CYFIRMA Research

Emerging Threat Model: SOLYXIMMORTAL Malware

Recent analysis highlights how modern commodity malware continues to evolve by abusing legitimate system functionality rather than relying on exploits or vulnerabilities. The malware demonstrates how attackers can achieve persistent access, credential theft, and user surveillance entirely within the user space, leveraging trusted operating system features and third-party services.

Key observations:

• User-level persistence via AppData and registry Run keys
• Credential extraction from browser stores using native OS APIs
• Context-aware surveillance through active window monitoring and screenshots
• Data exfiltration over legitimate platforms (e.g., Discord webhooks)
• No exploit chains or privilege escalation required

Why this matters:
These techniques evade many traditional security controls by blending into normal system behavior and trusted network traffic. When malware relies on standard scripting runtimes, user permissions, and widely used cloud services, detection becomes a behavioral problem, not a signature one.

Effective defense requires visibility into user-space execution, browser credential access, and abuse of legitimate third-party services, alongside strong behavioral analytics.

Link to the Research Report: SOLYXIMMORTAL : PYTHON MALWARE ANALYSIS - CYFIRMA

#ThreatIntelligence #MalwareAnalysis #CyberSecurity #BlueTeam  #DetectionEngineering #OSINT #InfoSec #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s December 2025 Ransomware Report.

December marked the most active month of 2025 with 801 global ransomware victims, signaling a strong year-end escalation. Qilin surged to 175 victims, reinforcing its dominance, while Safepay and Sinobi posted sharp month-over-month growth, highlighting shifting group momentum. Ransomware operations increasingly adopted cartel-style, access-driven models, abusing trusted security tools, hypervisors, and enterprise file-sharing platforms to accelerate encryption and data-theft-only extortion. 

The United States remained the primary target, followed by Western Europe, with expanding activity across Asia-Pacific and the Middle East. Professional services, manufacturing, IT, healthcare, and real estate were the most impacted sectors. Emerging groups like Nova continued to scale through data-centric extortion, signaling sustained threat expansion into 2026.

Link to the Research Report: TRACKING RANSOMWARE : DEC 2025 - CYFIRMA

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #Safepay   #Sinobi #Nova #DataExtortion #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

The threat landscape just got more complex. The Scattered LAPSUS$ Hunters-alliance has re-emerged, merging the tactics of notorious groups.
This isn’t just a name change; it’s a shift toward professionalized, identity-centric extortion.

What you need to know:

• High-Value Targets: Focused on enterprises with $500M+ revenue, specifically in Cloud, Telecom, and Finance.
• Identity is the Perimeter: They specialize in "logging in" rather than "hacking in," using advanced vishing (voice phishing) and insider recruitment to bypass MFA.
• ShinySp1d3r RaaS: The group is launching its own "extortion-as-a-service" platform, moving away from third-party ransomware.
• Sector Limits: They currently avoid healthcare and specific geopolitical regions (Russia/China), keeping their focus on high-yield corporate data.

The takeaway? If your security relies solely on "traditional" MFA without monitoring for suspicious identity behaviour, you could be at risk.

Link to the Research Report: https://www.cyfirma.com/research/resurgence-of-scattered-lapsus-hunters/

#CyberSecurity #ThreatIntel #ScatteredSpider #Lapsus #CISO #DataProtection #CYFIRMA #CYFIRMAresearch #ExtrnalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

APT36 Targets Indian Entities Using Weaponized Windows Shortcut Files

CYFIRMA has identified a coordinated cyber-espionage campaign attributed to APT36 (Transparent Tribe), a Pakistan-aligned threat actor persistently targeting Indian government entities and strategic sectors.

This campaign highlights APT36’s evolving tradecraft, leveraging malicious Windows shortcut (.LNK) files and multi-stage payload delivery to stealthily compromise victim systems while masquerading as legitimate documents.

This activity underscores APT36’s increasing technical maturity and continued emphasis on espionage-driven operations against Indian interests.

Link to the Research Report: https://www.cyfirma.com/research/apt36-multi-stage-lnk-malware-campaign-targeting-indian-government-entities/

#CyberSecurity #ThreatIntel #APT36 #TransparentTribe #MalwareAnalysis  #IndianGovernment #LNKMalware #CyberEspionage #ThreatResearch  #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Hacktivist activity is often dismissed as low-sophistication noise, website defacements, DDoS attacks, or online activism.

Our latest research argues that this view is increasingly outdated.

The report introduces Hacktivist Proxy Operations as a repeatable model of deniable cyber pressure, where ideologically aligned non-state groups apply disruption, narrative amplification, and psychological pressure in ways that align with state geopolitical interests without formal sponsorship or direct control.

Key takeaways:
• Hacktivist campaigns increasingly activate after geopolitical triggers such as sanctions or diplomatic escalation
• Impact comes from timing, visibility, and narrative amplification — not technical sophistication
• Low-intensity disruption can create disproportionate strategic and reputational pressure
• Effective defense requires resilience and context awareness, not attribution certainty

This research is based on structured analysis of open-source intelligence, underground ecosystems, and hacktivist communication channels, and is intended for public, policy, and security audiences.

Link to the Research Report: PLAUSIBLE DENIABILITY IN CYBERSPACE : THE STRATEGIC USE OF HACKTIVIST PROXIES - CYFIRMA

#CyberSecurity#ThreatIntelligence #Hacktivism #Geopolitics #CyberConflict  #InformationWarfare #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement  #ETLM

https://www.cyfirma.com/

Threat Alert: APT 36

CYFIRMA has identified a targeted malware campaign abusing fake NCERT WhatsApp advisory PDFs to compromise Windows systems.

Link to the Research Report: APT36 LNK-BASED MALWARE CAMPAIGN LEVERAGING MSI PAYLOAD DELIVERY - CYFIRMA

#APT36 #Cyberthreatintelligence #Malware analysis #Threathunting #Cybersecurity #ETLM #CYFIRMA

https://www.cyfirma.com/

A sophisticated QR-code phishing (“quishing”) campaign is targeting employees with payroll-themed lures, bypassing email security and harvesting credentials via obfuscated, per-victim infrastructure. This trend underscores the growing risk of mobile-based phishing and the need for stronger user awareness and behavior-driven defenses.

Link to the Research Report: Quishing Campaigns : Advanced QR-Code Phishing Evaluation and Insights - CYFIRMA

#Quishing #Phishing #CyberThreats #ThreatIntelligence #CYFIRMA 

#CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

New Research Alert: NexusRoute Campaign Uncovered
 
 We’ve uncovered a large-scale Android malware and phishing operation impersonating Indian government services like mParivahan and e-Challan. Threat actors are abusing GitHub to host malicious APKs and fake payment portals, tricking users into sharing OTPs, UPI PINs, and financial details. The malware uses advanced techniques—dynamic loaders, native code, SMS hijacking, screen capture, and persistent background services—to monitor devices, steal data, and enable real-time fraud. This coordinated infrastructure shows that the campaign is highly professional and financially motivated, posing a serious national-scale cybersecurity threat.

Link to the Research Report: NexusRoute: Attempting to Disrupt an Indian Government Ministry - CYFIRMA

 #CyberSecurity #ThreatIntelligence #AndroidMalware #PhishingAlert #MalwareAnalysis #MobileSecurity #CyfirmaResearch #DigitalSafety #FraudPrevention #CyberThreat #InfoSec #CyberAwareness #CyberFraud #CyberDefense #CyberCrime #ExternalThreatLandscapeManagement #ETLM #CYFIRMA #CYFIRMAresearch

https://www.cyfirma.com/

Mobile Threat Alert: Crypto Mnemonic Phrase Stealer

SeedSnatcher is a newly uncovered Android malware family targeting the crypto ecosystem, built to steal users’ mnemonic recovery phrases using a sophisticated DisplayOverlay attack

Capabilities:

• Intercepts and exfiltrates seed phrases and private keys from major cryptocurrency wallets
• Presents deceptive wallet-import screens to lure users into entering their recovery phrases
• Communicates with its command-and-control servers via encrypted WebSocket channels

Additional Capabilities:

• Access device files and media
• Read SMS content and monitor messages
• Retrieve call logs and contact lists
• Collect device identifiers, network data, and app details
• Exfiltrate collected information to the C2 over encrypted channels

Link to the Research Report: SEEDSNATCHER : Dissecting an Android Malware Targeting Multiple Crypto Wallet Mnemonic Phrases - CYFIRMA

#CyberSecurity #MobileSecurity #AndroidMalware #CryptoSecurity  #ThreatIntelligence #SeedSnatcher #ThreatAlert #CYFIRMA #CYFIRMAresearch#ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA researchers have identified a sophisticated Android malware operation spreading via fake RTO Challan/e-Challan notifications shared over WhatsApp.
 
The malicious APK uses two-stage installation, NP-based code obfuscation, and a custom VPN layer to evade detection and maintain persistent control over infected devices.

C2 Infrastructure Exposed.
Our analysis uncovered two domains used as the campaign’s Command-and-Control (C2) backend:
Jsonserv[.]xyz
jsonserv[.]biz

Both domains were hidden using Base64-encoded fragments inside the APK to evade static detection and were linked to multiple operational endpoints responsible for:

• Device registration and tracking
• Exfiltration of SMS, OTPs, and personal data
• Task retrieval and fraud orchestration
• APK update and payload delivery

The domains share identical infrastructure traits (GoDaddy registration, Cloudflare DNS, locked modification status), indicating a centrally managed fraud ecosystem aligned with large-scale financial scams targeting Indian users.

The malware harvests Aadhaar, PAN, phone numbers, banking credentials, UPI PINs, card details, and silently intercepts OTPs—enabling real-time account takeover and unauthorized transactions.

CYFIRMA Recommends:
 – Block C2 domains across your environment
 – Enable Google Play Protect and restrict sideloading
 – Deploy Mobile Threat Defense (MTD) controls
 – Raise awareness against APKs shared via messaging apps

Stay vigilant. Stay secure. For full technical insights, contact CYFIRMA.

Link to the Research Report: https://www.cyfirma.com/research/rto-challan-fraud-a-technical-report-on-apk-based-financial-and-identity-theft/

#CyberSecurity #ThreatIntelligence #AndroidMalware #MobileSecurity #RTOChallanScam #FinancialFraud #CyberAwareness #CyberCrime #CTI #InfoSec #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/