CYFIRMA Research

The CYFIRMA team recently discovered a malicious Android package orchestrating a sophisticated extortion scheme. Masked as a loan app promising quick funds, unsuspecting users are duped into revealing sensitive information during the installation process. 

The deceptive app coerces victims into submitting KYC details, including a selfie, gradually acquiring a wealth of personal data. Once armed with a government ID, contact list, and text messages, threat actors manipulate selfies into compromising content. Subsequently, they exploit the situation, attempting extortion by threatening to distribute the manipulated images. Although the demanded amount is minimal, persistent messages and calls create pressure on victims to comply. CYFIRMA seized the #malicious package, during an ongoing incident, initiating social engineering to glean more insights into the threat actor. For comprehensive details, see our report. 

Link to the Research Report: Pakistan-based Threat Actor Targets Indians with Fake Loan Android Application - CYFIRMA

#CYFIRMA #Android #extortion #loanapp #socialengineering #Cybersecurity #ThreatDetection #StayProtected #ExternalThreatLandscapeManagement #ETLM #CyfirmaResearch 

https://www.cyfirma.com/

CYFIRMA’s Q4 2023 APT report focusses on APT groups from Iran, Russia, China, and North Korea, that brought forth a wave of dynamic and innovative cyber activities, challenging the global cyber security landscape.

Iranian actors targeted telecom, higher education, and tech sectors, showcasing updated techniques and new C2 frameworks in the backdrop of the Israel-Hamas conflict. Russian APTs targeted vulnerabilities in TeamCity, WinRAR, Outlook, and Roundcube, highlighting a sustained focus on #supplychainattacks. Chinese threat actors, VoltTyphoon and ToddyCat, focused on SOHO devices, utilizing advanced malware for data exfiltration. North Korean Lazarus Group demonstrated proficiency in diverse programming languages, exploiting vulnerabilities like Log4Shell and MagicLine4NX. These developments underscore the need for heightened cybersecurity vigilance and countermeasures against evolving APT strategies.

 Link to the Research Report: APT QUARTERLY HIGHLIGHTS : Q4 - 2023 - CYFIRMA

#CyberSecurity #APT #APTHighlights #Q4APTReport #ThreatIntelligence #Cybersecurity #Q42023Report #APTActivities #cyberthreats #externalthreatlandscape #AdvancedPersistentThreat #Iran #Russia #China #NorthKorea 

https://www.cyfirma.com/

Monster Cloud, an emerging player in the Russian stealer log threat landscape, has shifted from just offering stealer logs to a Malware-as-a-Service (MaaS) model.

Operating on Telegram, these threat actors have announced the release of their fully native proprietary information stealer. In this report, we dive into the operations of the Russian-speaking threat group, their history, and capabilities along with an overview on Monster Stealer.

Link to the Research Report: RUSSIAN STEALER LOG AGGREGATOR RELEASES FULLY NATIVE INFOSTEALER - CYFIRMA

https://www.cyfirma.com/

A critical vulnerability has been identified in Apache Struts 2, exposing a global threat to digital security. CYFIRMA Researchers have analysed this flaw, uncovering potential risks of unauthorized access and data breaches. It is advised to take immediate action - secure your systems with the latest Apache Struts 2 patches. Strengthen access controls, fortify your digital infrastructure, and remain vigilant. Stay informed about potential threats and regularly monitor trusted sources for updates to ensure robust cybersecurity.

Link to the Research Report: Apache Struts RCE (CVE-2023-50164)- Vulnerability Analysis and Exploitation - CYFIRMA

#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #CyberThreats #StaySecure #ApacheStruts2 #SecurityUpdates

https://www.cyfirma.com/

Taiwan’s election marks the first on the calendar in what will be the largest election year in history. Understanding how the onslaught of disinformation will impact the opinions of the Taiwanese public will be critical for Taiwan’s election, but the tactics and behaviors will likely be duplicated elsewhere, not only by the Chinese Communist Party but also by other actors. Based on previous experience and geopolitical trends, social media, further weaponized with artificial intelligence, will play an outsized and destructive role in these elections. 

Link to the Research Report: TAIWAN ELECTIONS REPORT - CYFIRMA

 #Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #psyops #informationoperations

https://www.cyfirma.com/

Dive into Cyfirma’s December 2023 Ransomware Report for an exploration of evolving cyber threats. The rise of new players like Hunters International, Dragon Force and WereWolves highlight a severe threat.   

With 75% more incidents in 2023 than in 2022, this report unveils critical insights into the escalating global cybersecurity threat. Covering key events during this period such as:  

• Akira hitting Nissan Australia
• Play targeting GRTC 
• LockBit strikes Xeinadin
• Rhysida infiltrating King Edward VII’s Hospital

Read the full report for a comprehensive understanding of the month's top 5 ransomware groups, Industries targeted, geography targeted, trend comparison, evolution in groups, and new players in the threat landscape. 

Link to the Research Report: TRACKING RANSOMWARE : DECEMBER 2023 - CYFIRMA

#RansomwareTrends #CybersecurityInsights #ThreatLandscape#StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Cyfirmaresearch #Lockbit #Manufacturing

https://www.cyfirma.com/

At Cyfirma, we are committed to providing up-to-date information on the most prevalent threats and tactics used by malicious actors to target both organizations and individuals. This comprehensive analysis delves into the dissemination of cryptocurrency miners through a YouTube channel. Examining the tactics employed, the report reveals a concerning trend of malicious actors leveraging popular video-sharing platforms to distribute mining threats. The study explores the various evasion techniques, employed by threat actors to avoid detection. Additionally, it sheds light on the processes for generating resilient malware payloads. Notably, the report underscores the adaptive nature of these threats, highlighting the need for heightened security measures and user awareness in mitigating such risks.

Link to the Research Report: Decoding the Cryptocurrency Malware Landscape: A Comprehensive Analysis of a Mining Threat Disseminated Through A YouTube Channel

#CyberSecurity #Cryptojacking  #Crypto-Miner #YouTube  #ETLM #ExternalThreatLandscapeManagement #Cyfirma #CyfirmaResearch

https://www.cyfirma.com/

This report provides a glimpse into the evolving landscape of RAT development and malicious activities performed by threat actors working under name of ‘Anonymous Arabic’. Our team investigated the Silver RAT (written in C sharp) which has capabilities to bypass anti-viruses and covertly launch hidden applications, browsers, keyloggers, and other malicious activities. The developers operate on multiple hacker forums and social media platforms, showcasing an active and sophisticated presence, in addition to a Telegram channel offering a range of services including the distribution of cracked RATs, leaked databases, carding activities, and the sale of social media bots, which are employed to promote services by automatically engaging with and commenting on user content.

Link to the Research Report: https://www.cyfirma.com/outofband/a-gamer-turned-malware-developer-diving-into-silverrat-and-its-syrian-roots/
 
#CyberSecurity #SilverRat  #malware  #ETLM #ExternalThreatLandscapeManagement #Cyfirma #CyfirmaResearch 

https://www.cyfirma.com/

Satellites now sit at the heart of geopolitical power, playing a pivotal role in warfare and strategy. SpaceX's Tranche 0 satellites for the U.S. military and Starlink's impact in Ukraine exemplify this shift. Yet, amidst the dazzle of rocket launches and mega constellations, a silent cyber battle is escalating.

This report explores the interconnected realms of SpaceX's advancements, the rise of satellite networks, and the looming threat of cyber warfare in space. The U.S. military faces a double-edged sword: capitalizing on technological leaps like Starlink's potential for military information fusion, while shielding against cyberattacks and electronic warfare.

Link to the Research Report: THE FUTURE OF COMMUNICATION: SATELLITE MEGA-CONSTELLATIONS - CYFIRMA

#CyberSecurity #Satellite  #communication  #ETLM #ExternalThreatLandscapeManagement #Cyfirma #CyfirmaResearch 

https://www.cyfirma.com/

CYFIRMA’s Research team has conducted a thorough analysis of the critical security vulnerability, CVE-2023-49103, in OwnCloud's Graph. Uncovered by ownCloud on November 21, 2023, this vulnerability is assigned a CVSS score of 7.5, underscoring its severity.

This flaw directly impacts OwnCloud/graphapi, posing a significant risk of unauthorized access to sensitive information! Our report provides valuable insights into the nature of the vulnerability, its potential impact, insights from underground forums and the critical importance of prompt mitigation.

Link to the Research Report: OwnCloud : CVE-2023-49103 Vulnerability Analysis and Exploitation - CYFIRMA

#CyberSecurity #OwnCloud #VulnerabilityAlert #StaySecure #CVE-2023-49103 #graphapi #ETLM #ExternalThreatLandscapeManagement #Cyfirma #CyfirmaResearch 

https://www.cyfirma.com/