CYFIRMA Research

Dive into the November 2023 Ransomware Report by CYFIRMA for a deep dive into evolving cyber threats. LockBit dominates with 108 victims. With a 25% surge in attacks on Manufacturing and a 78.3% rise in FMCG incidents, the need for defences is evident. Geographically, the USA remains a prime target, experiencing a 45.72% share of attacks. Explore the developments in ransomware like DJVU, Phobos and Cerber.  GhostSec came up with GhostLocker, CVE-2023-4966 and other vulnerabilities were exploited by LockBit, Cl0p and other groups. 

There was an increase of approximately 18.21% in ransomware victims from October to November 2023. Stay vigilant and informed against emerging threats. 

Link to the Research Report: TRACKING RANSOMWARE : NOVEMBER 2023 - CYFIRMA

#RansomwareTrends #CybersecurityInsights #ThreatLandscape #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Cyfirmaresearch #clop #DigitalSecurity #Manufacturing 

https://www.cyfirma.com/

This report explores a sophisticated cyber threat orchestrated by the Sidewinder APT group. Targeting Nepalese government officials, this advanced threat involves a malicious Word document wielding a stealthy Nim backdoor. Unraveling the attack chain reveals a symphony of tactics, including VB scripts, BAT scripts, and a deceptive payload camouflaged as communications from the Nepalese Prime Minister's Office. 

 The Sidewinder group, with a history dating back to 2012, operates across South Asia. Our research report delves into the attack chain, highlighting evasion techniques and proactive defense measures.

Link to the Research Report: From Macro to Payload: Decrypting the Sidewinder Cyber Intrusion Tactics - CYFIRMA

#CyfirmaResearch #Cyfirma #SidewinderAPT #ThreatIntelligence #NimBackdoor #Nepalesegovernment #VBscripts #BATscripts #deceptivepayload #ETLM #ExternalThreatlandscapeManagement 

https://www.cyfirma.com/

A critical vulnerability, CVE-2023-46747, has surfaced in the F5 BIG-IP Traffic Management User Interface (TMUI), posing a significant global threat to organizations. This flaw enables unauthorized remote code execution, potentially compromising digital assets. CYFIRMA’s Research team has conducted an extensive analysis of this security flaw.

Take Immediate Action! Ensure your systems are shielded with the latest F5 patches. Strengthen access controls and maintain vigilant monitoring of your digital infrastructure. 

Link to the Research Report: F5 BIG-IP Remote Code Execution - CVE-2023-46747 - Vulnerability Analysis and Exploitation - CYFIRMA

#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #CyberThreats #StaySecure #F5BIGIP #SecurityUpdate #TrafficManagementUserInterface #TMUI #RemoteCodeExecution #CVE-2023-46747 #DigitalInfrastructure

https://www.cyfirma.com/

The world has witnessed an unprecedented surge in conflicts over the past two years, surpassing any period since the end of World War II. Amidst a fracturing world order and the waning Pax Americana, simmering tensions threaten to erupt suddenly, or at the very least, escalate into major crises with significant cyber repercussions. 

 Link to the Research Report: THE END OF PAX AMERICANA - CYFIRMA

#Geopolitics #Cyfirmaresearch #ThreatIntelligence #Cybersecurity #ETLM #CurrentAffairs #PaxAmericana 

https://www.cyfirma.com/

At Cyfirma, we are committed to providing up-to-date information on the prevalent threats and tactics used by malicious actors. Our latest report delves into DanaBot Stealer and presents a comprehensive overview of its functionality and capabilities.

DanaBot is a stealthy, multi-stage and versatile malware that infiltrates computers to steal valuable information for monetization, operates discreetly, prioritizing long-term persistence and the theft of sensitive data. DanaBot is offered as malware-as-a-service (MaaS) and allows cybercriminals to customize it for their specific targets. 

It has been employed in various attacks such as credential theft, financial fraud, and distributed-denial-of-service (DDoS) attacks. It has reemerged as a significant email-based threat that shifts towards prioritizing "quality over quantity" that highlights the increasing sophistication of cyberattacks. To evade detection over extended periods, threat actor consistently modifies the techniques, employing different sources for payload delivery at each stage. This approach ensures the malware remains adaptable and provides ease of control over infected systems.

Link to the Research Report: DanaBot Stealer : A Multistage MaaS Malware Re-emerges with Reduced Detectability - CYFIRMA

#CyberSecurity #MalwareAnalysis #DanaBot #Stealer #Cyfirmaresearch #ThreatIntelligence #ETLM

https://www.cyfirma.com/

Cyfirma’s latest report concerning a new malware, Nova, being offered by MaaSoperators Sordeal who have been actively distributing it since early 2023. This information stealer exhibits advanced capabilities, leveraging sophisticated techniques for anti-forensics and defense evasion.

Nova targets most of the commonly used browsers, exfiltrating autofills, bookmarks, payment cards, cookies, download lists, history and passwords. We have observed heightened activity by Sordeal since September 2023. Recent developments highlight alarming upcoming features, including Discord hijacking, credit card theft, and crypto wallet injection. Security measures should prioritize detection similar evolving tactics to safeguard against such threats.

Link to the Research Report: Emerging MaaS Operator Sordeal Releases Nova Infostealer - CYFIRMA

#etlm #cyberintelligence #cybersecurity #infostealer #informationstealer #Cyfirmaresearch #malvertising #Malicord

https://www.cyfirma.com/

Amidst the conflicts in Ukraine and Gaza, little attention has been paid to China’s ongoing coercion in the South China Sea. Yet Beijing and Manila are in the midst of an increasingly tense standoff over Second Thomas Shoal, which could easily escalate into a major crisis or even a conflict with cyber fallout.

Link to the Research Report: WITH THE WORLD DISTRACTED, CHINA STIRS TROUBLE IN THE ASIA PACIFIC - CYFIRMA

 #Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MustangPanda #BronzePresident #VoltTyphoon #Fiveeyes

https://www.cyfirma.com/

Explore the October 2023 Ransomware Report from CYFIRMA, uncovering the ever-changing landscape of cyber threats. LockBit leads the charge with 66 victims. Manufacturing takes a hit with 64 incidents, stressing the need for specific defences.

The USA is a prime target, enduring 151 ransomware incidents, and now, a new player, Hunters International, adds a twist to the cybersecurity plot. While there's a 33.34% drop in victims from September, the battle against ransomware continues.

Geographically, the report highlights the USA, bearing 43.64% of attacks, showing a deliberate focus on nations with advanced technology. See the evolution of BlackCat's 'Munchkin' tool, a sign of ransomware getting more advanced.

 
Despite fewer victims, the threat remains dynamic. Stay alert and prepared for new tactics and emerging threats. For a closer look at the world of cybersecurity, check out the full report.

Link to the Research Report: TRACKING RANSOMWARE: OCTOBER 2023 - CYFIRMA

#RansomwareTrends #CybersecurityInsights #ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Cyfirmaresearch #HuntersInternational #MunchkinTool #DigitalSecurity #LockbitRansomware

https://www.cyfirma.com/

A critical vulnerability found in Citrix ADC/Gateway poses a severe threat to digital security. This flaw facilitates unauthorized access and potential data breaches, raising concerns globally. CYFIRMA researchers have done an in-depth analysis of this vulnerability.

Immediate action needed! Secure your systems with the latest patches from Citrix. Strengthen access controls and maintain constant vigilance over your digital infrastructure.  Stay wary of potential threats and regularly monitor trusted sources for updates.

Link to the Research Report: Citrix Bleed: CVE-2023-4966 Vulnerability Analysis and Exploitation - CYFIRMA

#CYFIRMA #CYFIRMAResearch #CyberSecurity #VulnerabilityAlert #DataProtection #CyberThreats #StaySecure #CitrixADC #SecurityUpdates #CVE-2023-4966

https://www.cyfirma.com/

Cybercriminals are exploiting vulnerabilities in major platforms, including Windows,  JetBrains, MicrosoftStreamingServiceProxy, and Ubuntu kernels.

These exploits are being actively traded on darkwebforums, posing a serious risk of ransomwareattacks and remote system control. For example, the MOVEit vulnerability alone exposed millions of people to cyber threats.

Threatactors such as Cl0p and LockBit are exploiting these vulnerabilities, escalating the risk to industries worldwide. In the face of this growingcyberthreats, it is crucial to patchvulnerabilities promptly, install updates regularly, and monitor for threats vigilantly.

Organizations must implement robust cybersecurity measures to mitigate these evolvingthreats. 

Link to the Research Report: CRITICAL EXPLOITS FOR SALE ON THE DARK WEB - CYFIRMA

#CyberSecurity 

https://www.cyfirma.com/