       China's Economic Crossroads: China faces challenges including over-indebtedness, demographic concerns, and global pushback against its economic strategies, with cyber espionage posing a significant threat.

·       Middle East Suspended: Ongoing conflicts in the Middle East, especially the Israel-Hamas situation, raise concerns about cyber activities and potential wider hostilities involving Iran and its proxies.

The decisions made in the coming days and months will have profound consequences, shaping the course of history. Remain Informed and engaged in understanding the evolving dynamics. 

Link to the Research Report: LOOKING INTO THE CRYSTAL BALL : WHAT WILL 2024 BRING IN GEOPOLITICS - CYFIRMA

#Cyfirma #CyfirmaResearch #GlobalAffairs #Geopolitics2024 #Cyberfallout #IsraelGaza #Taiwan #RussiaUkraineWar #SupplyChain #China #Election #Trump #Biden 

https://www.cyfirma.com/

“CYFIRMA’ s research team has identified a new stealer in the wild called “Rage Stealer”. Rage Stealer employs a multifaceted approach, covertly extracting sensitive data encompassing browsers, cryptocurrency wallets, files, credentials, and various applications data. What sets "Rage Stealer" apart is its systematic organization of extracted information into specific directories, ensuring a streamlined process. The malware's ingenious technique lies in its adeptness at compressing and archiving data, and discreetly exfiltrates via the Telegram.

The malware promoted under the moniker "xStealer" on a dedicated Telegram channel and the promoter also engages with users on channel, and even offering a builder service at a cost. The evolving landscape of cyber threats is underscored by the adaptability and rebranding efforts observed in this malicious tool, also known as "Priv8 Stealer." As organizations grapple with the burgeoning market for info stealers, the imperative for robust cybersecurity measures and proactive defenses against these ever-adapting tools becomes even more critical. Stay vigilant, stay secure.

Link to the Research Report: From Screen Captures to Crypto wallets: Analyzing the Multi-Faceted Threat of Rage Stealer - CYFIRMA

#Cyfirma #CyberSecurity #ThreatIntelligence #RageStealer #InfoSec #MalwareAnalysis #CyfirmaResearch #ExternalThreatLandscapeManagement #ETLM #ProtonVPN #OpenVPN #NordVPN #MineCraft #xStealer 

https://www.cyfirma.com/