CYFIRMA Research

CYFIRMA | November 2025 Ransomware Snapshot

Ransomware activity shifted fast in November—Akira and INC Ransom surged; AI-driven tools accelerated attacks, and critical sectors like Manufacturing, IT, and Professional Services took the heaviest hits. North America remained the top target as threat actors expanded into virtualization platforms and even official software marketplaces.

The ransomware ecosystem is evolving rapidly—speed, automation, and precision are defining the new threat landscape.

Link to the Research Report: TRACKING RANSOMWARE : NOVEMBER 2025 - CYFIRMA

#CYFIRMA #ThreatIntelligence #Ransomware #CyberSecurity #CyberThreats  #InfoSec #AIThreats #Malware #DigitalRisk #SecurityOps #CISO #RiskManagement #CyberDefense #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

APT36 Targets Indian Government Entities with a New Python-Based ELF Malware.

CYFIRMA has uncovered a new cyber-espionage campaign by APT36 (Transparent Tribe), a Pakistan-based threat actor long known for targeting Indian government entities and strategic sectors.

This campaign showcases a major leap in the group’s technical sophistication — delivering custom Python-based ELF malware through weaponized .desktop shortcut files distributed via spear-phishing.

📌 Key Highlights:
The campaign begins with a malicious ZIP file containing a deceptive .desktop shortcut.
Once executed, the shortcut downloads:
A decoy PDF to distract the user
A malicious ELF payload (swcbc)
A persistence-enabling shell script (swcbc.sh)

The malware establishes C2 communication, executes shell/Python commands, steals files, takes screenshots, and maintains persistence.

Infrastructure used includes Lionsdenim[.]xyz and 185.235.137.90, both tied to APT36’s ongoing espionage operations.

The ELF implant is a PyInstaller-packed RAT, supporting cross-platform execution on both Linux and Windows.

Link to the Research Report: APT36 Python Based ELF Malware Targeting Indian Government Entities - CYFIRMA

#CyberSecurity #ThreatIntel #APT36 #MalwareAnalysis #IndianGovernment   #LinuxMalware #CYFIRMA #CyberEspionage #ThreatResearch #ELFMalware   #PyInstaller #TransparentTribe #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

After Russia’s veto of the UN Panel of Experts and increased military cooperation over the war in Ukraine, North Korea is ramping up sanctions evasion—deepening its military ties with Moscow and stealing billions in cryptocurrency to finance its WMD programs.

Link to the Research Report: NORTH KOREAN CYBER CRIME AS A STATECRAFT TOOL - CYFIRMA

#NorthKorea #Russia #sanctions #cryptoheist #Geopolitics #CYFIRMAResearch#ThreatIntelligence #cybersecurity #ETLM #currentaffairs #CYFIRMA   #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Black Friday & Cyber Monday Cyber Threats Are Already Here

As festive shopping surges, so does cybercrime. CYFIRMA’s latest analysis reveals a spike in fake websites, phishing campaigns, malicious ZIP downloads, UPI-based payment scams, and dark-web-powered phishing kits—all engineered to exploit the 2025 holiday rush.

Our researchers uncovered multiple spoofed retail domains, automated malware downloads, and dynamic UPI-ID switching techniques used by scammers to evade detection. With Phishing-as-a-Service (PhaaS) now mainstream, launching a professional-looking scam takes little effort.
 
Key Threats This Season:
• Counterfeit shopping websites & mobile apps
• Phishing + smishing campaigns impersonating major retailers
• Malvertising & fake social media promotions
• Supply-chain exploitation & payment workflow manipulation
• Mobile commerce and digital-wallet abuse
• Advanced UPI-based scam infrastructure
• Fraudulent gift card schemes
 
Stay Protected: verify URLs, strengthen payment security, avoid unknown downloads, enable MFA, monitor transactions, and stay aware of evolving scam patterns.

Link to the Research Report: Rising Cybercrime During Black Friday & Cyber Monday : A 2025 Threat Intelligence Report - CYFIRMA

#CyberSecurity #BlackFriday #CyberMonday #ThreatIntelligence #CyberAwareness #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement
#ETLM

https://www.cyfirma.com/

Tycoon 2FA - The Phishing-as-a-Service Platform

Our latest technical deep-dive reveals how Tycoon 2FA, a sophisticated Phishing-as-a-Service (PhaaS) platform, is successfully evading detection and bypassing multi-factor authentication (MFA) to compromise enterprise cloud environments.

This isn't just another phishing kit. It's an Adversary-in-the-Middle (AitM) framework that captures session tokens in real-time, making traditional MFA like SMS, TOTP apps, and push notifications ineffective.

Key Findings:
✅ Uses CAPTCHA gates to deter scanners & appear legitimate.
✅ Clones Microsoft, Gmail, and Outlook login flows with high fidelity.
✅ Employs a rapid domain-rotation system to evade blocklists.
✅ Displays fake "Sign-In Blocked" errors to delay victim response.

Mitigation is critical. Organizations must move beyond legacy MFA and adopt phishing-resistant authentication.

Link to the Research Report: Tycoon 2FA: A Technical Analysis of its Adversary-in-the-Middle Phishing Operation - CYFIRMA

#Cybersecurity #ThreatIntelligence #Phishing #MFA #InfoSec #CloudSecurity #Tycoon2FA #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Pig-butchering scams have evolved into one of the most damaging global cybercrime models, combining long-term emotional grooming, AI-driven impersonation, fake investment platforms, and sophisticated crypto-laundering networks.
 
Our latest CYFIRMA Threat Intelligence Report breaks down:
 
How global scam compounds operate like industrial-scale BPOs
The role of AI-generated personas, fake trading apps, and cross-chain laundering
Tens of billions are lost annually across victims of all ages
Emerging risk: manipulation of executives leading to organizational compromise
Evidence linking operations to transnational criminal groups and militia-protected scam zones
Detailed TTPs, MITRE mapping, forensic workflows & detection models
Strategic, tactical, and operational recommendations for SOC, TI, financial institutions, crypto exchanges, and regulators
 
These scams are no longer “romance fraud”—they represent a global cyber-financial threat ecosystem capable of destabilizing individuals, families, and even regulated institutions.

Link to the Research Report: PIG BUTCHERING SCAMS : CYBERCRIME THREAT INTELLIGENCE - CYFIRMA

#CYFIRMA #Pigbutcheringscams #ETLM #Externalthreatlandscapemanagement #CYFIRMAResearch #Threatintelligence

https://www.cyfirma.com/

The Middle East observes a fragile ceasefire, but Iran’s escalating cyberattacks could potentially threaten to unravel the region’s shaky peace.

Link to the Research Report: Regional Stability on Shaky Ground : Cyber Threat Escalation in the Middle East - CYFIRMA

#Geopolitics #CYFIRMAaResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MuddyWater #IRGC #Iran #CYFIRMA #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA Research's latest report: “Telemetry Relay”, describes logic-abuse attacks that trick telemetry/crash processors into fetching attacker-controlled resources. Instead of compromising clients, attackers get vendor or enterprise systems to reveal internal metadata (IPs, hostnames, cluster/tenant IDs) — and sometimes enable deeper server-side attacks. The technique is low-noise and broadly relevant across SaaS and modern apps.
 
Link to the Research Report: TELEMETRY RELAY : WHEN DIAGNOSTICS TURN AGAINST YOU - CYFIRMA
 
#CyberSecurity #ThreatIntelligence #Ransomware #CYFIRMA #CYFIRMAresearch #ExtrnalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s Monthly Ransomware Report – October 2025.

CYFIRMA’s October 2025 Ransomware Report reveals a strong resurgence in global ransomware activity, with 738 victims recorded marking one of the highest monthly volumes this year. The spike was led by Qilin, which more than doubled its attacks, and Sinobi, which surged sixfold, while new actors such as Black Shrantac, Coinbase Cartel, and GENESIS intensified the threat landscape.

Adversaries increasingly exploited kernel vulnerabilities, runtime environments, and abused code-signing certificates to evade detection, reflecting the growing sophistication of hybrid attack models. The most targeted industries included Professional Services, Manufacturing, Information Technology, and Healthcare, with the U.S. remaining the primary focus. Notably, incidents like the Asahi Breweries breach underscore a clear shift from data theft to industrial disruption, as ransomware continues to evolve into a tool for large-scale business sabotage.

Link to the Research Report: TRACKING RANSOMWARE : OCTOBER 2025 - CYFIRMA

#CYFIRMA #Ransomware #ThreatIntelligence  #CyberSecurity #ETLM #DataExtortion #DarkWeb #Malware #InfoSec  #DigitalRisk #CyberDefense #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

New Malware Analysis Report

Our latest research uncovers Android/BankBot-YNRK, a mobile banking trojan disguised as a legitimate app such as Google News.

Key findings:
• Abuses Accessibility Services for remote control
• Uses C2 servers at ping.ynrkone[.]top for device commands
• Targets financial and cryptocurrency applications
• Employs code obfuscation via nmm-protect
• Capable of exfiltrating sensitive data and performing unauthorized transactions

Link to the Research Report: https://www.cyfirma.com/research/investigation-report-android-bankbot-ynrk-mobile-banking-trojan/

 #MalwareAnalysis #Android #BankBot #CyberSecurity #CYFIRMAResearch #ThreatResearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/