CYFIRMA Research

In today's ever-evolving cybersecurity landscape, the role of malware detection solutions has become more critical than ever.

As cybercriminals continually evolve their evasion tactics, it's essential to understand the intricate web of strategies they employ; from signature-based to behaviour-based and anti-analysis techniques.

Discover why these evasion methods overlap and how they challenge traditional security measures. Stay one step ahead of evolving threats by adopting advanced threat detection solutions and a multi-faceted security approach.

Link to the Research Report: MALWARE DETECTION : EVASION TECHNIQUES - CYFIRMA

#cybersecurity #malware #ThreatLandscape #ETLM #Cyfirmaresearch #MalwareDetection

https://www.cyfirma.com/

The CYFIRMA monthly Ransomware Report report thoroughly analyses ransomware activity in August 2023, covering significant attacks, the top five ransomware families, geographical distribution, targeted industries, evolution of attacks, new ransomware groups, vulnerabilities exploited by ransomware groups, and trends between July and August 2023.

Organizations can leverage these insights to enhance their cybersecurity strategies and mitigate ransomware risks.

Link to the Research Report: Tracking Ransomware - August 2023 - CYFIRMA

#RansomwareTrends #CybersecurityInsights #ThreatLandscape #StaySecure #CyberSecurity #RansomwareReport #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirma #ETLM #Cyfirmaresearch #LockBit #Cloak #Akira #Knightransomware #INCransomware #ScatteredSpider #ViceSociety #RhysidaRansomware #BlackCatSphynx

https://www.cyfirma.com/

CYFIRMA delves into the Prysmax  MaaS operations, currently promoting their new stealer- Prysmax Stealer.

Almost all the builds of the infostealer have zero detections by signature-based solutions. The infostealer was released in June this year and has remained undetected by over 95% of antivirus vendors - no matter how many times it is scanned.

It is a sophisticated tool designed to covertly steal sensitive data, while evading detection. What's alarming is that its creators are not newcomers to the cyber game; they've been operating in the shadows for a while, since at least October 2022.

To protect yourself, stay vigilant, and follow our updates as we delve deeper into the cyber threat landscape.

Link to the Research Report: New MaaS Prysmax Launches Fully Undetectable Infostealer - CYFIRMA

#etlm #cybersecurity #externalthreatlandscape

https://www.cyfirma.com/

When dealing with the question of the strategic relationship between China and Russia, the narrative often splits between camps of proponents of upcoming fortress EURASIA or inevitable future rift between historical rivals. In this research, CYFIRMA Researchers are looking at the relationship between the two cyber superpowers, their military and intelligence cooperation and the possible future of the relationship.

Link to the Research Report: The China–Russia Nexus: Fortress Eurasia or Strategic Rivalry? - CYFIRMA

#externalthreatlandscape #etlm #geopolitics #cyberwarfare #cybersecurity #cybersecurityposture

https://www.cyfirma.com/

A critical unauthenticated remote code execution vulnerability, denoted as CVE- 2023-3519, has been exposed within the architecture of Citrix ADC and Citrix Gateway products.

This flaw enables threat actors to execute arbitrary code on susceptible systems without the need for authentication: this signifies a grave security concern, impacting numerous Citrix instances on a global scale, with the potential to cause data breaches, compromised systems, and unauthorized access. These products are widely deployed for load balancing and remote access, making them attractive targets for cybercriminals, seeking to exploit the unauthenticated remote code execution vulnerability.
 
 ​​​​​​CYFIRMA’s vigilant research underscores the urgency of swift mitigation measures, such as applying provided patches and heightening security protocols to ensure the resilience of digital assets, in the face of this formidable threat.

Link to the Research Report: Unveiling CVE-2023-3519 : Citrix ADC & Gateway Vulnerability Analysis - CYFIRMA

#StaySecure #CYFIRMAProtection #CyberThreatsAwareness #CitrixADC #Gatewayproducts #remotecodeexecution #CyfimaResearch #ETLM #ThreatIntelligence #networkcompromise

https://www.cyfirma.com/

The latest report by CYFIRMA Research delves deep into the Remcos Remote Access Trojan (RAT). This analysis uncovers a complex ecosystem of tactics, IPs, and advanced payloads utilized by malicious actors. From initial infection to persistent control, we explore the dynamic landscape of cyber threats and the need for proactive defense measures.
 
Discover the evolving tactics of the Remcos RAT campaign. Learn how this sophisticated malware infiltrates systems, gathers sensitive data, and manipulates operations. Our investigation exposes the Remcos RAT's multifaceted ecosystem. Extracted configurations reveal critical details like C2 IP, botnet name, and more.
 
Explore the comprehensive insights offered in our report to strengthen your digital defenses.

Link to the Research Report: The Persistent Danger of Remcos RAT - CYFIRMA

#CyberSecurity #ThreatAnalysis #DigitalDefense #StaySecure #RemcosRAT #RemoteAccessTrojan #Riotgames

https://www.cyfirma.com/

CYFIRMA Research analysis EVLF, the MaaS operator behind CypherRAT & CraxsRAT.
 
 These malicious tools grant remote access to cameras, mics, filesystem and applications on victim devices. With features like live screen monitoring, shell access and Google play protect bypass features, CraxsRAT can be categorized as one of the most dangerous android RATs in the current threat landscape.
 
 Over 100 threat actors purchased CraxsRAT licenses in the last 3 years!
 
 Link to the Research Report: Unmasking - EVLF DEV-The Creator of CypherRAT and CraxsRAT - CYFIRMA

#StaySecure #CyberSecurity #androidRATs #shellaccess #livescreenmonitoring #Googleplayprotect #CyfimaResearch #ETLM #remoteaccess #ThreatIntelligence

https://www.cyfirma.com/

The latest CYFIRMA Monthly Ransomware report presents an evolving threat landscape marked by a surge in ransomware attacks, significantly impacting critical industries on a global scale. The 'Cl0p' group stands at the forefront, targeting 183 victims, while the IT and Manufacturing sectors endure the highest toll, each encountering 50 incidents.

The United States faces the brunt with 186 attacks, underscoring the unwavering pursuit of high-value targets. Noteworthy incidents such as Maximus and the Port of Nagoya underscore the gravity of the situation while emerging players 'Cactus' and 'Cyclops' introduce new dimensions of threat.
 
In the face of this escalating digital battleground, industries must forge a united front to counter this persistent menace.

Link to the Research Report: TRACKING RANSOMWARE - JULY 2023 - CYFIRMA

#RansomwareTrends #CybersecurityInsights #ThreatLandscape  #CyberSecurity #ThreatIntelligence #Ransomware #Cyfirma #ETLM #Cyfirmaresearch #Rhysida #Rhysida #LockBit #MOVEit #ALPHV #BlackCat

https://www.cyfirma.com/

The Cyfirma Research team has recently discovered a disguised Stealthy MSI Loader being advertised in underground forums by Russian threat actor, showcasing its remarkable ability to evade detection by both Virus Total scan and Windows Defender. Additionally, through our investigation, we have established a link between this MSI Loader and the BatLoader campaign observed in March 2023, highlighting potential coordination between these threats. Our meticulously crafted report on Stealthy MSI Loader provides a comprehensive and actionable insight into this novel and rapidly evolving threat, emphasizing the urgent need for the cybersecurity community to address and counter this threat promptly. 

Link to the Research Report: https://www.cyfirma.com/outofband/stealthy-malicious-msi-loader-overlapping-technique-and-infrastructure-with-batloader/

#CyberSecurity #MSILoader #ThreatIntelligence #externalthreatlandscape  #etlm #malware #Batloader #Botnet

https://www.cyfirma.com/

This report is Part 2 of a comprehensive analysis of ransomware activity in 2023. Part 1 covered major ransomware attacks, the top five prolific ransomware families since January 2023, and the geographical distribution of ransomware, whereas, this publication will delve into targeted industries, industrial trends analysis for H1-2022 and H1-2023, the ongoing evolution of ransomware attacks, notable new ransomware groups, the vulnerabilities exploited in 2023, and trends comparison between H1 2022 and H1 2023.

Learn how industries like #Manufacturing, #FMCG, #IT, #Banking and #HealthCare are affected, and why #cybercriminals are constantly evolving their tactics.​​​​​​​By examining these themes, organizations can gain valuable insights into the evolving threat landscape and enhance their cybersecurity strategies to mitigate ransomware risks effectively.

Link to the Research Report: RANSOMWARE TRENDS : H1 2023 Part-2 - CYFIRMA

#RansomwareTrends #CybersecurityInsights #ThreatLandscape #ThreatIntelligence #Ransomware #Cyfirma #NoEscape #Rhysida #ETLM #Cyfirmaresearch

https://www.cyfirma.com/