CYFIRMA Research

Since the beginning of 2023, a new hacking collective has appeared, claiming origins in Sudan; a war-torn African country with a pre-modern societal structure, limited internet connectivity, and very low per capita incomes.

A Russian private military company which executes elements of foreign policy for the Kremlin has been operating in the country for years, and the self-described Islamist hacktivist collective seems to be a poorly-disguised Russian front for attacks on the West.

The group mostly uses nuisance level DDoS attacks, however, in the event of top Russian APTs carrying out significant cyber attacks on Western targets, it is likely the hacktivist auxiliaries would take credit to partially shield Moscow from the political fallout.

Link to the Research Report: ANONYMOUS SUDAN : A BYPRODUCT OF CIVIL WAR? - CYFIRMA
#AnonymousSudan #Russia #Wagner #geopolitics #Cyfirmaresearch #ThreatIntelligence #Prigozhin #UkraineWar #cybersecurity #Russianinformationoperations #ETLM

https://www.cyfirma.com/

This two-part report provides a comprehensive analysis of ransomware activity in 2023, where part 1 covers major ransomware attacks, the top five prolific ransomware families, since January 2023, and the geographical distribution of ransomware.

​​​​​​​In 2023, major companies and government departments such as, Yum! Brands, Royal Mail, and the US Marshals Service were amongst the victims of cybercriminals. #LockBit, #ALPHV, and #Clop are just a few of the notorious ransomware families wreaking havoc across the globe, with the US, UK, Italy, and Canada seeing significant increases in attacks due to their strong economies and digital infrastructures.

By examining these trends, organizations can gain valuable insights into the evolving threat landscape and enhance their cybersecurity strategies to mitigate ransomware risks effectively.

Link to the Research Report: RANSOMWARE TRENDS: H1 2023 – Part 1 - CYFIRMA

#CyberSecurity #RansomwareReport #Cybersecurity #ThreatIntelligence #Ransomware #DigitalDefense #Cyfirmaresearch #HitachiEnergy #GoAnywherevulnerability #Clopransomware #zeroday

https://www.cyfirma.com/

The team at CYFIRMA recently obtained advanced Android malware targeting individuals in the South Asia region.

The suspicious Android malware is a dummy chatting app named SafeChat that was initially disguised as a harmless chatting app called Coverlm on WhatsApp.

The user interface of this app is designed in such a convincing manner that it successfully deceives users into believing it to be authentic.

Our initial technical analyses revealed that APT Bahamut is behind the attack, we also found footprints of tactics used by DoNot APT in the suspicious app belonging to APT Bahamut. The malware exploits Android Libraries to extract sensitive data. Our research suggest that this malware serves the interests of one nation state government.


Link to research Report:  APT Bahamut Targets Individuals with Android Malware Using Spear Messaging - CYFIRMA

#CyberSecurity #AndroidThreats #StaySafe #Androidmalware #APTBahamut #DoNotAPT, #sensitivedata #Indiangovernment #ETLM #CYFIRMAResearch #ThreatIntelligence #CyberSecurity #GooglePlayStore

https://www.cyfirma.com/

CYRFIRMA Research examines a MAJOR threat - CVE-2023-3460 in Ultimate Member Plugin!
 
This flaw in the widely used Ultimate Member WordPress Plugin allows attackers to escalate privileges, bypassing regular security measures. By exploiting the zero-day vulnerability, attackers can manipulate user roles, leading to data breaches, content tampering, and worse.

Don't let your website be the next victim! Stay protected, update NOW!

Link to Research Report: Analyzing the Ultimate Member Plugin Vulnerability - CVE-2023-3460 - CYFIRMA.

#WordPressSecurity #CyberThreats #VulnerabilityAlert #StaySafe #CyberSecurity #StayVigilant #PatchAlert #CYFIRMAResearch #databreaches, #contenttampering #zeroday #privilegeescalation #websitesecurity #ETLM

https://www.cyfirma.com/

Cyfirma remains committed to tracking new threats and trends in the cybersecurity landscape. One noteworthy tool that has emerged is Attacker-Crypter. A crypter is a type of software that can encrypt, obfuscate and manipulate malicious code to make detection harder by the security tools, and is used by cybercriminals to create malware that can deceive security checks and AV detections.

 Attacker- Crypter is equipped with various options that can be leveraged to significantly reduce detections of the existing malware and bypass security scans when used in combination, making it a definite ‘one to watch’ in the threat-of sphere.

Link to Research Report: Attacker-Crypter (v0.9): Unveiling a Powerful Tool for Evading Antivirus and Enhancing Malware Capabilities - CYFIRMA

#Russianundergroundforum #ETLM #TheAttackerCrypter #Cyfirmaresearch #ThreatIntelligence #VMdetection   #WindowsAntimalwareScanInterface   #malware   #debuggerevasion #maliciouscode

https://www.cyfirma.com/

CYRFIRMA Research team has uncovered the recent activities of DEV-0970/Storm-0970, a financially motivated threat actor group. Armed with a ransomware builder, acquired from a Malware-as-a-Service operator, they unleash multiple ransomware variants to expand their malicious arsenal.

Our report highlights the connection between Poop69 and BIG HEAD ransomware, which we attribute to DEV-0970/Storm-0970, while analysing their evolving strategies and the urgent need for robust cybersecurity measures.

Our report serves as a call to action for stakeholders to fortify their defences against DEV-0970/Storm-0970. Together, let's combat this growing threat!

Link to the Research Report: DEV-0970/Storm-0970 : The Threat Actors Behind Big Head and Poop69 Ransomware - CYFIRMA

#Cybersecurity #DigitalDefense #Cyfirmaresearch #ThreatIntelligence #MaaS #ETLM #cybercriminal #CYFIRMAResearch

https://www.cyfirma.com/

By the end of June 2023, Wagner, a Russian mercenary organization mutinied against its state backers. The Russian government has been using the PMC for its dirty work for years. The rebellion seriously shook the political system in Russia and weakened the position of President Putin, even though the mercenaries stood down and agreed to a deal offered by the Kremlin.

The full extent of the damage is still unfolding. The mutiny resulted in an unknown hacking group making claims of disabling satellite terminals used by the Russian military, and the restructuring of Russian information operations (troll factories), which Prigozhin was in charge of prior to the mutiny.
 
Link to the Research Report: Who are the Wagner PMCs of Russia : Is There a Risk of a Cyber Fallout? - CYFIRMA

#geopolitics #Cyfirmaresearch #ThreatIntelligence #Prigozhin #Ukraine #UkraineWar #cybersecurity #Russianinformationoperations #ETLM #currentaffiars

https://www.cyfirma.com/

This research by the CYFIRMA Research team investigates a critical vulnerability, tracked as CVE-2023-27997, affecting FortiOS and FortiProxy SSL-VPN, a popular operating system and VPN, used in their security products. The vulnerability, known as XORTIGATE, has the potential for remote code execution (RCE) and is being exploited in recent attacks.

The XORTIGATE vulnerability arises from an insecure deserialization flaw found in the SSL VPN portal, allowing attackers to execute arbitrary code with privileges of the targeted user.

Fortinet has identified the affected versions of FortiOS, which include 6.0 to 7.2.4, for FortiProxy 1.1.0 to 7.2.3. Organizations utilizing these versions must act swiftly to patch or upgrade their systems to protect against potential attacks.

Link to Research Report: XORTIGATE Vulnerability : Unmasking Critical Threats in Fortinet's FortiOS and FortiProxy SSL-VPN (CVE-2023-27997) - CYFIRMA

#CyberSecurity #ThreatAlert #XORTIGATEVulnerability #ETLM #Cyfirmaresearch #ThreatIntelligence #FortiOS #FortiProxySSL-VPN #compromisingnetworks #stealingsensitivedata

https://www.cyfirma.com/

CYFIRMA researchers have uncovered a new infostealer builder called "Blank Grabber" that poses a significant threat to Windows operating systems. It was released in 2022, however since then, it has been frequently updated – with 85 contributions to the project in the last one month alone.

It’s sophisticated and is evolving, with frequent updates and a growing list of features, aimed at stealing sensitive information, causing potential damage, including financial losses, reputational harm, and compromised business operations.

Interestingly, the developer behind this infostealer has kept it open source, indicating a focus on building a rapport within the cybercriminal community rather than financial gains. This report delves into the capabilities of this malware and offers proactive measures for organizations to defend themselves.
 
Link to Research Report: Blank Grabber Returns With High Evasiveness - CYFIRMA

#blankgrabber #ETLM #Cyfirmaresearch #ThreatIntelligence #cybercriminalcommunity #Blackforums #Threatsec

https://www.cyfirma.com/

Information stealers remain an enduring and evolving security concern for individuals and organizations alike. CYFIRMA’s Research team has recently uncovered an advanced information stealer, known as “WISE REMOTE Stealer,” that functions as both a stealer and a Remote Access Trojan (RAT). This sophisticated malware has gained significant traction through promotion in underground forums.

Continual enhancements are observed within the WISE REMOTE Stealer, as the threat actor diligently incorporates new features to amplify its effectiveness and expand its user base. This report offers in-depth insights into the comprehensive capabilities and features of WISE REMOTE Stealer, empowering stakeholders with a thorough understanding of its operational scope, and potential consequences to mitigate the associated risks effectively.

Link to Research Report: WISE REMOTE Stealer Unleashed: Unveiling Its Multifaceted Malicious Arsenal - CYFIRMA

#CyberSecurity #WISEREMOTEStealer #ThreatIntelligence #externalthreatlandscape #etlm #Stealer #malware #ransomware #DDoS #Botnet #Cyfirmaresearch #ThreatIntelligence #RemoteAccessTrojan #denialofservice

https://www.cyfirma.com/