EXECUTIVE SUMMARY This report provides a glimpse into the evolving landscape of RAT development and malicious activities performed by threat actors working under name of ‘Anonymous Arabic’. Our team investigated the Silver RAT (written in C sharp) which has capabilities to bypass anti-viruses and covertly launch hidden applications, browsers, keyloggers, and other malicious activities. The […]

EXECUTIVE SUMMARY This report provides a glimpse into the evolving landscape of RAT development and malicious activities performed by threat actors working under name of ‘Anonymous Arabic’. Our team investigated the Silver RAT (written in C sharp) which has capabilities to bypass anti-viruses and covertly launch hidden applications, browsers, keyloggers, and other malicious activities. The […]

Unknown Nation-Based Threat Actor Using Android RAT to Target Indian Defence Personnel Executive Summary The CYFIRMA research team recently detected a malicious android APK targeting Indian Defence Personnel. Our research revealed that the attack has been active since July 2021. The APK file in this case is a decoy copy of a promotion letter to […]

Phishing Attacks Leverage Deceptive Website Builders to Target AT&T Users Executive Summary The CYFIRMA research team observed threat actors using free website builders to clone and deceive popular brand websites for phishing attacks. This research paper will detail how phishing attacks targeting AT&T users leverage free website builders like Google Sites and Weebly Sites. Attack […]

Fortinet Authentication Bypass Vulnerability Exploited by Threat Actors EXECUTIVE SUMMARY A critical Authentication Bypass Vulnerability in Fortinet Appliances tracked as CVE-2022-40684 has been discovered to be actively exploited in the wild. An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiOS, FortiProxy, and FortiSwitchManager could allow an unauthenticated attacker to perform administrative […]

Infostealer Prynt Malware a Deep Dive into Its Process Injection Technique EXECUTIVE SUMMARY CYFIRMA Research team has seen an uptick in threat actor orchestrated cyber campaigns aimed at stealing confidential and sensitive information. Infostealers like “Prynt” are used to exfiltrate information as the first step leading into orchestration of sophisticated attacks which may include deployment […]

Advanced Social Engineering Attacks Deconstructed EXECUTIVE SUMMARY The team at CYFIRMA has analyzed and researched social engineering attacks in depth. The research paper reports techniques used by various threat actors to initiate the first stage of a deadly cyber-attack. The paper discusses the psychological role, and how it becomes an important part of the social […]

Thousands of TP-Link Routers Vulnerable, Can be Exploited by Multiple Hackers EXECUTIVE SUMMARY As per CYFIRMA’s latest research report, thousands of TP-Link routers being used globally, are still vulnerable and could be exploited by multiple threat actor groups and cybercriminals from China, Russia, and Iran. Attackers can collaborate on exploiting TP-Link routers using the Remote […]

Erbium Stealer Malware Report Executive Summary The Erbium malware is an information-stealer/ info stealer, which is distributed as Malware-as- a-Service (MaaS). CYFIRMA research team observed this malware binary in Aug-2022 while carrying out threat hunting activities. The team has also observed the stealer malware being advertised on Russian-speaking hacker forums. The malware sample we have […]

FIN11 is Back : Impersonates Popular Video Conference Application CYFIRMA research team has observed impersonated web download pages of Zoom Application – which is the most downloaded application in recent years. We believe with moderate confidence that financially motivated FIN11 is behind this campaign. This threat actor is known for conducting a large-scale campaign using […]

HTML smuggling: A Stealthier Approach to Deliver Malware HTML smuggling is a highly evasive technique that abuses legitimate HTML5 and JavaScript features to evade detection and deploy RATs, banking malware, and other malicious payloads. The nation-backed hacking groups and other cyber criminals are extensively using this technique to compromise governments, individuals, and organizations. For example, […]

AsyncRAT and MrAnonymous Backdoor Report Date: 14-July-22 Suspected Malware: AsyncRAT Function: Malware RAT Risk Score: 8 Confidence Level: High Threat actor Associations: Unknown Executive Summary : AsyncRAT is a Remote Access Tool (RAT) created to remotely monitor and manipulate other computers through a secure encrypted connection. It is an open-source remote administration program and has […]

NukeSped RAT Report Suspected Malware: NukeSped Malware Function: RAT Risk Score: 8 Confidence Level: High Threat actor Associations: Lazarus Group (North Korea) Executive Summary: The NukeSped malware is a remote access trojan (RAT) and has been attributed to the threat actor Lazarus Group. The group has been active since 2009 and remain active in 2022 […]

Matanbuchus Loader Report Date: 29-June-22 Author: Manoj Kumar (CYFIRMA-Malware Research Team) Suspected Malware: Matanbuchus Function: malware Loader Risk Score: 8 Confidence Level: High1` Threat actor Associations: BelialDemon DeCyfir presence: Yes Executive Summary: Matanbuchus, offered as part of malware-as-a-service, has been available on underground forums for a rental price of $2500 since February 2021. Recently, the […]

AvosLocker Ransomware Report Suspected Malware: AvosLocker Malware Function: Ransomware Risk Score: 8 Confidence Level: High Threat actor Associations: Unknown First Seen: July 2021   Executive Summary: Ransomware-as-a-service can cause massive disruption to businesses as well as significant financial impact. Attackers behind these services have developed new techniques and attack patterns and this article provides a […]

Threat Actor Profile Threat Actor: TA505 Alias: ATK 103, Chimborazo, Evil Corp, Gold Evergreen, Gold Tahoe, Graceful Spider, Hive0065, SectorJ04, TA 505, TA-505, TA505 Origin: Russia Description: The threat actor is a well-established financial crime group that has recently focused its operations on ransomware and extortion. The group has been active since 2008. They are […]

Phishing Sample Analysis MD5 : 140F716E974CD7483EEAA380A9C4FD82 SHA1 : 4D5B17CA34D8D15FBAE65AB637919E13E72A3476 SHA256 : 4DCED4DDB2FFA1E0E1E9C2F6A2D4B1302CEBCA59E7D340ADA0F2E421288B54FE Motivation : Steal user credentials Recently the CYFIRMA research team has observed an active phishing campaign to steal victims’ credentials. The email contains a malicious attachment in .html format containing an embedded JavaScript which upon execution will bring the user to a fake […]

Recently Observed Campaigns The following list contains recent campaigns observed by CYFIRMA Threat Intelligence (CTI) that are attributed to the MISSION2025 and or its affiliates last seen in 2022. • C Guard • Vision2025 • UNC038 • UNC041 • Think pocket • UNC036 • Uplift19 • Slow Walker • UNC026 • Bupa Street • UNC033 […]

Yashma Ransomware Report Executive Summary: Yashma is a new ransomware seen in the wild since May 2022. This ransomware is the rebranded version of an earlier ransomware named Chaos. The latter has been in the wild since June 2021. After encryption, the Yashma ransomware dropped a ransom note titled “read_it.txt” in each encrypted folder and […]

IOC Analysis of Russian threat actors Nobelium and Wizard Spider The Russian threat actors have been observed to be very active and have targeted multiple organizations in the past. The primary objective of these hacker groups in targeting foreign organizations appears to be to exfiltrate sensitive details to be sold in the grey market or […]