By CYFIRMA Research First Published on 6 August 2021 EXECUTIVE SUMMARY Russian threat actors are suspected to have leveraged and believed to have exploited a zero-day vulnerability CVE-2021-1879 in the wild leveraging LinkedIn messaging and sending spear-phishing emails with malicious links. Based on our research and analysis, we suspect state-sponsored Russian threat actor – Cozy […]

By CYFIRMA Research First Published on 6 August 2021 EXECUTIVE SUMMARY Russian threat actors are suspected to have leveraged malware/ransomware and are believed to have exploited a zero-day vulnerability CVE-2021-34527. Based on our research and analysis, we suspect state-sponsored Russian threat actor – TA505 or its affiliates to be carrying out these activities targeting multiple […]

By CYFIRMA Research First Published on 27 Apr 2021 Following the coup in Myanmar by the country’s military forces which has detained the elected leader Aung San Suu Kyi and members of her National League for Democracy (NLD) party alleging fraud in the general election, massive protests have been taking place in the country against […]

By CYFIRMA Research First Published on 17 May 2021 Post Japanese government’s announcement to approve the plan of releasing radioactive contaminated water from the Fukushima Daiichi Nuclear Power Plant into the Pacific Ocean by 2023, there have been multiple threats on Twitter since April 13, 2021, from a suspected Anonymous member to protest against this […]

By CYFIRMA Research Large-scale cyberattacks targeting critical infrastructure and operations is back rearing its ugly head, forcing the major oil and gas pipeline operator, Colonial Pipeline Co., of the United States, to shut down its operations covering almost the entire east coast. The 5,500-mile (approximately 8,850 km) pipeline carrying gasoline, diesel, natural gas, and jet […]

Out-of-Band Report 8 Mar 2021 Content 1. Executive Summary 2. Impact 3. Hypotheses 4. Process Flow of SilentFade Malware 5. Malware Toolset and Infection Chain 6. SilentFade: On Platform Persistence 7. SilentFade Group Prosecution by Facebook 8. SilentFade Attribution 9. Facebook Remediation 10. SilentFade: Signs of a Larger Malware Ecosystem 11. Insights 12. Recommendations Executive […]

First published on 16 Dec 2020 A hacker has published a list of one-line exploits that can exfiltrate VPN credentials from nearly 50,000 Fortinet VPN devices. The list of vulnerable targets contains domains that belong to financial institutions and government organizations across many countries including Japan, the US, China, France, India, South Korea, United Kingdom, […]

Microsoft Teams could be targeted by suspected threat actors as they have been observed manipulating and leveraging Microsoft services to gain access to organizations’ networks and to exfiltrate sensitive information stored in it. In the past, Microsoft Teams has been targeted by ransomware operators as it is considered one of the treasure troves of data […]

Kimsuky (aka Velvet Chollima, Black Banshee, and Thallium) is a known N. Korean state-sponsored threat actor. The group has been active since 2012 and targeting businesses and individuals with new phishing themes. It has a history of launching attacks around the world including Japan, the United States, Russia, and European nations. Kimsuky operatives specialize in […]

CYFIRMA research first alerted clients on the increase in open proxy usage as the attack method by known nation-sponsored actor groups in Apr 2020. Since then, these threat actors have accelerated their campaigns targeting a wide mix of industries in Japan as well as other markets. CYFIRMA’s flagship product, DeCYFIR, has been picking up signals […]

As of December 25, CYFIRMA Threat Intelligence team had gathered indicators suggesting that a new wave of the notorious Emotet malware may strike Japan during the year end and the early days of 2020. CTI has deduced that this campaign is motivated by financial gains and is looking to target Japanese companies, government entities and […]

As on November 3, CYFIRMA Threat Intelligence had observed heightened interest in Korean and Russian speaking hacker groups about the PHP-FPM Vulnerability with NGINX tracked as CVE-201911043, an Arbitrary Code Execution Vulnerability. This instance pointed to hackers seemingly working on reconnaissance tools to identify systems at a global scale which are using vulnerable PHP and […]

Between 29 May 2019 – 2 June 2019, CYFIRMA Threat Intelligence have observed Korean and Mandarin speaking hackers showing intense interest in NGINX Webserver in hackers community. Under the active campaign: “LongNeck”, a global reconnaissance exercise was carried out by hackers to discover systems susceptible to vulnerabilities in NGNIX webserver/reverse proxy system. Hackers have successfully […]

AUTHOR CYFIRMA   TOKYO/SINGAPORE, Nov 28, 2018: CYFIRMA releases its Cyber Threat and Risk Predictions for 2019. Kumar Ritesh, CYFIRMA Chairman and CEO says “While 2018 was a year of financially motivated threat actors having a free run against individuals, organizations, institution and countries, we have noticed an increasing trend of state sponsors interested in […]

Over the last 24 hours, CYFIRMA Threat Intelligence has gathered information which indicates that financially motivated Chinese speaking cybercriminals are developing infrastructure for staging phishing campaigns to sell fake Tokyo 2020 Olympics merchandise. These phishing emails abuse Tokyo 2020 Olympics brand and target English and Spanish speaking population. Earlier Observations: On 20th August 2018, CYFIRMA […]

In the last 24 hours, CTI has gathered additional details about the vulnerability CVE-2016-1000031. Once again, we suspect threat actor group BOLIC14 to be exploiting the vulnerability in the wild. On 19th September 2018, CTI have gathered evidences suggesting that threat actor group BOLIC14 is performing large scale passive reconnaissance and targeting thousands of vulnerable […]

Over the last 24 hours, we have gathered additional indicators around LetsDance Ransomware. Antuit Cyber Intelligence Research Team (“ACIRT”) has determined possibility of a Ransomware campaign dubbed as LetsDance targeted towards Japanese organizations. The attack vector is suspected to be fake website/phishing email which downloads an initial malicious payload. This is a multistage ransomware campaign […]

Antuit Cyber Intelligence Research Team (“ACIRT”) has determined a possibility of GDPR Non-Compliant themed phishing campaign which distributes a Data Stealing malware. The phishing email has a zipped attachment which contains a malicious Word document. It further downloads an executable which enables attackers to exfiltrate data from the targeted systems. Our analysis suggests that an […]

On 25th April, Antuit Cyber Intelligence Research Team (“ACIRT”) intercepted communications between threat actors in a few specific hacker forums, indicating a collusion to distribute a Double-Face Cryptominer malware targeting Financial, Energy, Retail and FMCG enterprises. Earlier on 9th May, we had observed additional Indicators of Attack suggesting that the malware is in the wild. […]

Over the last 24 hours, Antuit Cyber Intelligence Research Team (“ACIRT”) have observed an increase in chatter between threat actors in various deep, dark web and hacker forums indicating that they might be planning to launch a new Permanent Lockdown Ransomware campaign targeting Financial Institutions, Retail, Critical Infrastructure and Manufacturing enterprises. There are new evidences […]