CYFIRMA Research

EXPLORE

Society & Culture

Health & Fitness

© 2024 PodJoint

https://is1-ssl.mzstatic.com/image/thumb/Podcasts211/v4/f8/4c/13/f84c1317-22f3-a01f-99b2-4c83ee69f8c2/mza_9105038198531967979.jpg/600x600bb.jpg

CYFIRMA Research

CYFIRMA

276 episodes

4 days ago

The threat landscape just got more complex. The Scattered LAPSUS$ Hunters-alliance has re-emerged, merging the tactics of notorious groups. This isn’t just a name change; it’s a shift toward professionalized, identity-centric extortion. What you need to know: High-Value Targets: Focused on enterprises with $500M+ revenue, specifically in Cloud, Telecom, and Finance.Identity is the Perimeter: They specialize in "logging in" rather than "hacking in," using advanced vishing (voice phishing) a...

Show more...

All content for CYFIRMA Research is the property of CYFIRMA and is served directly from their servers with no modification, redirects, or rehosting. The podcast is not affiliated with or endorsed by Podjoint in any way.

The threat landscape just got more complex. The Scattered LAPSUS$ Hunters-alliance has re-emerged, merging the tactics of notorious groups. This isn’t just a name change; it’s a shift toward professionalized, identity-centric extortion. What you need to know: High-Value Targets: Focused on enterprises with $500M+ revenue, specifically in Cloud, Telecom, and Finance.Identity is the Perimeter: They specialize in "logging in" rather than "hacking in," using advanced vishing (voice phishing) a...

Show more...

Episodes (20/276)

CYFIRMA Research

CYFIRMA Research- Resurgence of Scattered Lapsus$ Hunters

The threat landscape just got more complex. The Scattered LAPSUS$ Hunters-alliance has re-emerged, merging the tactics of notorious groups. This isn’t just a name change; it’s a shift toward professionalized, identity-centric extortion. What you need to know: High-Value Targets: Focused on enterprises with $500M+ revenue, specifically in Cloud, Telecom, and Finance.Identity is the Perimeter: They specialize in "logging in" rather than "hacking in," using advanced vishing (voice phishing) a...

4 days ago

7 minutes

CYFIRMA Research

CYFIRMA Research- APT36: Multi-Stage LNK Malware Campaign Targeting Indian Government Entities

APT36 Targets Indian Entities Using Weaponized Windows Shortcut Files CYFIRMA has identified a coordinated cyber-espionage campaign attributed to APT36 (Transparent Tribe), a Pakistan-aligned threat actor persistently targeting Indian government entities and strategic sectors. This campaign highlights APT36’s evolving tradecraft, leveraging malicious Windows shortcut (.LNK) files and multi-stage payload delivery to stealthily compromise victim systems while masquerading as legitimate docume...

1 week ago

4 minutes

CYFIRMA Research

CYFIRMA Research- PLAUSIBLE DENIABILITY IN CYBERSPACE: THE STRATEGIC USE OF HACKTIVIST PROXIES

Hacktivist activity is often dismissed as low-sophistication noise, website defacements, DDoS attacks, or online activism. Our latest research argues that this view is increasingly outdated. The report introduces Hacktivist Proxy Operations as a repeatable model of deniable cyber pressure, where ideologically aligned non-state groups apply disruption, narrative amplification, and psychological pressure in ways that align with state geopolitical interests without formal sponsorship or direct...

1 week ago

7 minutes

CYFIRMA Research

CYFIRMA Research- APT36 LNK-Based Malware Campaign Leveraging MSI Payload Delivery

Threat Alert: APT 36 CYFIRMA has identified a targeted malware campaign abusing fake NCERT WhatsApp advisory PDFs to compromise Windows systems. Link to the Research Report: APT36 LNK-BASED MALWARE CAMPAIGN LEVERAGING MSI PAYLOAD DELIVERY - CYFIRMA #APT36 #Cyberthreatintelligence #Malware analysis #Threathunting #Cybersecurity #ETLM #CYFIRMA https://www.cyfirma.com/

2 weeks ago

5 minutes

CYFIRMA Research

CYFIRMA Research- Quishing Campaigns: Advanced QR-Code Phishing Evaluation and Insights

A sophisticated QR-code phishing (“quishing”) campaign is targeting employees with payroll-themed lures, bypassing email security and harvesting credentials via obfuscated, per-victim infrastructure. This trend underscores the growing risk of mobile-based phishing and the need for stronger user awareness and behavior-driven defenses. Link to the Research Report: Quishing Campaigns : Advanced QR-Code Phishing Evaluation and Insights - CYFIRMA #Quishing #Phishing #CyberThreats #...

2 weeks ago

2 minutes

CYFIRMA Research

CYFIRMA Research- NexusRoute: Attempting to Disrupt an Indian Government Ministry

New Research Alert: NexusRoute Campaign Uncovered We’ve uncovered a large-scale Android malware and phishing operation impersonating Indian government services like mParivahan and e-Challan. Threat actors are abusing GitHub to host malicious APKs and fake payment portals, tricking users into sharing OTPs, UPI PINs, and financial details. The malware uses advanced techniques—dynamic loaders, native code, SMS hijacking, screen capture, and persistent background services—to monitor ...

2 weeks ago

6 minutes

CYFIRMA Research

CYFIRMA Research- SeedSnatcher: Dissecting an Android Malware Targeting Multiple Crypto Wallet Mnemonic Phrases

Mobile Threat Alert: Crypto Mnemonic Phrase Stealer SeedSnatcher is a newly uncovered Android malware family targeting the crypto ecosystem, built to steal users’ mnemonic recovery phrases using a sophisticated DisplayOverlay attack Capabilities: Intercepts and exfiltrates seed phrases and private keys from major cryptocurrency walletsPresents deceptive wallet-import screens to lure users into entering their recovery phrasesCommunicates with its command-and-control servers via encrypted Web...

3 weeks ago

4 minutes

CYFIRMA Research

CYFIRMA Research- RTO Challan Fraud A Technical Report on APK-Based Financial and Identity Theft

CYFIRMA researchers have identified a sophisticated Android malware operation spreading via fake RTO Challan/e-Challan notifications shared over WhatsApp. The malicious APK uses two-stage installation, NP-based code obfuscation, and a custom VPN layer to evade detection and maintain persistent control over infected devices. C2 Infrastructure Exposed. Our analysis uncovered two domains used as the campaign’s Command-and-Control (C2) backend: Jsonserv[.]xyz jsonserv[.]biz Both domains ...

4 weeks ago

7 minutes

CYFIRMA Research

CYFIRMA Research- Tracking Ransomware – November 2025

CYFIRMA | November 2025 Ransomware Snapshot Ransomware activity shifted fast in November—Akira and INC Ransom surged; AI-driven tools accelerated attacks, and critical sectors like Manufacturing, IT, and Professional Services took the heaviest hits. North America remained the top target as threat actors expanded into virtualization platforms and even official software marketplaces. The ransomware ecosystem is evolving rapidly—speed, automation, and precision are defining the new threat land...

1 month ago

5 minutes

CYFIRMA Research

CYFIRMA Research- APT36 Python Based ELF Malware Targeting Indian Government Entities

APT36 Targets Indian Government Entities with a New Python-Based ELF Malware. CYFIRMA has uncovered a new cyber-espionage campaign by APT36 (Transparent Tribe), a Pakistan-based threat actor long known for targeting Indian government entities and strategic sectors. This campaign showcases a major leap in the group’s technical sophistication — delivering custom Python-based ELF malware through weaponized .desktop shortcut files distributed via spear-phishing. 📌 Key Highlights: The campaign ...

1 month ago

4 minutes

CYFIRMA Research

CYFIRMA Research: North Korean Cyber Crime as a Statecraft Tool

After Russia’s veto of the UN Panel of Experts and increased military cooperation over the war in Ukraine, North Korea is ramping up sanctions evasion—deepening its military ties with Moscow and stealing billions in cryptocurrency to finance its WMD programs. Link to the Research Report: NORTH KOREAN CYBER CRIME AS A STATECRAFT TOOL - CYFIRMA #NorthKorea #Russia #sanctions #cryptoheist #Geopolitics #CYFIRMAResearch#ThreatIntelligence #cybersecurity #ETLM&nbs...

1 month ago

7 minutes

CYFIRMA Research

CYFIRMA Research: Rising Cybercrime During Black Friday & Cyber Monday- A 2025 Threat Intelligence Report

Black Friday & Cyber Monday Cyber Threats Are Already Here As festive shopping surges, so does cybercrime. CYFIRMA’s latest analysis reveals a spike in fake websites, phishing campaigns, malicious ZIP downloads, UPI-based payment scams, and dark-web-powered phishing kits—all engineered to exploit the 2025 holiday rush. Our researchers uncovered multiple spoofed retail domains, automated malware downloads, and dynamic UPI-ID switching techniques used by scammers to evade detection. With ...

1 month ago

8 minutes

CYFIRMA Research

CYFIRMA Research: Tycoon 2FA- A Technical Analysis of its Adversary-in-the-Middle Phishing Operation

Tycoon 2FA - The Phishing-as-a-Service Platform Our latest technical deep-dive reveals how Tycoon 2FA, a sophisticated Phishing-as-a-Service (PhaaS) platform, is successfully evading detection and bypassing multi-factor authentication (MFA) to compromise enterprise cloud environments. This isn't just another phishing kit. It's an Adversary-in-the-Middle (AitM) framework that captures session tokens in real-time, making traditional MFA like SMS, TOTP apps, and push notifications ineffective...

1 month ago

3 minutes

CYFIRMA Research

CYFIRMA Research- Pig Butchering Scams: Cybercrime Threat Intelligence

Pig-butchering scams have evolved into one of the most damaging global cybercrime models, combining long-term emotional grooming, AI-driven impersonation, fake investment platforms, and sophisticated crypto-laundering networks. Our latest CYFIRMA Threat Intelligence Report breaks down: How global scam compounds operate like industrial-scale BPOs The role of AI-generated personas, fake trading apps, and cross-chain laundering Tens of billions are lost annually across victims of a...

1 month ago

7 minutes

CYFIRMA Research

CYFIRMA Research- Regional Stability on Shaky Ground: Cyber Threat Escalation in the Middle East

The Middle East observes a fragile ceasefire, but Iran’s escalating cyberattacks could potentially threaten to unravel the region’s shaky peace. Link to the Research Report: Regional Stability on Shaky Ground : Cyber Threat Escalation in the Middle East - CYFIRMA #Geopolitics #CYFIRMAaResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #MuddyWater #IRGC #Iran #CYFIRMA #ExternalThreatLandscapeManagement https://www.cyfirma.com/

2 months ago

7 minutes

CYFIRMA Research

CYFIRMA Research- Telemetry Relay: When Diagnostics Turn Against You

CYFIRMA Research's latest report: “Telemetry Relay”, describes logic-abuse attacks that trick telemetry/crash processors into fetching attacker-controlled resources. Instead of compromising clients, attackers get vendor or enterprise systems to reveal internal metadata (IPs, hostnames, cluster/tenant IDs) — and sometimes enable deeper server-side attacks. The technique is low-noise and broadly relevant across SaaS and modern apps. Link to the Research Report: TELEMETRY RELAY : WHEN DI...

2 months ago

6 minutes

CYFIRMA Research

CYFIRMA Research- Tracking Ransomware: October 2025

Stay ahead with CYFIRMA’s Monthly Ransomware Report – October 2025. CYFIRMA’s October 2025 Ransomware Report reveals a strong resurgence in global ransomware activity, with 738 victims recorded marking one of the highest monthly volumes this year. The spike was led by Qilin, which more than doubled its attacks, and Sinobi, which surged sixfold, while new actors such as Black Shrantac, Coinbase Cartel, and GENESIS intensified the threat landscape. Adversaries increasingly exploited kernel v...

2 months ago

3 minutes

CYFIRMA Research

CYFIRMA Research: Android/BankBot- YNRK Mobile Banking Trojan

New Malware Analysis Report Our latest research uncovers Android/BankBot-YNRK, a mobile banking trojan disguised as a legitimate app such as Google News. Key findings: • Abuses Accessibility Services for remote control • Uses C2 servers at ping.ynrkone[.]top for device commands • Targets financial and cryptocurrency applications • Employs code obfuscation via nmm-protect • Capable of exfiltrating sensitive data and performing unauthorized transactions Link to the Research Report: https://w...

2 months ago

3 minutes

CYFIRMA Research

CYFIRMA Research- GhostGrab Android Malware

Mobile Threat Alert: GhostGrab Malware! Cybercriminals are getting more sophisticated, and GhostGrab is a clear example. This Android malware doesn’t just steal banking credentials—it can also: Run hidden cryptocurrency mining that drains your battery and CPUHarvest debit card and online banking login informationIntercept SMS messages, including one-time passwords (OTPs)Collect detailed device and SIM dataHide itself and resist removalUse phishing pages within apps to trick victims int...

2 months ago

5 minutes

CYFIRMA Research

Cyfirma Research- CVE-2025-6541: TP-Link Omada Gateway Remote Command Injection Vulnerability Analysis

Critical Alert: CVE-2025-6541 – TP-Link Omada Gateway Remote Command Injection Organizations using TP-Link Omada Gateway devices must act immediately. This critical vulnerability allows attackers to execute arbitrary OS-level commands via the device web management interface. Exploitation can lead to full device compromise, exposure of credentials, configuration changes, and potential lateral movement within enterprise networks. Link to the Research Report: https://www.cyfirma.com/research/...

2 months ago

4 minutes