Weekly Intelligence Report – 02 May 2025

Published On : 2025-05-02

Ransomware of the Week

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – which could be relevant to your organization.

Type: Ransomware
Target Technologies: MS Windows
Target Geography: Argentina, Egypt, Panama, Italy, Japan.
Target Industry: Manufacturing, Healthcare, Real estate.

Introduction
CYFIRMA Research and Advisory Team has found Gunra Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

Gunra Ransomware
Gunra is a ransomware that encrypts data and demands a ransom for decryption. Upon infecting a system, Gunra encrypts files, appending a “.ENCRT” extension to filenames. Following encryption, it generates a ransom note titled “R3ADM3.txt.”

The ransom note informs victims that files have been encrypted and sensitive business data stolen. Decryption requires purchasing a key and software. Victims are allowed to decrypt several files for free as proof. They are given five days to respond, with threats of data leakage on the dark web if they refuse or delay payment. Tampering with files is strongly discouraged.

Following are the TTPs based on the MITRE Attack Framework.

Tactic	ID	Technique
Execution	T1047	Windows Management Instrumentation
Execution	T1129	Shared Modules
Persistence	T1176	Software Extensions
Persistence	T1542	Pre-OS Boot
Persistence	T1542.003	Bootkit
Persistence	T1574	Hijack Execution Flow
Privilege Escalation	T1055	Process Injection
Privilege Escalation	T1548	Abuse Elevation Control Mechanism
Privilege Escalation	T1574	Hijack Execution Flow
Defense Evasion	T1014	Rootkit
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1027.002	Software Packing
Defense Evasion	T1027.005	Indicator Removal from Tools
Defense Evasion	T1036	Masquerading
Defense Evasion	T1055	Process Injection
Defense Evasion	T1542	Pre-OS Boot
Defense Evasion	T1542.003	Bootkit
Defense Evasion	T1548	Abuse Elevation Control Mechanism
Defense Evasion	T1564	Hide Artifacts
Defense Evasion	T1564.001	Hidden Files and Directories
Defense Evasion	T1574	Hijack Execution Flow
Credential Access	T1003	OS Credential Dumping
Credential Access	T1539	Steal Web Session Cookie
Credential Access	T1552	Unsecured Credentials
Credential Access	T1552.001	Credentials in Files
Credential Access	T1555	Credentials from Password Stores
Credential Access	T1555.003	Credentials from Web Browsers
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Discovery	T1497.001	Virtualization/Sandbox Evasion: System Checks
Discovery	T1518	Software Discovery
Collection	T1005	Data from Local System
Collection	T1119	Automated Collection
Collection	T1185	Browser Session Hijacking
Command and Control	T1071	Application Layer Protocol
Command and Control	T1090	Proxy
Impact	T1486	Data Encrypted for Impact
Impact	T1490	Inhibit System Recovery
Impact	T1496	Resource Hijacking

Relevancy and Insights:

• This ransomware specifically targets the widely used Windows Operating System, which is prevalent across numerous industries and organizations.
• Detect-Debug-Environment: Debugging environments are used by developers to analyze and troubleshoot software. The ransomware uses this technique to determine whether it is operating in a debug environment. This feature aids the ransomware in avoiding analysis and detection attempts.
• Calls to WMI: The ransomware is making calls to the Windows Management Instrumentation (WMI) framework. WMI is a powerful tool used by many legitimate applications and services, but it can also be exploited by malware to execute commands, collect information, or perform system modifications.
• The ransomware’s attempt to delete Volume Shadow Copies (VSS) indicates a deliberate effort to hinder data recovery options for victims.

ETLM Assessment:
CYFIRMA’s assessment, based on available data, indicates that Gunra ransomware is poised to expand its operations globally, posing a serious threat to critical infrastructure sectors. Leveraging tactics such as data encryption, theft, and extortion, Gunra is expected to target both developed and developing regions to maximize financial returns. Its use of high-pressure ransom demands and threats of data leaks suggests a focus on organizations with valuable assets. Gunra is projected to remain a persistent and evolving global threat, necessitating strengthened cybersecurity measures.

Sigma Rule
title: Shadow Copies Deletion Using Operating Systems Utilities
tags:
– attack.defense-evasion
– attack.impact
– attack.t1070
– attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’
selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’
selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’
selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet
selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’
selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’
CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*)
fields:
– CommandLine
– ParentCommandLine
falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)
level: high

Indicators of Compromise
Kindly refer to the IOCs section to exercise controls on your security systems.

STRATEGIC RECOMMENDATION

• Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
• Ensure that backups of critical systems are maintained which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATION

• A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority. 
• Enable zero-trust architecture and multifactor authentication (MFA) to mitigate the compromise of credentials.
• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATION

• Update all applications/software regularly with the latest versions and security patches alike.
• Add the Sigma rules for threat detection and monitoring which will help to detect anomalies in log events, identify and monitor suspicious activities.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

Trending Malware of the Week

Type: Trojan
Objective: Remote Access, Data exfiltration
Target Geography: Japan
Exploited Vulnerability: CVE-2025-0282

Active Malware of the Week
This week “DslogdRAT” is trending.

DslogdRAT
Researchers recently discovered that DslogdRAT malware was being used in attacks against organizations in Japan. The malware and a web shell were installed by exploiting a zero-day vulnerability (CVE-2025-0282), giving attackers remote control over infected systems. DslogdRAT can perform various actions, such as uploading and downloading files, executing malicious code, and setting up proxies. It also gathers basic information from compromised devices and sends it back to the attackers to support further malicious activity.

Attack Method
A web shell written in Perl was used as part of the attack to gain control over compromised systems. The script operated as a CGI program, checking incoming HTTP requests for a specific cookie value. When the correct token was detected, it allowed attackers to execute arbitrary commands sent through the request. This technique enabled the attackers to run malware like DslogdRAT on the targeted systems, helping them establish deeper control during the intrusion.

Upon execution, DslogdRAT’s main process spawns a child process before terminating itself. The first child process decodes the configuration data and then creates a second child process, which handles the core functionality of the malware. The first child process enters a loop, including sleep intervals, preventing it from being terminated. The second child process establishes communication with the command-and-control (C2) server, using the configuration data to initiate this connection. It then creates a worker thread to manage the data exchange with the C2 server and execute various commands. These threads are managed through the pthread library, allowing the malware to maintain ongoing communication and perform malicious activities remotely.

The configuration data for DslogdRAT is encoded and hardcoded within the malware, using XOR encoding with a key of 0x63 to decode it. Once decoded, the data reveals that DslogdRAT is set to operate between 8:00 AM and 8:00 PM, remaining in a sleep state outside these hours. This scheduling appears to be a deliberate tactic by the attackers, likely intended to reduce the risk of detection by limiting the malware’s activity to business hours.

DslogdRAT’s Communication Method and Commands
Once DslogdRAT establishes communication with the C2 server, it uses a simple XOR encoding and decoding process to exchange data. During the initial communication, the malware sends basic information about the infected host. It then waits for further commands from the server, which can include file uploads and downloads, execution of shell commands, and setting up proxy functionality. The encoding mechanism helps the malware obfuscate its communications, making it harder to detect while maintaining its ability to carry out malicious activities on the compromised system. The following are the commands supported by DslogdRAT:

INSIGHTS

• DslogdRAT malware has emerged as a significant threat to organizations, particularly in targeted attacks where attackers gain remote access to systems through sophisticated methods. By exploiting vulnerabilities, such as zero-day flaws, attackers can silently infiltrate networks and establish persistent control. Once inside, DslogdRAT provides a platform for further malicious activities, often used to maintain long-term access and execute commands without detection. Its ability to operate covertly during specific hours helps minimize its chances of being spotted by monitoring systems, making it a difficult threat to combat.
• One of the key dangers of DslogdRAT is its versatility. It enables attackers to perform a wide range of malicious actions once a system is compromised. This can include stealing sensitive data, disrupting operations, or using the infected device as a foothold to launch additional attacks across the network. The malware’s ability to execute arbitrary commands remotely, download and upload files, and set up proxies can be exploited in various ways depending on the attacker’s objectives. This makes DslogdRAT a highly adaptable tool for cybercriminals and threat actors.
• Recent findings suggest that DslogdRAT may be part of a broader threat landscape. Another malware, identified as SPAWNSNARE, was found on the same compromised system, raising the possibility of a larger, coordinated campaign. While a direct link to the SPAWN malware family operated by UNC5221 remains unconfirmed, this overlap highlights how DslogdRAT could be integrated into multi-stage attacks. Its use of encrypted communications and persistent C2 connectivity makes it a strong candidate for advanced threat operations aligned with long-term, high-value intrusions.

ETLM ASSESSMENT
From the ETLM perspective, CYFIRMA anticipates that DslogdRAT is likely to evolve into a more stealthy and persistent threat, making it harder for organizations to detect and remove. As attackers refine their ability to mimic normal system behavior and limit activity to business hours, they may succeed in staying hidden for extended periods, increasing the risk of prolonged data exposure or silent surveillance. This could lead to widespread data breaches, service disruptions, and unauthorized surveillance across various sectors.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.

STRATEGIC RECOMMENDATION

• Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more, by identifying such patterns.
• Periodically conduct vulnerability assessments to help minimize gaps.
• Configure organization’s intrusion detection systems (IDS), intrusion prevention systems (IPS), or any network defence mechanisms in place to alert on — and upon review, consider blocking connection attempts to and from — the external IP addresses and domains listed in the appendix.

MANAGEMENT RECOMMENDATION

• Enable security monitoring, security incident detection, notification, and alerting by leveraging SIEM solutions.
• Conduct regular security checks of your server and internet-facing assets.
• Effective implementation of security initiatives that encompass awareness building and training across the organization.

TACTICAL RECOMMENDATION

• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
• Exercise VAPT (Vulnerability Assessment and Penetration Testing) assessments on the website to identify and fix security weaknesses & loopholes.
• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.

Weekly Intelligence Trends/Advisory

1. Weekly Attack Type and Trends

Key Intelligence Signals:

• Attack Type: Ransomware Attacks, Malware Implant, Vulnerabilities & Exploits, Data Leaks.
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware – Qilin Ransomware, Brain Cipher Ransomware | Malware – DslogdRAT
• Qilin Ransomware– One of the ransomware groups.
• Brain Cipher Ransomware – One of the ransomware groups.
• Please refer to the trending malware advisory for details on the following:
• Malware – DslogdRAT
• Behaviour –Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

Sophisticated Earth Kurma Cyber Espionage Targets Southeast Asia’s Public and Telecom Sectors

• Threat Actor: Earth Kurma
• Attack Type: Malware Implant
• Objective: Espionage, Credential Theft.
• Target Technology: Windows OS, Cloud Services, Network Infrastructure.
• Target Geographies: Southeast Asian countries like the Philippines, Vietnam, Thailand, and Malaysia.
• Target Industries: Software Development, Information Technology (IT), Financial Services, Semiconductor Manufacturing, Telecommunications Industries.
• Business Impact: Data exfiltration, Operational disruption.

Summary:
The Earth Kurma APT campaign targets government and telecommunications sectors in Southeast Asia, utilizing a sophisticated set of malware and tools for cyberespionage. The attackers, active since at least 2020, primarily focus on data exfiltration through trusted cloud services such as Dropbox and OneDrive. Their operations involve using advanced custom malware, rootkits, and tools designed to evade detection, maintain persistence, and exploit the infrastructure of compromised organizations.

The attackers deploy keyloggers, such as KMLOG, to capture sensitive credentials. Persistence is achieved through loaders like DUNLOADER, TESDAT, and DMLOADER, which enable the continuous deployment of payloads and further malware installation. These loaders are designed to operate stealthily, employing techniques such as reflective loading and in-memory execution to avoid detection by security software.

Rootkits, including KRNRAT and MORIYA, are used to hide the attackers’ activities at the kernel level. MORIYA, for instance, intercepts and injects malicious code into TCP traffic, while KRNRAT serves as a backdoor with features like process manipulation and traffic concealment. These rootkits ensure that the attackers remain undetected while maintaining control over compromised systems.

For data exfiltration, Earth Kurma employs tools like SIMPOBOXSPY and ODRIZ to upload stolen documents to cloud storage services. The exfiltration process is highly targeted, focusing on documents with specific extensions such as .pdf, .docx, and .xlsx, which are archived and encrypted before being uploaded. The attackers leverage native Windows mechanisms like Distributed File System Replication (DFSR) to move exfiltrated files across the network and ensure they reach external servers.

This APT campaign highlights the persistent threat of state-sponsored cyberattacks, with a clear focus on strategic espionage using advanced malware and cloud services to evade detection and exfiltrate sensitive data. Effective mitigation requires securing network protocols, auditing critical directories, and enforcing strict driver installation policies.

Relevancy & Insights:
The Earth Kurma APT campaign, identified by researchers, targets government and telecommunications sectors in Southeast Asia using a stealthy and persistent malware ecosystem. While the exact initial access vector remains unknown due to delayed discovery, the group employs customized loaders (DUNLOADER, TESDAT, DMLOADER), rootkits (MORIYA, KRNRAT), and malware such as Cobalt Strike beacons for post-compromise persistence, lateral movement, and espionage. They use open-source tools like WMIHACKER, LADON, and FRPC for reconnaissance and privilege escalation, and tools like KMLOG for credential theft. Earth Kurma exfiltrates sensitive documents using Dropbox and OneDrive via custom tools SIMPOBOXSPY and ODRIZ, leveraging the Windows DFSR mechanism for stealthy data replication. Their malware TTPs align partially with known APTs such as ToddyCat and Operation TunnelSnake, though attribution remains inconclusive.

ETLM Assessment:
Earth Kurma is a sophisticated advanced persistent threat (APT) group known for targeting government and telecommunications sectors across Southeast Asia, particularly in countries such as the Philippines, Vietnam, Thailand, and Malaysia. Active since at least November 2020, the group specializes in cyber espionage, employing tailored malware and rootkits to infiltrate networks and extract sensitive information. Notably, Earth Kurma makes strategic use of public cloud services like Dropbox and OneDrive to discreetly exfiltrate stolen data, blending seamlessly into legitimate network traffic to evade detection.

The group uses sophisticated malware, including tools like TESDAT, SIMPOBOXSPY, KRNRAT, and MORIYA, along with rootkits and loaders to maintain persistence within victim networks. They target various vulnerabilities in the infrastructure and rely on advanced evasion techniques to avoid detection. Previously, similar tools were linked to other APT groups, but Earth Kurma operates independently with a tailored approach.

Looking forward, CYFIRMA assesses that the threat is expected to persist, with adaptive techniques and evolving toolsets to bypass security measures, making it critical for organizations to strengthen defenses and actively monitor for advanced threats.

Recommendations:

Strategic Recommendations

• Update and enforce security policies that specifically address the risks posed by targeted cyber-espionage activities, particularly within government and telecommunications sectors.
• Create a strategy of layering security controls in the organization to make it difficult for adversaries to carry out reconnaissance, exploiting a weakness in the system and potential exfiltration of data.
• Establish a robust security posture that is thoughtfully layered with a series of security mechanisms and controls in the network to protect the confidentiality, integrity, and availability of critical data.

Tactical Recommendations

• Regularly audit and review access controls to ensure that only authorized personnel can access sensitive government and telecommunications data.
• Utilize advanced endpoint detection and response (EDR) solutions to monitor for signs of rootkit activity, such as unusual network traffic or unauthorized process manipulation.
• Regularly scan for and analyze malware signatures associated with Earth Kurma’s toolset (e.g., KRNRAT, MORIYA, DUNLOADER).
• Ensure that kernel-level monitoring is implemented to detect anomalies related to rootkit activities, which are difficult to detect through traditional antivirus tools.

Operational Recommendations

• Secure all sensitive communications within the organization, especially those related to government and telecommunications data, using end-to-end encryption.
• Ensure that users are educated about the risks of downloading untrusted files or opening attachments, which could trigger the infection chain.

MITRE ATT&CK Tactics and Techniques
Tactics	ID	Technique
Initial Access	T1078.004	Valid Accounts: Cloud Accounts
Execution	T1059	Command and Scripting Interpreter
Execution	T1129	Shared Modules
Persistence	T1574	Hijack Execution Flow
Privilege Escalation	T1055	Process Injection
Defense Evasion	T1222	File and Directory Permissions Modification
Defense Evasion	T1564.001	Hidden Files and Directories
Credential Access	T1056	Input Capture
Discovery	T1082	System Information Discovery
Discovery	T1518.001	Security Software Discovery
Collection	T1056	Input Capture
Command and Control	T1071	Application Layer Protocol

IOCs:
Kindly refer to the IOCs (Indicators of Compromise) Section to exercise controls on your security systems.

3. Major Geopolitical Developments in Cybersecurity

Russian hackers target Dutch and French critical infrastructure
The Dutch Military Intelligence and Security Service (MIVD) has issued a warning about increased cyber activity by Russian state-sponsored threat actors targeting the Netherlands’ critical infrastructure, according to The Record. The agency revealed that in 2023, Russian hackers attempted to sabotage the “digital operating system of a public facility” in the country. Although the attack caused no damage, the MIVD noted it was the first known instance of cyber sabotage targeting such a control system within the Netherlands.

Meanwhile, in a rare and direct accusation, France’s Ministry for Europe and Foreign Affairs publicly condemned cyberattacks linked to APT28, a hacking group associated with Russia’s military intelligence agency, the GRU. The ministry stated it “condemns in the strongest possible terms” the actions of the group, also known as Fancy Bear.

French officials reported that APT28 has been conducting cyber operations against approximately ten French entities since 2021. Targets included government services, private companies, and a sports organization involved in preparations for the Olympics.

APT28, active since at least 2004, has a history of high-profile cyberattacks, including the 2015 breach of French TV station TV5Monde and interference in France’s 2017 presidential election. The group has also targeted institutions in Germany, Poland, and across Europe and the U.S., employing tactics such as phishing, brute-force attacks, and exploiting zero-day vulnerabilities. According to France’s national cybersecurity agency (ANSSI), the group often uses inexpensive, easily obtained infrastructure—like rented servers and VPNs—to mask its activities and hinder attribution.

ETLM Assessment:
France’s decision to go public with the accusations comes amid heightened geopolitical tensions and growing concern over Russia’s ongoing invasion of Ukraine. President Emmanuel Macron said that Western allies plan to intensify pressure on Moscow over the next 10 days in a bid to force a ceasefire in Ukraine. Earlier this week, Russian President Vladimir Putin announced a so-called “humanitarian” truce in Russia’s war against Ukraine to mark the 80th anniversary of the end of World War II in Europe, which is a ploy to allow him to hold a military parade in Moscow undisturbed.

Spanish Judiciary to Investigate Whether Massive Blackout Was a Cyberattack
A massive power outage hit the Iberian Peninsula, disrupting electricity supplies across Spain, Portugal, Andorra, and parts of southern France. Spanish grid authorities indicated that full restoration could take between six and ten hours, while their Portuguese counterparts warned recovery might extend up to a week. The blackout disabled subway systems, phone networks, and traffic lights, severely impacting public transportation and causing major traffic congestion and flight delays throughout the region.

A judge at Spain’s National Court has launched an investigation to determine whether Monday’s nationwide blackout may have been caused by a cyberattack. As part of the inquiry, the judiciary has requested detailed reports from the national cybersecurity agency, the power grid operator, and the national police outlining the circumstances surrounding the outage. In a statement, the court said that although the exact cause of the blackout remains unclear, “cyber terrorism is among the possibilities,” prompting the need for a formal investigation.

With the investigation still ongoing, an electricity company has been hit with a cyber-attack in Nova Scotia, which has affected parts of its Canadian network and servers supporting portions of its business.

ETLM Assessment:
While the attack in Canada has not caused damage to the grid itself and the electricity generation and distribution operations, the blackout in Spain has been the worst in recent decades in all of Europe. As of writing, a cyberattack seems unlikely as the ultimate cause of the blackout, however, the case highlights the increasing vulnerability of interdependent grid operations in the 21st century, while hostile actors like China and Russia are making inroads to critical infrastructure virtually everywhere.

4. Rise in Malware/Ransomware and Phishing

The Qilin Ransomware Impacts MS SUPPLY CHAIN SOLUTIONS (MALAYSIA) SDN. BHD

• Attack Type: Ransomware
• Target Industry: Logistics
• Target Geography: Malaysia
• Ransomware: Qilin Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from Malaysia; MS SUPPLY CHAIN SOLUTIONS (MALAYSIA) SDN. BHD (https[:]//www[.]mscsm[.]com[.]my/), was compromised by Qilin Ransomware. MS Supply Chain Solutions (Malaysia) Sdn Bhd – (MSCSM) is a subsidiary of MITSUI-SOKO Supply Chain Solutions, Inc. This company provides integrated high-quality logistics services such as factory logistics solutions, storage, transport, value-added services, import and export services, and so on. The compromised data consists of sensitive financial data, customer and employee data, confidential personal data, etc. The total size of the compromised data is approximately 183 GB.

The following screenshot was observed published on the dark web:

Relevancy & Insights:

• Qilin (also known as Agenda) is a Ransomware-as-a-Service (RaaS) group first observed in July 2022. It employs a double extortion method, encrypting victims’ data and exfiltrating it, threatening to leak it on their data leak site (DLS) if the ransom is not paid.
• Recently, we observed that the North Korean threat group Moonstone Sleet is using Qilin ransomware in limited attacks, marking the first known use of Qilin by a nation-state actor.
• Qilin maintains variants written in both Golang and Rust, targeting both Windows and Linux operating systems.
• Qilin ransomware now utilizes a hybrid encryption scheme combining AES-256 symmetric encryption with RSA-2048 asymmetric keys, making recovery without the decryption key extremely difficult.
• The Qilin Ransomware group primarily targets countries such as the United States of America, Canada, France, Spain, and the United Kingdom.
• The Qilin Ransomware group primarily targets industries, including Health Care Providers, Business Support Services, Heavy Construction, Manufacturing, and Industrial Machinery.
• Based on the Qilin Ransomware victims list from 1st January 2024 to 30th April 2025, the top 5 Target Countries are as follows:
  
• The Top 10 Industries, most affected by Qilin Ransomware from 1st January 2024 to 30th April 2025 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and focus on speed and evasion make it a particularly dangerous actor.

The Brain Cipher Ransomware Impacts MBM Gulf

• Attack Type: Ransomware
• Target Industry: Construction and Engineering
• Target Geography: United Arab Emirates (UAE)
• Ransomware: Brain Cipher Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from the United Arab Emirates (UAE), MBM Gulf (https[:]//www[.]mbmdubai[.]com/), was compromised by Brain Cipher Ransomware. MBM Gulf is a prominent Mechanical, Electrical, and Plumbing (MEP) services provider based in Dubai, United Arab Emirates (UAE). The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data included confidential emails from company managers, financial reports, details of partnerships with key contractors, and personal information of employees.

The following screenshot was observed published on the dark web:

Relevancy & Insights:

• Brain Cipher ransomware was first identified in June 2024. It employs a double-extortion model, where attackers not only encrypt files but also threaten to leak stolen data if the ransom is not paid.
• Brain Cipher ransomware uses strong AES-256 encryption combined with RSA-2048 to secure encryption keys, making file recovery without the key nearly impossible.
• The ransomware employs various methods to avoid detection, including hiding threads from debuggers and executing them in suspended mode. It also attempts to disable core Windows security services like Windows Defender.
• The Brain Cipher Ransomware group primarily targets countries such as the United States of America, Mexico, Venezuela, the United Kingdom, and the United Arab Emirates.
• The Brain Cipher Ransomware group primarily targets industries such as Manufacturing, Retail, Specialized Consumer Services, Construction, and Government Agencies.
• Based on the Brain Cipher Ransomware victims list from 1st June 2024 to 30th April 2025, the top 5 Target Countries are as follows:
  
• The Top 10 Industries, most affected by the Brain Cipher Ransomware from 1st June 2024 to 30th April 2025 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, Brain Cipher Ransomware represents a growing threat in the cybersecurity landscape, particularly due to its focus on critical infrastructure and government entities. Organizations must enhance their cybersecurity measures, including robust incident response plans and employee training on recognizing phishing attempts, to mitigate risks associated with this evolving threat. Continuous monitoring and updating of security protocols are essential to defend against such sophisticated attacks.

5. Vulnerabilities and Exploits

Vulnerability in Custom Admin-Bar Favorites plugin for WordPress

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Modules and components for CMS
• Vulnerability: CVE-2025- 3868
• CVSS Base Score: 6.1 Source
• Vulnerability Type: Cross-site Scripting
• Summary: The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

Relevancy & Insights:
The vulnerability exists due to insufficient sanitization of user-supplied data in the “menuObject” parameter. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in the user’s browser in the context of a vulnerable website.

Impact:
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change the appearance of the web page, and perform phishing and drive-by-download attacks.

Affected Products:
https[:]//www[.]wordfence[.]com/threat-intel/vulnerabilities/id/417fb507-a414-4bc2-ab01-d6f2fc554350?source=cve

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED PRODUCTS OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies, due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment:
Vulnerability in the Custom Admin-Bar Favorites plugin for WordPress can pose significant threats to user privacy and security. This can impact various industries globally, including technology, media, education, and beyond. Ensuring the security of the Custom Admin-Bar Favorites plugin is crucial for maintaining the integrity and protection of users’ data worldwide. Therefore, addressing these vulnerabilities is essential to safeguarding customized admin toolbar functionalities and ensuring secure, efficient access to favorite links within the WordPress dashboard across different geographic regions and sectors.

6. Latest Cyber-Attacks, Incidents, and Breaches

Space Bears Ransomware attacked and published the data of EVERTECH INSTRUMENTAL CO., LTD

• Threat Actors: Space Bears Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Technology
• Target Geography: Taiwan
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, we observed that Space Bears Ransomware attacked and published the data of EVERTECH INSTRUMENTAL CO., LTD (https[:]//en[.]evertech[.]com[.]tw/) on its dark web website. EVERTECH Instrumental Co., Ltd. (ETI) is a Taiwan-based company that operates as a technology agent, specializing in the flat panel display (FPD) and semiconductor sectors. The company is primarily engaged in the import and distribution of equipment and materials for SEMI/FPD applications, advanced materials, as well as optical and analytical instruments sourced from Japan and Korea. The data breach resulting from the ransomware attack includes the database, financial documents, and personal information of both employees and clients.

Relevancy & Insights:

• Space Bears operates a dedicated leak site that was first identified in April 2024. This site is used to publish stolen data from victims, showcasing the group’s pivot towards data theft as a primary method of extortion.
• Space Bears is associated with the Phobos ransomware-as-a-service (RaaS) operation. The group utilizes similar tactics and tools, including hosting stolen data on their leak site, which has been linked to the Faust operator within the Phobos ecosystem.
• The Space Bears group employs double extortion strategies, where they not only encrypt files but also exfiltrate sensitive data before encryption. If the ransom is not paid, they threaten to leak this data publicly.

ETLM Assessment:
According to CYFIRMA’s assessment, Space Bears ransomware represents a significant threat in the evolving landscape of cybercrime. With its aggressive tactics, association with established ransomware operations like Phobos, and focus on double extortion, organizations are advised to bolster their cybersecurity measures to mitigate risks associated with such attacks. Continuous monitoring of this group’s activities will be essential for understanding their methods and potential impact on various sectors.

7. Data Leaks

ICICI Bank (Saudi Arabia) Customers’ Data Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Finance
• Target Geography: Saudi Arabia
• Objective: Data Theft, Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary:
The CYFIRMA Research team observed that a threat actor claims to be selling sensitive transaction notification data linked to ICICI Bank customers in Saudi Arabia. The dataset reportedly includes debit amounts, account numbers, and dispute resolution contact details.

Malaysia’s Prime Minister’s Data Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Government
• Target Geography: Malaysia
• Objective: Data Theft, Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary:
The CYFIRMA Research team observed that R00TK1T ISC CYBER TEAM claims to have breached the network of Malaysia’s Prime Minister’s Department, exfiltrating over 270GB of data. The group has leaked a folder related to the logistics and facilities sector and announced plans to release the remaining files throughout the week.

Relevancy & Insights:
Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:
R00TK1T ISC CYBER TEAM represents a significant and volatile hacktivist threat actor characterized by its public-facing operations and geopolitically motivated attacks. The group executes disruptive campaigns targeting a diverse range of sectors, including critical infrastructure (telecommunications, aviation), government entities, and multinational corporations across various geographic locations. From a defensive standpoint, R00TK1T highlights the importance of a layered security posture. Continuous monitoring of the external attack surface, prompt patching of identified vulnerabilities, implementation of strong access controls, and monitoring threat intelligence feeds for specific mentions or related TTPs are crucial mitigation strategies.

Recommendations: Enhance the cybersecurity posture by

• Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
• Ensure proper database configuration to mitigate the risk of database-related attacks.
• Establish robust password management policies, incorporating multi-factor authentication and role-based access, to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA Research team observed that a threat actor is offering a database allegedly containing sensitive employee information from a Korean organization.

• Records: 35K employees
• Price: $8,000

Data Includes:

• Name, Address, Zip Code, SSN, Phone, Email
• Passwords, Face Photos, Signature Photos
• Job History, Home Phone, Bank Account Numbers
• School Info, Military Info, Family List, Insurance Details
• Extras: Financial Receipts are also included

The CYFIRMA Research team observed that a threat actor is offering a private phishing kit named XPanel, featuring an admin and affiliate dashboard setup with extensive customization options for real-time data management and campaign automation.

Product:
XPanel (Admin Panel & Affiliate Dashboard)

Admin Panel Features:

• Entry page system (validated and sanitized to prevent SQLi and XSS)
• Statistics page (conversion rates, log stats, daily data visualization)
• Log management (CSV/TXT export, scheduled calls, log editing, responsive pagination)
• Accounting page (due payments, recent transactions)

Affiliate Dashboard Features:

• Entry page system (validated & sanitized)
• Dashboard with total hits, unique visitors, allowed/blocked logs
• Hits management (update stats, filter blocked hits, clear all hits)
• Settings management (spam-URL control, IP and ISP black/whitelists, ASN settings)

Pricing:

• Base Kit: $1000
• Per target site addition: +$350
• Custom feature development available (real login simulation, secure status viewing, etc.)

STRATEGIC RECOMMENDATION

• Attack Surface Management should be adopted by organizations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, active network monitoring, through next generation security solutions and ready to go incident response plan.
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATION

• Take advantage of global Cyber Intelligence providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied and the proper implementation of security technologies, followed by corrective actions remediations, and lessons learned.
• Move beyond the traditional model of security awareness towards improved simulation and training exercises that mimic real attack scenarios, account for behaviours that lead to a compromised, and are measured against real attacks the organization receives.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcoming of EDR and SIEM solutions.
• Detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies and continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATION

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthen defences based on tactical intelligence provided.
• Deploy detection technologies that are behavioural anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security control such as reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

Geography-Wise Graph

Industry-Wise Graph