CYFIRMA Research

The current flareup in the Middle East is taking place in a complex tapestry of relations in the region that can be described as a hotbed of geopolitics, where – despite the superficial media image – politics always takes primacy over religion.

To understand the situation better and to learn why there is a cyber arms race going on in the region, read our comprehensive CYFIRMA research report.

Link to the Research Report: MIDDLE EAST : A CYBER ARMS RACE - CYFIRMA

#Geopolitics #Cyfirmaresearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs

https://www.cyfirma.com/

Our latest report unveils the pulse of cyber security threats in the Philippines!

From the escalating risk of state sponsored espionage by global actors like China, North Korea, and Russia to the surge in ransomware attacks targeting key industries, including finance, government, healthcare, education, and retail, the nation is at a crossroads.

Recent incidents, such as the widespread data breach in September 2023 affecting Phil Health, in April 2023 the Philippine National Police and the illicit sale of stolen Data on the Russian market, underscores the urgency for heightened cybersecurity measures.

With Earth Estries and FamousSparrow actively engaging in cyber espionage, the report serves as a clear call, emphasizing the imperative for strengthened digital defenses and strategic preparedness in the face of imminent risks.

Link to the Research Report: PHILIPPINES THREAT OVERVIEW - CYFIRMA

#Cybersecurity #CybersecurityPhilippines #threatOverview #cyberthreats #philippines #ThreatIntelligence #externalthreatlandscape #EarthEstries #FamousSparrow

https://www.cyfirma.com/

September’s North Korea – Russia summit stoked fears that there could be increased weapons and technology transfers between the two nations, hostile to the West and its partners in Asia, with North Korea providing Russia with munitions for its war in Ukraine, in exchange for sensitive nuclear, missile and cyber knowhow.

Both regimes have much to gain from each other at this particular geopolitical moment and the summit can have impacts in cyberspace.

Link to the Research Report: NORTH KOREA–RUSSIA SUMMIT: A NEW ALLIANCE IN CYBERSPACE? - CYFIRMA

#Geopolitics #Cyfirmaresearch #ThreatIntelligence #UkraineWar #cybersecurity #ETLM #currentaffiars 

https://www.cyfirma.com/

Stay ahead of ransomware threats with our September 2023 Ransomware Report, which provides essential insights into the evolving landscape.

The latest monthly report from CYFIRMA reveals a dynamic threat landscape marked by widespread ransomware attacks that have had a significant impact on critical industries worldwide. The 'LockBit' group has taken the lead, targeting 79 victims, while the Manufacturing sector has borne the highest toll with 80 incidents. The United States is the hardest hit, experiencing 237 attacks, which highlights the relentless pursuit of high-value targets.

Notable incidents, such as the breach at MGM Resorts and the Cl0p attack on BORN, underscore the gravity of the situation. Meanwhile, emerging players '3AM', 'LostTrust', and 'CryptBB' are introducing new dimensions of threat.

In the face of this escalating digital battleground, industries must come together to collectively combat this persistent menace.

Link to the Research Report: TRACKING RANSOMWARE - SEPTEMBER 2023 - CYFIRMA


#RansomwareTrends #CybersecurityInsights #ThreatLandscape #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #ETLM #Cyfirmaresearch

https://www.cyfirma.com/

Learn about the experience of a ransomware operator in their own words!
 
CYFIRMA Research recently published a report on a new threat actor group known as Fusion Core. In a follow-up, we were able to get in touch with “NecroSys”, who is the developer of SarinLocker ransomware and the current face of FusionCore.

Read what NecroSys has to say about FusionCore's alleged links with APTgroups, their malware arsenal and what's on the horizon for them.

Link to the Research Report: CYFIRMA RESEARCH - CHIT-CHAT WITH A RANSOMWARE OPERATOR - CYFIRMA

#externalthreatlandscape #cyberposturemanagement #cybersecurity #CyberThreats

https://www.cyfirma.com/

CYFIRMA Research's latest report unveils "The-Murk-Stealer," an open-source threat that covertly extracts a wide array of information designed to infiltrate systems and harvest sensitive data. From gaming files to cryptocurrency wallet details, this malware operates stealthily, underlining the importance of heightened vigilance and advanced cybersecurity strategies.
 
Furthermore, our analysis sheds light on the disconcerting trend of malicious tools masquerading as educational resources on platforms like GitHub. Despite assertions of innocent purpose, these tools are swiftly embraced by malicious actors, underscoring the urgent necessity for reinforced cybersecurity measures and increased public awareness.
 
The cybersecurity landscape is evolving rapidly, and so are the tools at the disposal of malicious actors. Our comprehensive report unveils the capabilities of "The-Murk-Stealer," shedding light on how it discreetly collects a vast array of sensitive information.

Link to the research Report: The Thin Line: Educational Tools vs. Malicious Threats - A Focus on The-Murk-Stealer - CYFIRMA

https://www.cyfirma.com/

CYFIRMA Research examines a MAJOR threat - CVE-2023-34468 in Apache NiFi!

This vulnerability risks your data integration and automation tool, allowing remote code execution through manipulative H2 database connection strings. The implications are severe– unauthorized access, compromised data integrity, and the potential for remote code execution, all leading to substantial operational and reputational risks!

Immediate Action Required! If you are using Apache NiFi versions up to the reported issue, apply the provided patch from the Apache Software Foundation immediately. But that's not all - strengthen your defenses with access controls, monitoring, and continuous vigilance. Your data's security is paramount!

Link to the Research Report: Apache NiFi CVE-2023- 34468 RCE Vulnerability Analysis and Exploitation - CYFIRMA

#etlm #vulnerabilityintelligence #CyberSecurity #CVE202334468 

https://www.cyfirma.com/

Japan's Threat Landscape ETLM Report reveals the dynamic challenges faced by this economic powerhouse.

From state-sponsored giants to stealthy financial hackers, gain insights into the full spectrum of cyber threats impacting Japan's cutting-edge tech, automotive, and financial sectors.

With an extensive network of overseas subsidiaries and proximity to cyber-capable neighbours, Japan stands as a prime target in the Asia Pacific region. Threats range from IP theft to cryptocurrency attacks; to name a few.

Link to the Research Report: JAPAN THREAT LANDSCAPE - CYFIRMA


#japanthreatlandscape #cyberthreats #japan #ThreatIntelligence #externalthreatlandscape #ETLM #Cyfirmaresearch #CybersecurityInsights

https://www.cyfirma.com/

 CYFIRMA’s Research team is closely monitoring an evolving cyber conflict between independent hacktivist groups in Asia and the middle east. This isn't state backed, but it's impacting small businesses.
 
A surge in cyber-attacks from Islamic countries like Indonesia, Pakistan, Bangladesh, Afghanistan, and Malaysia, initially sparked by perceived injustices against Muslims in India, has taken an unexpected turn. Indian hackers have also retaliated, resulting in unintended harm to businesses in both regions.
 
The Russia-Ukraine conflict birthed cyber hacktivist groups on both sides, resorting to aggressive tactics like DDOS attacks and defacements to convey their messages. This trend is spreading, with political, religious, and protest-driven motives. Smaller conflicts are now cropping up globally, impacting unsuspecting businesses. Most affected are small businesses unrelated to the religious disputes.

Link to the Research Report: Mini Cyber-Conflict Leaving Impact on Small Businesses and Governments Sector - CYFIRMA

#CyberSecurity #Peace #Hacktivist #OnlineSafety #cybersecuritylandscape #CybersecurityInsights #ThreatLandscape #ETLM #Cyfirmaresearch #Cyfirma

https://www.cyfirma.com/

CYFIRMA Research delves deep into the new variant of RedLine Stealer, investigating this novel strain of malware, disguising as a document packaged within a zip archive that houses a batch script file.
 
RedLine Stealer is designed to steal sensitive information from the compromised system and is available on underground forums as Malware-as-a-Service (MaaS).
 
The best way to protect organizations and end users from RedLine is to be cautious with suspicious links and files received on the emails. Users should be aware that even trustworthy sources can lead to infection and data theft.

Link to the Research Report: RedLine Stealer : A new variant surfaces, Deploying using Batch Script - CYFIRMA

#CyberSecurity #ThreatAnalysis #DigitalDefense #RedLineStealer #cybersecuritylandscape #malware #ETLM #ThreatIntelligence

https://www.cyfirma.com/