CYFIRMA Research

The loss of intellectual property (IP) through cyber espionage and cyber crime constitutes the greatest transfer of wealth in history. U.S. companies alone loose around a quarter to half a trillion dollars annually through intellectual property theft, with over a hundred billion lost due to cyber crime – a number that can be tripled when the costs of downtime are taken into account.

There are many challenges in the field of IP protection, however, the chief among them is China and its national program of integrating IP theft into Chinese industry via cyber espionage, as its ambitions are curtailed by export restrictions. Some of the most vulnerable industries to this campaign are those in information technology, advanced manufacturing (especially in semiconductors), aerospace, maritime, rail, high-tech shipping equipment, new-energy vehicles, biotech, and pharmaceutical products.

Link to Research Report: CHINA IP THEFT REPORT - CYFIRMA

#geopolitics #etlm #Cyfirmaresearch #ThreatIntelligence #G7 #Chinesegovernment #cybersecurity

https://www.cyfirma.com/

Detecting SEO poisoning attacks can be a significant challenge due to the ever-changing nature of search engine algorithms and the sophisticated techniques used by attackers. Cybercriminals are constantly evolving their tactics, and they're even leveraging advanced technologies like AI and ChatGPT to make their SEO poisoning attacks more convincing.

This report provides valuable insights into the detection challenges faced by organizations, along with recommendations on how to strengthen your defenses. It also includes ETLM overview to identify and avoid deceptive search results, understand the potential risks involved, and implement robust defense mechanisms to safeguard your online security.

Link to Research Report: Beyond Search Results: Deconstructing SEO Poisoning Technique & Safeguarding Measures - CYFIRMA

#CyberSecurity #SEOpoisoning #StayInformed #ProtectYourself #OnlineSafety #manipulatesearchengine #searchenginealgorithms #ETLM #StayVigilant #cybercrime #Cyfirmaresearch #TyposquattingThreatLinkManipulation #Keywordstuffing #Contentcloaking #MaliciousAdvertising

https://www.cyfirma.com/

The CYFIRMA research team has identified a new marketplace run by unknown threat actors, known as the Zero-Day Shop. It serves as a one-stop destination for threat actors, offering a range of dangerous tools and services.  Zero Day Shop acts as a middleman between initial access brokers, offers malware and exploit software to launch devastating cyber-attacks.
 
 The consequences of the products on offer are far-reaching: data breaches, financial fraud, identity theft, and reputational damage. Therefore, organizations must remain vigilant and bolster their defenses against these evolving threats.
 
 Link to Research Report: Research Report: Zero Day Shop - CYFIRMA

#Cybersecurity #ThreatIntelligence #ZeroDayShop #onestopshop #databreaches #financialfraud #identitytheft #scampages #StayVigilant #cybercrime #Cyfirmaresearch #exploitsoftware #ETLM

https://www.cyfirma.com/

Typosquatting, also known as URL hijacking or domain mimicry, exploits the typing errors made by internet users when entering website URLs, aiming to redirect them to malicious websites. 

Attackers register domain names that closely resemble popular or legitimate websites, capitalizing on common misspellings or slight variations. 

By luring unsuspecting users to typosquatted websites, threat actors can execute various malicious actions, including phishing scams, malware distribution, and unauthorized data collection. While organizations targeted by typosquatting attacks face reputational damage as users associate fraudulent activities with their brands.

Link to research Report: Typosquatting Unmasked: Exposing the Threats of Misplaced Keystrokes - CYFIRMA

#CyberSecurity #TyposquattingThreat #StayVigilant

https://www.cyfirma.com/

https://www.cyfirma.com/

Information stealers pose an ongoing and dynamic threat to the security of both individuals and organizations. CYFIRMA’s Research team recently discovered an information stealer called “Mystic Stealer” being promoted in an underground forum, with the threat actor utilizing a Telegram channel for their operations. This threat actor continuously enhances the malware, incorporating new features to enhance its effectiveness and expand its user base. Our open-source intelligence (OSINT) investigation revealed the existence of over 50 active command and control (C2) servers, indicating the growing prevalence of this threat. Given the consistent demand for potent information stealers, “Mystic Stealer” emerges as a potential contender in this domain. This report provides comprehensive insights into Mystic Stealer’s capabilities and presents our OSINT findings.

Link to Research Report: Mystic Stealer - Evolving "stealth" Malware - CYFIRMA


#CyberSecurity #MysticStealer #ThreatIntelligence #etlm #malware #stealer #externalthreatlandscape ##MysticStealermalware #Cyfirmamalwarereport

https://www.cyfirma.com/

Cyfirma recently interviewed the DeltaBoys; a threat actor group that specialises in mass defacements. Following our recent research report; 'DeltaBoys- Black Hats on the Rise’, our insightful and unique interview explores the DeltaBoys’ ideological and geopolitical motivations, affiliations, their financial motivations, and gives them the chance to have their voices heard across the world.

 Link to Research Report: Unveiling DeltaBoys : Interview about their Past and Motivation. - CYFIRMA

#CyfirmaInterviews #DeltaBoys #ThreatActorGroup #MassDefacements #CyberSecurity #ResearchReport #BlackHatsOnTheRise #FinancialMotivations #IdeologicalMotivations #VoiceOfDeltaBoys #SecurityResearch

https://www.cyfirma.com/

Blubrry PowerPress, a popular plugin used by podcasters to enhance their websites, has recently come under scrutiny due to a security vulnerability. Cybersecurity researchers at CYFIRMA discovered the security vulnerability, specifically affecting versions 10.2.3 and earlier. The vulnerability identified is a zero-day authenticated stored cross-site scripting (XSS) exploit, found within the “Show Title” field, which allows an attacker with authenticated access to inject malicious code into the podcast’s title, potentially compromising the security and integrity of the affected website.

Link to Research Report: Unveiling an Authenticated Stored Cross-Site Scripting Zero-Day Vulnerability in PowerPress Plugin 10.2.3 and Earlier - CYFIRMA

#Cybersecurity #ZeroDayVulnerability #PodcastSecurity #WebsiteSecurity #VulnerabilityAlert #ZeroDayExploit #XSSAttack #CyberThreats #WebsiteIntegrity 

https://www.cyfirma.com/

The Group of Seven (G7) singled out China on issues including Taiwan; non-market policies; malign business and cyber practices (such as illegitimate technology transfer, or data disclosure / human rights abuses), which naturally underscores the wide-ranging tensions between Beijing and the group of major industrialized democracies. Beijing has responded in a fiery way, with Chinese state media berating the outcome of the meeting, singling out Japan, Great Britain, and the United States in their rhetoric.

The group has also issued a separate and way more damning communique on Russia, and among other things stated that the G7 countries will deprive Russia of technologies, industrial equipment, and services that serve its war machine. Russia, a close ally of China that was also called out in the G7 statement over its war in Ukraine, said the summit was an “incubator” for anti-Russian and anti-Chinese hysteria, and stated the G7 countries are on a path of dangerous escalation.

Link to Research Report: G7 Summit Assessment Report - Strong Symbolism, Military Commitments and Relations with China - CYFIRMA

#etlm #cyberintelligence #cybersecurity #geopoliticalposturing

https://www.cyfirma.com/

DeltaBoys have been operating since December 2021, initially starting out as database brokers and carders. However, in August 2022, their operation evolved into mass defacement and the ‘initial access’ broking market, providing webshells to sensitive websites. To fund their geopolitically motivated operations, they built a diverse catalogue of recently compromised databases, ‘zero-days’, ‘exploits to known vulnerabilities’, webshells, and leaked credit cards for sale.

Link to Research Report: https://www.cyfirma.com/outofband/deltaboys-black-hats-on-the-rise/

#Cybersecurity #CyberIntelligence #etlm #situationalawareness

https://www.cyfirma.com/