CYFIRMA Research

CYFIRMA Research has identified an active crypto drainer campaign targeting Trust Wallet users through QR code phishing distributed via Telegram channels. The attack leverages deep link abuse and deceptive transaction flows to gain persistent access to victim funds.

This campaign highlights a shift toward user-authorized exploitation, where no wallet vulnerability is required. By abusing standard Web3 workflows, attackers gain persistent and unrestricted access to victim wallets, enabling delayed or automated fund exfiltration. This activity underscores the rapid evolution of Drainer-as-a-Service ecosystems, combining social engineering, automation, and low-cost blockchain operations to scale financial theft.

Link to the Research Report: https://www.cyfirma.com/research/silent-crypto-wallet-takeover-unlimited-usdt-approval-exploitation-via-trust-wallet-qr-code-phishing/

#ThreatIntelligence #CryptoSecurity #Web3 #Phishing  #BlockchainSecurity
#CyberSecurity #MalwareAnalysis #CYFIRMA #CyfirmaResearch

https://www.cyfirma.com/

The CYFIRMA Research team has identified critical security insights related to CVE-2026-1492, a high-severity authentication bypass and privilege escalation vulnerability affecting the WordPress User Registration & Membership plugin.

The vulnerability allows unauthenticated attackers to gain administrative access by exploiting improper server-side validation and weak authorization controls within the registration and membership workflow.

Our research highlights the exploitation mechanism, exposure landscape, affected versions, and mitigation strategies to help organizations defend against potential compromise.

Link to the Research Report: https://www.cyfirma.com/research/cve-2026-1492-wordpress-user-registration-membership-authentication-bypass-flaw/

#CYFIRMAResearch #CyberSecurity #ThreatIntelligence #VulnerabilityResearch #ETLM #CVE20261492 #CYFIRMA #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

March reflected a further escalation in ransomware activity, with incident volumes rising and multiple threat actors expanding operations simultaneously. Qilin emerged as the most dominant group with a sharp increase in activity, while several others, including Akira, Incransom, Nightspire, Dragonforce, and LockBit5, showed significant growth, indicating a highly competitive and rapidly scaling ecosystem. At the same time, a few groups declined, reinforcing the fluid and continuously shifting nature of ransomware operations. The threat model continues to evolve toward access-driven intrusions, with attackers leveraging credential compromise, exploitation of internet-facing vulnerabilities, and brokered access. Increased use of legitimate administrative tools, stealth-focused techniques, and rapid deployment through cloud and virtual infrastructure highlights a strong shift toward efficiency and evasion.

Geographically, the United States remained the most impacted region by a wide margin, followed by the United Kingdom, Canada, and major European economies, with continued expansion across Asia-Pacific and emerging markets. Industry targeting remained concentrated on sectors with high operational reliance and sensitive data exposure, particularly professional services, manufacturing, healthcare, and information technology.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-march-2026/ 

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA  #ThreatLandscape #CyberRisk #DataExtortion #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CrySome RAT – Advanced Threat Insight

CrySome RAT is a sophisticated .NET-based remote access trojan engineered for long-term persistence and stealth on Windows systems. It extends beyond typical malware by maintaining execution even after system resets, leveraging recovery partition abuse and offline registry manipulation to ensure continued presence.

Beyond persistence, it delivers a full post-exploitation toolkit. It supports remote command execution, file exfiltration, process manipulation, and network pivoting via SOCKS and reverse proxy. With capabilities like AVKiller to disable security tools, HVNC for hidden remote control, keylogging, credential theft from Chromium-based browsers, and real-time screen, audio, and webcam surveillance, it provides attackers with deep visibility and control over compromised environments.

Adding to the concern, it’s being openly marketed via crysome[.]net, lowering the barrier for wider adoption.

Link to the Research Report: https://www.cyfirma.com/research/crysome-rat-an-advanced-persistent-net-remote-access-trojan/

#MalwareAnalysis #CyberSecurity#ThreatIntel #RAT #CYFIRMA #CYFIRMAResearch #WindowsRAT #HVNC #InfoSec  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

New Threat Intelligence Report: Invoice-Themed Phishing Campaign

A sophisticated phishing campaign is actively targeting finance and procurement teams using invoice, payment, and operational lures—timed strategically around financial year-end activities.

With increased transaction volumes and audit processes, employees are more likely to engage with seemingly routine emails—making this campaign particularly effective.

This campaign reflects a broader shift toward stealthy, user-driven phishing techniques designed to bypass traditional defenses. 

Link to The Research Report: https://www.cyfirma.com/research/invoice-themed-phishing-campaign-targeting-financial-workflows-amid-fiscal-year-end-activity/

#CyberSecurity #Phishing #ThreatIntelligence #InfoSec #CyberAwareness #BEC #CyberDefense #CYFIRMA#CYFIRMAresearch  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay informed with CYFIRMA’s February 2026 Ransomware Threat Report.

February continued to reflect a high-activity ransomware environment, with noticeable shifts in group dynamics and operational patterns. While Qilin sustained consistent activity levels, other actors showed mixed trends, with some groups scaling rapidly and others reducing operations, highlighting the constantly evolving nature of the ecosystem. The ransomware model continues to move toward access-led intrusions and extortion strategies driven by psychological and operational pressure rather than purely technical compromise. Techniques such as credential-based access, abuse of legitimate tools, and stealth-focused persistence are becoming more prominent, alongside increasing use of cloud and virtual infrastructure to support campaigns.

Geographically, the United States remained the most affected region, followed by Canada, the United Kingdom, and key European markets, with continued spread across Asia-Pacific and emerging economies. Industry targeting remained focused on sectors with high operational dependency and valuable data, particularly professional services, manufacturing, and information technology.

Link to The Research Report: https://www.cyfirma.com/research/tracking-ransomware-feb-2026/

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #ThreatLandscape #CyberRisk #DataExtortion #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

The CYFIRMA Research team has identified critical security insights related to CVE-2026-24423, a high-severity unauthenticated remote code execution vulnerability impacting SmarterTools SmarterMail.

The vulnerability allows attackers to execute arbitrary commands through the ConnectToHub API, potentially leading to full system compromise. Our research highlights the exploitation mechanism, threat landscape, affected versions, and mitigation strategies to help organizations defend against emerging threats.

Link to the Research Report: CVE-2026-24423 - SmarterTools SmarterMail Remote Code Execution Vulnerability - CYFIRMA

#CYFIRMAresearch #CyberSecurity #ThreatIntelligence #VulnerabilityResearch #ETLM #CVE202624423  #ExternalThreatLandscapeManagement #ETLM #CYFIRMA

https://www.cyfirma.com/

CYFIRMA Research uncovered a targeted Android spyware campaign, Operation False Siren, exploiting wartime urgency by weaponizing the trusted Israeli civil defense alert application.

In this operation, threat actors distributed a trojanized version of the missile warning app via SMS phishing (smishing) campaigns, convincing victims to install what appeared to be a critical alert system update. Once installed, the application deployed a two-stage malware framework designed to silently establish long-term surveillance on compromised devices.

This campaign highlights how trusted public-safety applications and open-source codebases can be abused to conduct large-scale surveillance operations, particularly during periods of geopolitical conflict when users are more likely to install urgent security updates without scrutiny.

Link to the Research Report: OPERATION FALSE SIREN ANDROID SPYWARE CAMPAIGN - CYFIRMA

#CYFIRMA #ThreatIntelligence #AndroidMalware #MobileSecurity  #ThreatResearch #MalwareAnalysis #CyberSecurity #CTI #AndroidSpyware  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

New Report Released: Advanced Android Banking RAT Targeting Russian Financial Institutions

CYFIRMA Research has uncovered a highly sophisticated Android Banking Trojan with integrated Remote Access Trojan (RAT) capabilities targeting Russian users and financial institutions, such as banking apps, cryptocurrency applications, government services apps, and marketplace platforms.

What the report covers:
 • Native library–based obfuscation (sysruntime[.]so)
 • Custom rolling XOR encryption hiding C2 infrastructure
 • Firebase-backed command & control
 • Real-time VNC-like remote device control
 • SMS takeover & OTP interception
 • Lock screen PIN capture & keylogging
 • Targeted monitoring of 33+ Russian banking apps
 • Multi-layered persistence mechanisms

The malware demonstrates advanced operational security, runtime decryption of infrastructure, affiliate-style worker keys, and comprehensive financial fraud capabilities.

This campaign reflects the growing sophistication of Android banking RAT ecosystems — combining stealth, persistence, and full remote access into a scalable threat model.

Link to the Research Report: TAXISPY RAT : Analysis of TaxiSpy RAT - Russian Banking - Focused Android Malware with Full Remote Control - CYFIRMA 

#ThreatIntelligence #AndroidMalware #BankingTrojan #CyberSecurity  #MobileThreats #RAT #MalwareAnalysis #CYFIRMA #CYFIRMAResearch  #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

New Research: Dead Infrastructure Hijacking — The Attack That Doesn't Need a Vulnerability

Most breaches start with an exploit. This one starts with a domain registration.

We've published a full threat intelligence report on Dead Infrastructure Hijacking (DIH) — a threat class that exploits residual trust relationships left behind when digital infrastructure is decommissioned, migrated, or abandoned.

No intrusion. No CVE. No malware. The attacker simply owns an address that your systems are still calling.

Link to the Research Report: DEAD INFRASTRUCTURE HIJACKING - A COMPLETE AND PRECISELY BOUND THREAT ASSESSMENT - CYFIRMA

#CyberThreatIntelligence #CTI #AttackSurfaceManagement #CloudSecurity  #DIH #SubdomainTakeover #SupplyChainSecurity #MITRE #ATTACKFramewor #BlueTeam #ThreatResearch #ExternalThreatLandscapeManagement #ETLM  #CYFIRMA #CYFIRMAresearch

https://www.cyfirma.com/