CYFIRMA Research

Mobile Threat Alert: GhostGrab Malware!
 
Cybercriminals are getting more sophisticated, and GhostGrab is a clear example. This Android malware doesn’t just steal banking credentials—it can also:

• Run hidden cryptocurrency mining that drains your battery and CPU
• Harvest debit card and online banking login information
• Intercept SMS messages, including one-time passwords (OTPs)
• Collect detailed device and SIM data
• Hide itself and resist removal
• Use phishing pages within apps to trick victims into revealing sensitive information
• Leverage Firebase as a Command & Control (C2) server, making traditional detection more difficult

How to Protect Yourself:

✅ Only download apps from official sources, such as the Google Play Store or, for iOS devices, the Apple App Store
 ✅ Avoid unknown APKs and suspicious links
 ✅ Monitor your bank accounts and SMS activity regularly
 ✅ Keep your device and apps updated
 
Mobile malware is evolving—stay informed, stay protected.

Link to the Research Report: https://www.cyfirma.com/research/ghostgrab-android-malware/

#CYFIRMA #CyfirmaResearch #CyberSecurity #MobileSecurity #AndroidMalware #GhostGrab #CyberThreats #ThreatAlert #ETLM   #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

Critical Alert: CVE-2025-6541 – TP-Link Omada Gateway Remote Command Injection

Organizations using TP-Link Omada Gateway devices must act immediately. This critical vulnerability allows attackers to execute arbitrary OS-level commands via the device web management interface. Exploitation can lead to full device compromise, exposure of credentials, configuration changes, and potential lateral movement within enterprise networks.

Link to the Research Report: https://www.cyfirma.com/research/cve-2025-6541-tp-link-omada-gateway-remote-command-injection-vulnerability-analysis/

#CyberSecurity #TPLink #CVE20256541 #OmadaGateway #RCE #ThreatIntel
#VulnerabilityAlert #NetworkSecurity #CommandInjection #CYFIRMA
#CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

North Korea’s cyber operations are evolving into one of the most significant global sanctions-evasion threats. CYFIRMA's new report, DPRK Sanctions Violations in Cyber Operations Post UN Panel Demise, highlights escalating multi-billion-dollar crypto heists, advanced laundering through cross-chain bridges, widespread IT worker infiltration schemes, direct targeting of defense technologies, and the deepening DPRK–Russia cyber nexus. The findings highlight how geopolitical shifts and fragmented enforcement are shaping a more hostile and resilient DPRK cyber apparatus.

Link to the Research Report: https://www.cyfirma.com/research/dprk-sanctions-violations-in-cyber-operations-post-un-panel-demise/
 
 #CyberThreats #SanctionsEvasion #DPRK #CyberSecurity #ThreatIntelligence #CryptoSecurity #Geopolitics #CyberEspionage #APT #NationalSecurity #ExecutiveIntelligence #CISO #DigitalResilience #ETLM #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement

https://www.cyfirma.com/

CYFIRMA’s Sept 2025 Ransomware Report highlights major evolutions across the ransomware landscape. Akira advanced by bypassing MFA on SonicWall VPNs through OTP seed theft, signalling a move beyond patchable flaws. MalTerminal broke new ground with AI-powered, runtime-generated ransomware payloads, while Scattered Spider reemerged to target financial workflows via AI-driven vishing and VMware ESXi exploits. CountLoader reinforced Russia’s ecosystem with modular, multi-language loaders distributing Cobalt Strike, AdaptixC2, and PureHVNC. HybridPetya escalated the threat to firmware-level extortion, exploiting Secure Boot (CVE-2024-7344) and encrypting the MFT at pre-boot for near-irrecoverable persistence.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-september-2025/

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Akira #MalTerminal #ScatteredSpider #CountLoader #HybridPetya #AIThreats #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM

https://www.cyfirma.com/

CYFIRMA has identified Yurei Ransomware, a Go-based strain engineered for speed, stealth, and irreversible impact.

 It encrypts files with ChaCha20 + ECIES, appends a .Yurei extension, and drops ransom notes _README_Yurei.txt with Tor-based communication channels. Yurei destroys backups, wipes logs, manipulates timestamps, and even self-destructs to erase traces, leaving defenders blind. It spreads laterally via SMB shares, USBs, and PsExec/CIM-based credential execution, while adopting double-extortion tactics threatening both encryption and data leaks.

 Observed since September 2025, the first victim was a Sri Lankan food manufacturer, with samples uploaded from Morocco, Germany, and Turkey, pointing to a global footprint. Code overlaps suggest reuse from Prince Ransomware, reinforcing its professional design.

 Link to the Research Report: https://www.cyfirma.com/research/yurei-ransomware-the-digital-ghost/

#CyberSecurity #ThreatIntelligence #Ransomware #YureiRansomware #IncidentResponse #CYFIRMA #CYFIRMAresearch #ExternalThreatLandscapeManagement #ETLM 

https://www.cyfirma.com/

Malware Alert: New DeerStealer Campaign

A new variant of sophisticated information-stealing malware, DeerStealer, has been identified targeting personal and financial data across infected systems. Using signed binaries, rootkit-like techniques, and deceptive installers (like Adobe Acrobat Reader), it evades detection while maintaining persistence via scheduled tasks.
 
Key highlights:

• Steals system info, credentials, crypto wallets, browser & app data.
• Uses obfuscated files and hidden components for stealth.
• Communicates with C2 servers and can switch servers to avoid detection.
• Sold and supported on dark-web forums and Telegram channels.
• Stay vigilant! Always verify downloads and keep security tools updated.

 Link to the Research Report: https://www.cyfirma.com/research/deerstealer-malware-campaign-stealth-persistence-and-rootkit-like-capabilities/

#CYFIRMA #MalwareAnalysis #InfoStealer #DeerStealer #ThreatIntel #CyberSecurity

https://www.cyfirma.com/

Defence Industry Cyber Threats: Espionage Meets Monetization

CYFIRMA observed sustained cyber campaigns targeting the global defence sector.

Key Highlights from the report:

• China: Long-term persistence in telecom & enterprise networks via router/switch compromises, harvesting IP and credentials.
• Russia: Disrupting logistics & transport contractors supporting Ukraine, aiming to destabilize defence supply chains.
• North Korea: Blending IP theft with aggressive financial operations, treating cybercrime as both a strategy and a revenue stream.
• Iran: Politically motivated intrusions aligned with regional tensions, occasionally spilling into Western-linked suppliers.
• Cybercriminals: Pivoting away from ransomware encryption → toward direct data theft + leak-driven extortion, exploiting misconfigured cloud environments and subcontractor access.
• Hacktivists: Amplifying propaganda through nuisance-level DDoS, often pro-Russian aligned.

Why it matters:
The defence industry is now under dual pressure, espionage-driven persistence and monetization-driven extortion. The underground economy confirms it: data leaks dominate dark web chatter, while ransomware “lock-and-encrypt” tactics are fading. Cloud-native techniques, subcontractor abuse, and living-off-the-land persistence are reshaping how adversaries sustain access and monetize breaches.

Link to the research report: https://www.cyfirma.com/research/cyfirma-defence-industry-threat-report/

#DefenceCyberSecurity #ThreatIntelligence #Espionage #CloudSecurity #SupplyChainRisk #CyberExtortion #RedTeam #BlueTeam #CYFIRMA

https://www.cyfirma.com/

🚨 Threat Intelligence Alert – XillenStealer 🚨
 
CYFIRMA research identifies XillenStealer, a Python-based open-source information stealer circulating on GitHub, built to exfiltrate:
 🔹 Browser credentials & cookies
 🔹 Cryptocurrency wallets
 🔹 Discord, Steam, Telegram sessions
 🔹 System & network data + screenshots

Key insights:
 ⚙️ Builder GUI lowers entry barriers, enabling even low-skilled actors to deploy the malware.
 📤 Data exfiltration is routed via Telegram bots.
 🕵️‍♂️ Anti-analysis, sandbox evasion & persistence mechanisms enhance stealth.
 🌐 Linked to Russian-speaking cybercriminal group “Xillen Killers” offering a suite of offensive tools & services.
🔑 Why it matters: Open-source availability accelerates adoption by threat actors, while also giving defenders valuable visibility to improve detection & mitigation.

✅ Recommendations:
Deploy advanced EDR & monitor unusual traffic to Telegram/Discord.
Enforce MFA & system hardening.
Educate users on phishing & malicious downloads.
Patch, monitor, and back up regularly.
🛡️ Stay proactive. Stay protected.

Link to the Research Report: https://www.cyfirma.com/research/unmasking-a-python-stealer-xillenstealer/

#CyberSecurity #ThreatIntelligence #Malware #XillenStealer #InfoStealer  #Cyfirma

https://www.cyfirma.com/

India faced a wave of coordinated cyberattacks in July-August 2025 from multiple countries targeting government and public systems. Notably, a sophisticated malware campaign impersonated the Income Tax Department, tricking users into downloading a malicious file linked to a Chinese-operated server for data theft.

Other attacks included data breaches, DDoS, defacements, and phishing scams. This rise in multi-nation hacktivism highlights the urgent need for strong cyber defenses and vigilance. Stay alert, verify sources, and protect your data! 
 
Link to the Research Report: https://www.cyfirma.com/research/digital-frontlines-india-under-multi-nation-hacktivist-attack/

#CYFIRMAResearch #CYFIRMA #CyberSecurity #Malware #Phishing  #Hacktivism #IndiaCyberThreats

https://www.cyfirma.com/

Stay ahead with CYFIRMA’s Monthly Ransomware Report – Aug 2025.

CYFIRMA’s August 2025 Ransomware Report recorded 522 global victims, a slight dip but still far above 2023–24 levels. Qilin led with 84 attacks, while Akira surged by 35% targeting SonicWall VPNs and abusing Intel drivers for BYOVD evasion. Charon adopted APT-grade stealth, and 4L4MD4R blended Chinese ToolShell exploits with ransomware deployment. AI abuse accelerated with Claude enabling RaaS and PromptLock showcasing LLM-powered ransomware. Emerging groups Yurei, Desolator, and Anubis expanded globally, with the U.S., Canada, and UK most affected, and professional services, consumer services, and manufacturing hit hardest.

Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-august-2025/

#CyberSecurity #Ransomware #ThreatIntel #ETLM #CYFIRMA #Qilin #Akira #Charon #4L4MD4R #AIThreats

https://www.cyfirma.com/