Weekly Intelligence Report – 19 September 2025

Published On : 2025-09-18

Ransomware of the week

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.

Type:
Ransomware

Target Technologies:
Windows

Target Geographies:
Iran, Germany, USA, Turkey, and Ireland

Target Industries:
Real Estate & Construction, Public Services, Healthcare, and Manufacturing

Introduction
CYFIRMA Research and Advisory Team has found Obscura Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

Obscura Ransomware
Researchers discovered a previously unseen ransomware variant called Obscura, first observed in late August 2025. The ransomware drops a ransom note named README_Obscura.txt, which repeatedly references the Obscura name. In at least one intrusion, the ransomware executable a Go binary was deployed across multiple hosts and staged within the domain controller’s SYSVOL scripts directory, using a filename mimicking the victim’s domain to evade suspicion. Due to limited visibility into the attack, the initial access vector remains unknown, but findings indicate the malware was tailored to blend into the victim environment and facilitate rapid propagation.

The following are the TTPs based on the MITRE Attack Framework

Tactic	Technique ID	Technique Name
Execution	T1129	Shared Modules
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1027.002	Obfuscated Files or Information: Software Packing
Defense Evasion	T1036	Masquerading
Defense Evasion	T1070	Indicator Removal
Defense Evasion	T1070.004	Indicator Removal: File Deletion
Defense Evasion	T1202	Indirect Command Execution
Defense Evasion	T1497	Virtualization/Sandbox Evasion
Defense Evasion	T1497.001	Virtualization/Sandbox Evasion: System Checks
Defense Evasion	T1564	Hide Artifacts
Defense Evasion	T1564.003	Hide Artifacts: Hidden Window
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Discovery	T1497	Virtualization/Sandbox Evasion
Discovery	T1497.001	Virtualization/Sandbox Evasion: System Checks
Lateral Movement	T1080	Taint Shared Content
Collection	T1074	Data Staged
Command and Control	T1090	Proxy
Impact	T1486	Data Encrypted for Impact

Relevancy and Insights:

• The ransomware primarily targets Windows OS, which is utilised by enterprise in a variety of industries.
• This ransomware accessing the Windows Credential Manager to extract stored credentials, including usernames and passwords saved by the user or system. Suspicious access to the credentials history is a technique often used during the credential access phase, where the ransomware attempts to gather authentication data to escalate privileges, disable security tools, or facilitate lateral movement within the network.

ETLM Assessment:
Analyst assessment suggests that the Obscura ransomware operation is in its early stages but poised for rapid evolution. The use of a Go-based binary and deployment via the domain controller’s SYSVOL scripts indicates a focus on scalability and domain-wide impact traits consistent with groups seeking to professionalize. Over time, Obscura may adopt double extortion tactics, establish dedicated leak sites, and expand its targeting across industries beyond its initial victims. The choice of Go also suggests cross-platform ambitions, potentially enabling future Linux variants. If the operators mature their tradecraft and distribution methods, Obscura could evolve into a Ransomware-as-a-Service (RaaS) offering, making it a sustained and adaptable threat in the global ransomware ecosystem.

Sigma rule:
title: Shadow Copies Deletion Using Operating Systems Utilities tags:
– attack.defense-evasion
– attack.impact
– attack.t1070
– attack.t1490 logsource:
category: process_creation product: windows
detection: selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’ selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’ selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’ selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’ selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’ CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*) fields:
– CommandLine
– ParentCommandLine falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high
(Source: Surface Web)

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems.

Strategic Recommendations

• Enforce strong authentication and access controls for critical systems.
• Maintain reliable offline backups to support recovery if ransomware executes.

Management Recommendations

• Create a clear data breach response plan covering data types, storage, remediation, and reporting obligations.
• Deploy Zero-Trust principles and MFA to reduce credential abuse.
• Provide regular employee security training to strengthen awareness.

Tactical Recommendations

• Keep operating systems and applications fully patched and updated.
• Use Sigma rules or similar detections to spot suspicious log activity.
• Continuously monitor and block identified IOCs to limit attacker movement.

Trending Malware of the Week

Type: Loader | Objectives: Malware Distribution |Target Technology: Windows OS | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malware that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the week
This week “HijackLoader” is trending.

Overview of HijackLoader Malware
Researchers identified a spike in recent activity linked to HijackLoader, a malware family that first emerged in the latter half of 2023 and has steadily gained traction since. Initially recognized for its ability to deliver additional payloads, it quickly evolved into a Malware- as-a-Service platform supporting financially motivated operations worldwide. The latest wave of attacks, observed since June 2025, shows how attackers have been using tactics like Clickfix to lure victims into downloading malicious installers. These installers execute HijackLoader and deploy secondary threats such as DeerStealer.

Combined with earlier distribution methods—ranging from SEO-poisoned websites and fake installers to malvertising and pirated content—these campaigns demonstrate the loader’s ability to reach victims through multiple entry points. As HijackLoader continues to refine its approach, it has established itself as more than just a delivery tool. Its sophisticated evasion capabilities and adaptability make it a persistent threat.

Technical Analysis
The initial access starts with a CAPTCHA-based social-engineering campaign called Clickfix. This HTA file serves as the initial downloader and launches successive, heavily obfuscated PowerShell stages that rebuild themselves at runtime and fetch the next component from the web. Analysis shows multiple layers of packed code and environment checks designed to detect virtual machines and frustrate analysis; the final stages then unpack an executable and a protected DLL before reaching out to remote servers. Although the original command links are no longer reachable, the observable behavior matches long-standing loader patterns: a staged delivery that ultimately pulls down information-stealing malware (campaigns have previously delivered families such as NekoStealer and Lumma). In short, the chain relies on social trickery up front and multiple stealthy stages before the final infostealer payload is deployed.

Following are the TTPs based on the MITRE Attack Framework for Enterprise

Tactic	Technique ID	Technique Name
Initial Access	T1566.002	Phishing: Spearphishing Link
Initial Access	T1189	Drive-by Compromise
Execution	T1059.001	Command and Scripting Interpreter: PowerShell
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	T1055	Process Injection
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1140	Deobfuscate/Decode Files or Information
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools
Defense Evasion	T1070.004	Indicator Removal: File Deletion
Defense Evasion	T1211	Exploitation for Defense Evasion
Defense Evasion	T1036	Masquerading
Discovery	T1082	System Information Discovery
Discovery	T1497.001	Virtualization/Sandbox Evasion: System Checks
Collection	T1056	Input Capture
Collection	T1005	Data from Local System
Command and Control	T1071.001	Application Layer Protocol: Web Protocols
Command and Control	T1105	Ingress Tool Transfer

INSIGHTS

• HijackLoader demonstrates how modern malware families are increasingly modular, relying on a chain of components that each handle specific tasks. This design allows attackers to swap or update individual parts without affecting the overall operation, making campaigns more resilient and difficult to fully analyze. Its frequent use of multiple stages also shows a strategic focus on maintaining persistence and operational flexibility.
• The malware’s distribution approach highlights the opportunistic nature of cybercrime today. By combining mainstream tactics like search engine manipulation, malvertising, and the Clickfix CAPTCHA-based campaign with more niche avenues such as pirated content portals, HijackLoader campaigns cast a wide net. This reflects a broader trend where attackers prioritize reach and scale, seeking to exploit both casual internet users and those actively looking for free or “convenient” content.
• Another notable aspect is the integration of varied malware families into a single delivery ecosystem. HijackLoader’s ability to carry multiple secondary threats — from information stealers to remote access tools — illustrates the value attackers place on multi-functional operations. Rather than focusing on a single goal, campaigns often mix data theft, system compromise, and evasion techniques, creating a versatile platform that can serve different criminal objectives simultaneously.

ETLM ASSESSMENT
From the ETLM perspective, CYFIRMA anticipates that as HijackLoader continues to evolve, its campaigns may increasingly affect digital ecosystems at large, including personal devices, cloud services, and online platforms, making everyday users more vulnerable to data theft and account compromise. The malware’s adaptability could lead to more complex, multi-stage attacks that evade traditional security measures, resulting in broader disruptions and potential loss of trust in online services. In addition, the proliferation of sophisticated social-engineering tactics may normalize deceptive practices, creating an environment where digital interactions are more frequently exploited and harder to navigate safely.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.

YARA Rule
rule HijackLoader_Indicators
{
meta:
description = “Detects HijackLoader malware indicators” author = “CYFIRMA”
malware_family = “HijackLoader”
strings:
// SHA256 File Hashes
$sha256_1 = “1b272eb601bd48d296995d73f2cdda54ae5f9fa534efc5a6f1dab3e879014b57”
$sha256_2 = “37fc6016eea22ac5692694835dda5e590dc68412ac3a1523ba2792428053fbf4”
$sha256_3 = “3552b1fded77d4c0ec440f596de12f33be29c5a0b5463fd157c0d27259e5a2df”
$sha256_4 = “782b07c9af047cdeda6ba036cfc30c5be8edfbbf0d22f2c110fd0eb1a1a8e57d”
$sha256_5 = “921016a014af73579abc94c891cd5c20c6822f69421f27b24f8e0a044fa10184”
$sha256_6 = “e2b3c5fdcba20c93cfa695f0abcabe218ac0fc2d7bc72c4c3af84a52d0218a82”
$sha256_7 = “52273e057552d886effa29cd2e78836e906ca167f65dd8a6b6a6c1708ffdfcfd”
$sha256_8 = “c03eedf04f19fcce9c9b4e5ad1b0f7b69abc4bce7fb551833f37c81acf2c041e”
$sha256_9 = “D0068b92aced77b7a54bd8722ad0fd1037a28821d370cf7e67cbf6fd70a608c4”
$sha256_10 = “50258134199482753e9ba3e04d8265d5f64d73a5099f689abcd1c93b5a1b80ee”
// IP Addresses
$ip_1 = “91.212.166.51”
$ip_2 = “37.27.165.65”
// Domains
$domain_1 = “cosi.com.ar”
// URLs
$url_1 = “https://1h.vuregyy1.ru/3g2bzgrevl.hta”
$url_2 = “https://rs.mezi.bet/samie_bower.mp3”
$url_3 = “http://77.91.101.66/”
condition:
any of ($sha256*) or any of ($ip*) or
any of ($domain*) or any of ($url*)
}

Recommendations:

STRATEGIC:

• Maintain an up-to-date inventory of all active software used within the organization and perform regular self-audit of workstations, servers, laptops, mobile devices to identify unauthorized/ restricted software.
• Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Configure organization’s intrusion detection systems (IDS), intrusion prevention systems (IPS), or any network defence mechanisms in place to alert on — and upon review, consider blocking connection attempts to and from — the external IP addresses and domains listed in the appendix.

MANAGEMENT:

• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.
• Move beyond the traditional model of security awareness towards Improved Simulation and training exercises that mimic real attack scenarios, account for behaviors that lead to a compromise, and are measured against real attacks the organization receives.

TACTICAL RECOMMENDATIONS

• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
• Enable network protection to prevent applications or users from accessing malicious domains and other malicious content on the internet.
• Add the Yara rules for threat detection and monitoring which will help to detect anomalies in log events and identify and monitor suspicious activities.

CYFIRMA’S WEEKLY INSIGHTS

1. Weekly Attack Types and Trends

Key Intelligence Signals:

• Attack Type: Ransomware Attacks, Spear-Phishing, Vulnerabilities & Exploits, Malware implant, Data Leaks.
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware – Medusa Ransomware, The Gentlemen Ransomware | Malware – HijackLoader
• Medusa Ransomware– One of the ransomware groups.
• The Gentlemen Ransomware – One of the ransomware groups.
  Please refer to the trending malware advisory for details on the following:
• Malware – HijackLoader
  Behavior – Most of these malware use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

Tracking Mustang Panda: Expansion of Cyber Capabilities and Regional Focus

• Threat Actor: Mustang Panda
• Attack Type: Connection Proxy, Credential Dumping, DLL Sideloading, USB, Exploitation of Vulnerability, Spear-Phishing
• Objective: Information theft, Espionage
• Suspected Target Technology: Air Gapped systems, Office Suites Software, Operating System, Web Application, Citrix NetScaler
• Suspected Target Geography: Australia, India, Japan, South Korea, Taiwan, Thailand, US, Vietnam, Myanmar, Philippines, Mongolia, Pakistan
• Suspected Target Industries: Critical Infrastructure, Government, NGOs, Religion, Think Tanks
• Business Impact: Compromised user accounts, Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor
Mustang Panda, a Chinese state-linked espionage group active since at least 2012, conducts disciplined, geopolitically driven intelligence operations characterized by rapid tradecraft evolution and long-running persistence. Its campaigns typically begin with targeted spear-phishing—politically themed messages carrying ZIP, RAR, LNK, or URL lures—then deploy multi-stage payloads (initial loaders or stagers that deliver backdoors, reverse shells, and lateral-movement tools). Common toolsets include PlugX, Poison Ivy, ToneShell, StarProxy, Claimloader, and SplatCloak, with operators favouring DLL sideloading and encrypted C2 channels for stealth and persistence; some operations have also used infected USB drives to propagate. Mustang Panda is a capable, adaptive actor that blends careful targeting with modular malware to maintain long-term access to high-value networks.

Details on Exploited Vulnerabilities

CVE ID	Affected Products	CVSS Score	Exploit Links
CVE-2023- 4966	NetScaler ADC and NetScaler Gateway	7.5	link
CVE-2021- 1675	Microsoft Windows	7.8	link1, link2, link3
CVE-2021-40444	Microsoft Windows	7.8	link1, link2, link3

TTPs based on MITRE ATT&CK Framework

Tactic	ID	Technique
Reconnaissance	T1598.003	Phishing for Information: Spear phishing Link
Resource Development	T1585.002	Establish Accounts: Email Accounts
Resource Development	T1608	Stage Capabilities
Resource Development	T1608.001	Stage Capabilities: Upload Malware
Resource Development	T1588.004	Obtain Capabilities: Digital Certificates
Resource Development	T1583.002	Acquire Infrastructure: Domains
Initial Access	T1091	Replication Through Removable Media
Initial Access	T1566.001	Phishing: Spear phishing Attachment
Initial Access	T1566.002	Phishing: Spear phishing Link
Execution	T1059.003	Command and Scripting Interpreter: Windows Command Shell
Execution	T1059.005	Command and Scripting Interpreter: Visual Basic
Execution	T1059.001	Command and Scripting Interpreter: PowerShell
Execution	T1203	Exploitation for Client Execution
Execution	T1053.005	Scheduled Task/Job: Scheduled Task
Execution	T1204.001	User Execution: Malicious Link
Execution	T1204.002	User Execution: Malicious File
Execution	T1047	Windows Management Instrumentation
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Persistence	T1546.003	Event Triggered Execution: Windows Management Instrumentation Event Subscription
Persistence	T1574.001	Hijack Execution Flow: DLL
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	T1546.003	Event Triggered Execution: Windows Management Instrumentation Event Subscription
Privilege Escalation	T1574.001	Hijack Execution Flow: DLL
Privilege Escalation	T1053.005	Scheduled Task/Job: Scheduled Task
Defense Evasion	T1480	Execution Guardrails
Defense Evasion	T1564.001	Hide Artifacts: Hidden Files and Directories
Defense Evasion	T1574.001	Hijack Execution Flow: DLL
Defense Evasion	T1070.004	Indicator Removal: File Deletion
Defense Evasion	T1036.005	Masquerading: Match Legitimate Resource Name or Location
Defense Evasion	T1036.007	Masquerading: Double File Extension
Defense Evasion	T1036.004	Masquerading: Masquerade Task or Service
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1027.013	Obfuscated Files or Information: Encrypted/Encoded File
Defense Evasion	T1027.016	Obfuscated Files or Information: Junk Code Insertion
Defense Evasion	T1553.002	Subvert Trust Controls: Code Signing
Defense Evasion	T1218.004	System Binary Proxy Execution: InstallUtil
Defense Evasion	T1218.005	System Binary Proxy Execution: Mshta
Defense Evasion	T1218.014	System Binary Proxy Execution: MMC
Defense Evasion	T1218.007	System Binary Proxy Execution: Msiexec
Credential Access	T1003.003	OS Credential Dumping: NTDS
Discovery	T1083	File and Directory Discovery
Discovery	T1057	Process Discovery
Discovery	T1518	Software Discovery
Discovery	T1082	System Information Discovery
Discovery	T1016	System Network Configuration Discovery
Discovery	T1049	System Network Connections Discovery
Lateral Movement	T1091	Replication Through Removable Media
Collection	T1557.004	Adversary-in-the-Middle: Evil Twin
Collection	T1560.001	Archive Collected Data: Archive via Utility
Collection	T1119	Automated Collection
Collection	T1560.003	Archive Collected Data: Archive via Custom Method
Collection	T1074.001	Data Staged: Local Data Staging
Command and Control	T1071.001	Application Layer Protocol: Web Protocols
Command and Control	T1219.002	Remote Access Tools: Remote Desktop Software
Command and Control	T1573.001	Encrypted Channel: Symmetric Cryptography
Command and Control	T1105	Ingress Tool Transfer
Command and Control	T1102	Web Service
Command and Control	T1090	Proxy
Command and Control	T1095	Non-Application Layer Protocol
Exfiltration	T1052.001	Exfiltration Over Physical Medium: Exfiltration over USB

Latest Developments Observed
The threat actor is suspected of deploying an advanced variant of the Toneshell backdoor capable of evading conventional detection systems, along with a newly identified USB-propagating malware, SnakeDisk, designed to specifically target devices in Thailand. The campaign’s primary objective appears to be the exfiltration of sensitive information.

ETLM Insights
Mustang Panda is a China-linked espionage group engaged in long-term intelligence collection targeting governments, NGOs, and strategic industries across Central, East, and Southeast Asia. The group employs sophisticated tactics, including localized spear- phishing campaigns with geopolitical themes, multi-stage deployment chains, USB/removable media propagation, and custom malware implants. Their operations are characterized by stealth and persistence, enabling the gradual exfiltration of sensitive and strategic intelligence. Mustang Panda’s activities are assessed to align with broader state intelligence objectives and long-term strategic ambitions designed to challenge U.S. global leadership.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.

YARA Rules
rule MustangPanda_Threat_Indicators
{
meta:
description = “Detects presence of indicators related to threat activity using CVEs, IPs, domains, and suspicious executables”
author = “CYFIRMA” date = “2025-09-15”
threat_actor = “Likely Mustang Panda or related threat group”
strings:
// Suspicious executables
$exe1 = “myp0912.exe” nocase
$exe2 = “rens.exe” nocase
$str1 = “eqfvkn”
// Suspicious domains
$domain1 = “www.profile-keybord.com”
$domain2 = “www.dest-working.com”
$domain3 = “www.ynsins.com”
$domain4 = “www.aihkstore.com”
$domain5 = “jcswcd.com”
// CVE references in exploits
$cve1 = “CVE-2023-4966”
$cve2 = “CVE-2021-1675”
$cve3 = “CVE-2021-40444”
// IP addresses (can appear in config files, C2 beacons, etc.)
$ip1 = “139.59.46.88”
$ip2 = “45.152.66.25”
$ip3 = “103.159.132.91”
$ip4 = “23.216.147.76”
condition:
any of ($exe*) or any of ($domain*) or any of ($cve*) or any of ($ip*) or
$str1
}

Recommendations

Strategic

• Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
• Deploy Zero Trust Policy that leverages tools like security information management, advanced security analytics platforms, security user behaviour analytics, and other analytics systems to help the organization’s security personnel observe in real-time what is happening within their networks so they can orient defences more intelligently.
• Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more by identifying such patterns.

Management

• Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.
• Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.

Tactical

• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening the defence based on the tactical intelligence provided.
• For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
• Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
• Apply security measures to detect unauthorized activities, protect sensitive production, and process control systems from cyberattacks.
• Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events, identify, and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

China-Linked APT41 Hackers Target US Trade Officials During 2025 Negotiations.
The House Select Committee on China has issued a formal advisory warning of an “ongoing” series of highly targeted cyber espionage efforts related to the People’s Republic of China (PRC), amidst tense US-China trade talks.

These campaigns seek to compromise organizations and individuals involved in U.S.- China trade policy and diplomacy, including U.S. government agencies, U.S. business organizations, D.C. law firms and think tanks, and at least one foreign government, according to the committee.

The committee noted that suspected Chinese threat actors impersonated Republican Party Congressman John Robert Moolenaar in phishing emails sent to trusted counterparts in order to deceive and trick them into opening files and links that would grant them unauthorized access to their systems and sensitive information without their knowledge.

The attacks’ ultimate purpose was to steal important data by exploiting software and cloud services to hide evidence of their activity, a method frequently used by state- sponsored hackers to avoid detection.

The attack is thought to be the work of APT41, a prominent hacking group renowned for targeting many industries and locations for cyber espionage.

ETLM Assessment:
By impersonating Rep. Moolenaar (R-MI), a known Beijing critic, the attackers created urgency and legitimacy that encouraged fast responses.

Political communication goes beyond official government equipment and accounts. Sophisticated enemies recognize this truth and deliberately exploit it. By impersonating trustworthy officials via personal or non-official channels, attackers circumvent established security protections while increasing legitimacy.

North Korean Hackers Used ChatGPT to Help Generate Deepfake ID
A suspected North Korean state-sponsored hacking group used ChatGPT to build a deepfake of a military ID paper before attacking a target in South Korea.

The notorious group, Kimsuky, is suspected of being tasked by the North Korean leadership with gathering worldwide intelligence, and it has been tied to prior surveillance operations against South Korean targets.

The attackers employed an artificial intelligence technique to build a false draft of a South Korean military identification card in order to create a realistic-looking image that would make a phishing effort appear more believable. Instead of including an actual image, the email contained a link to malware capable of extracting data from the recipients’ devices. The number of victims violated was not immediately clear.

The pattern indicates that attackers can use emerging AI during the hacking process, such as attack scenario preparation, malware development, tool building, and impersonating job recruiters.

During their investigation into the bogus identification document, researchers used ChatGPT. Because duplication of government IDs is unlawful in South Korea, ChatGPT first refused to create an ID. But changing the prompt allowed them to get around the prohibition.

ETLM Assessment:
Researchers’ July discoveries are the most recent example of suspected North Korean spies using AI to acquire intelligence. In August, researchers reported that North Korean hackers used the Claude Code program to be hired and work remotely for US Fortune 500 software companies. In that case, Claude assisted them in creating sophisticated phony identities, passing coding tests, and performing actual technical work once employed.

According to American officials, North Korea has been attempting to obtain intelligence on behalf of the Pyongyang regime through cyberattacks, cryptocurrency theft, and IT contractors for quite some time. According to the US administration, these approaches are also employed to raise funds to assist the regime in circumventing international sanctions and developing its nuclear weapons programs.

The request for comment was not immediately responded to by OpenAI personnel. In February, the business announced that it had suspended suspected North Korean accounts that had used the service to construct bogus résumés, cover letters, and social media posts in an attempt to attract people for their schemes.

4. Rise in Malware/Ransomware and Phishing

Medusa Ransomware Impacts TEAM GROUP

• Attack Type: Ransomware
• Target Industry: Engineering and Management Consulting
• Target Geography: Thailand
• Ransomware: Medusa Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from Thailand, TEAM GROUP (https[:]//www[.]teamgroup[.]co[.]th/), was compromised by Medusa Ransomware. TEAM GROUP is a leading integrated consulting firm in Thailand and across the region, providing extensive expertise in building and infrastructure, water resources, environmental management, transportation and logistics, and power and energy. The compromised data includes confidential and sensitive information belonging to the organization. The total size of the compromised data is approximately 2.25 TB.

Relevancy & Insights:

• Medusa ransomware has been active since late 2021 and has quickly established itself as a major player in the ransomware space, employing a double extortion strategy. Once inside, Medusa uses strong encryption methods (AES-256 and RSA-2048) to secure files, rendering them inaccessible without the decryption key held by the attackers.
• The Medusa Ransomware group primarily targets countries like the United States of America, the United Kingdom, Canada, Germany, and Australia.
• The Medusa Ransomware group primarily targets industries, such as Consumer Goods & Services, Healthcare, Professional Goods & Services, Manufacturing, and Government & Civic.
• Based on the Medusa Ransomware victims list from 1st Jan 2025 to 17th September 2025, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the Medusa Ransomware victims list from 1st Jan 2025 to 17th September 2025 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, Medusa Ransomware continues to pose a significant threat across various sectors. The group’s sophisticated tactics and aggressive demands highlight the need for organizations to enhance their cybersecurity measures, including regular updates, employee training on phishing recognition, and robust incident response plans to mitigate risks associated with ransomware attacks.

The Gentlemen Ransomware Impacts Flexofast Indonesia

• Attack Type: Ransomware
• Target Industry: Logistics
• Target Geography: Indonesia
• Ransomware: The Gentlemen Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from Indonesia, Flexofast Indonesia (https[:]//www[.]flexofast[.]com/), was compromised by the Gentlemen Ransomware.

Flexofast serves as a premier logistics partner for brands and companies in Indonesia, providing innovative and customized solutions to enhance their operational capabilities. The compromised data includes confidential and sensitive information belonging to the organization.

Relevancy & Insights:

• The Gentlemen ransomware is a recently emerged, highly sophisticated threat group.
• The Gentlemen Ransomware group primarily targets countries such as the United States of America, Argentina, France, India, and Indonesia.
• The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Healthcare, Materials, Information Technology, and Consumer Goods & Services.
• Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 17th September 2025, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 17th September 2025 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen ransomware group exemplifies the rising sophistication and persistence of modern ransomware actors, necessitating tailored enterprise defenses and vigilant threat monitoring.

5. Vulnerabilities and Exploits

Vulnerability in Spring Security

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Server application
• Vulnerability: CVE-2025-41248
• CVSS Base Score: 7.5 Source
• Vulnerability Type: Protection Mechanism Failure
• Summary: The vulnerability allows a remote attacker to gain access to sensitive information.

Relevancy & Insights:
The vulnerability exists since the annotation detection mechanism does not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics.

Impact:
A remote attacker can gain access to sensitive information.

Affected Products:
https[:]//spring[.]io/security/cve-2025-41248

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

TOP 5 MOST AFFECTED TECHNOLOGIES OF THE WEEK

ETLM Assessment
Vulnerabilities in Spring Security, the powerful authentication and access-control framework for Java applications, can expose systems to serious risks. Exploitation of such flaws may lead to issues like authentication bypass, privilege escalation, session fixation, or exposure of sensitive data.

6. Latest Cyber-Attacks, Incidents, and Breaches

Killsec Ransomware attacked and published the data of Nathan and Nathan

• Threat Actor: Killsec Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Business Services / HR & Employment Services
• Target Geography: The United Arab Emirates (UAE)
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, we observed that Killsec Ransomware attacked and published the data of Nathan and Nathan (https[:]//www[.]nathanhr[.]com/) on its dark web website. Nathan and Nathan is a global leader in delivering customized HR, staffing, and technology solutions that enable businesses to excel in today’s dynamic market.

Operating across 45+ countries, Nathan offers expertise in managed HR services, staffing, PEO/EOR solutions, and advanced AI-driven HR technology. With a strong focus on compliance, flexibility, and efficiency, Nathan helps organizations optimize operations, attract top talent, and scale seamlessly. The data leak, following the ransomware attack, encompasses sensitive and confidential records originating from the organizational database.

Relevancy & Insights:

• KillSec is a ransomware group that has gained notoriety for its ransomware-as- a-service (RaaS) model and a series of high-profile attacks.
• KillSec Ransomware employs various sophisticated methods to infiltrate systems, including phishing attacks, exploiting known vulnerabilities, and using custom malware to maintain persistence within compromised networks.

ETLM Assessment:
The emergence and evolution of KillSec’s Ransomware-as-a-Service (RaaS) platform represents a concerning development in the cybercrime landscape. By lowering the technical barrier to entry, this RaaS model allows less skilled individuals to engage in sophisticated ransomware attacks, potentially leading to an increase in such incidents globally.

According to CYFIRMA’s assessment, the KillSec ransomware group is expected to continue targeting a wide range of industries worldwide. Their advanced tactics, such as exploiting website vulnerabilities and conducting credential theft, make them a significant threat to organizations with inadequate security measures in place.

7. Data Leaks

PS&KP Motor’s Data Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Automotive
• Target Geography: Thailand
• Objective: Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary:
The CYFIRMA Research team observed that a threat actor has allegedly leaked the database of PS&KP Motor, a car dealership operating in Thailand. The breach has exposed a significant amount of sensitive personal and vehicle information, raising serious concerns about the privacy and security of the dealership’s customers.

PS&KP Motor is a local automotive business in Thailand involved in the sale of vehicles, and the leaked data appears to be related to its customer relationship management and sales operations.

The compromised data, displayed in screenshots from the database, allegedly contains a wide array of confidential information. The exposure of such detailed records could place affected individuals at a high risk of identity theft, targeted phishing campaigns, and other fraudulent activities. The inclusion of both personal identifiers and specific vehicle details provides malicious actors with a powerful combination of data for sophisticated scams.

An analysis of the samples shared by the threat actor reveals that the following information has allegedly been compromised:

• Customer Full Names
• Phone Numbers
• Residential Addresses
• Vehicle Details (Make, Model, Color, License Plate)
• Vehicle Identification Numbers (VIN)
• Internal notes on sales and customer interactions
• Financial details related to vehicle purchases
• Line Messenger IDs and profile information

Dubai’s Ports Customs, and Free Zone Corporation’s (PCFC) Data Advertised on a Leak Site

• Attack Type: Data leak
• Target Industry: Government
• Target Geography: The United Arab Emirates (UAE)
• Objective: Data Theft, Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary:
The CYFIRMA Research team has identified that a threat actor “Kazu” has allegedly breached the Ports, Customs and Free Zone Corporation (PCFC), a critical government authority based in Dubai, United Arab Emirates. The PCFC is a cornerstone of the emirate’s economy, responsible for integrating and overseeing trade, logistics, customs, and free zone activities, including major entities like Dubai Customs and the Jebel Ali Free Zone (JAFZA). According to a post on a dark web forum, the cybercriminal claims to have exfiltrated 1.94 TB of data from the corporation’s Security Department during September 2025 and is offering it for sale for $50,000.

The scale of the alleged breach is substantial, reportedly involving over 13 million files. The threat actor provided a detailed list of the types of sensitive information contained within the stolen dataset, which poses a significant risk to individuals and businesses associated with the PCFC. The contents allegedly include a vast amount of Personally Identifiable Information (PII) and official documentation. The specific data types listed for sale are:

• PII Data: Pass Reference No, Port, Entry Gate, Pass Type, Pass Duration, Purpose of Visit, Date of Visit, Status, Visit Reason, Title, First Name, Last Name, Nationality, Mobile Phone, Email, Date of Birth, Designation, Visa Type, Company Name, Vehicle Type, Vehicle Number, Driving License No
• Entry Pass for Entry Permit (For Individual) – PDF files
• Payment Receipt – PDF files
• Scanned Documents: Driving License, Emirates ID Cards, Face Images, Visas, Passports, Trade Licenses, Safety Induction Documents, and other supporting business documents.

Relevancy & Insights:
Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:
The threat actor “Kazu” has recently emerged as a notably active group engaged in data leak activities. Credible sources have tied the group to multiple security breaches involving unauthorized system access and attempts to sell stolen data on dark web marketplaces. The group’s ongoing operations illustrate the persistent and escalating cyber threats stemming from underground forums. These incidents reinforce the critical need for organizations to bolster cybersecurity through continuous monitoring, advanced threat intelligence, and proactive defense strategies to protect sensitive data and critical infrastructure.

Recommendations: Enhance the cybersecurity posture by:

1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
2. Ensure proper database configuration to mitigate the risk of database-related attacks.
3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA Research team observed that Ready2Host, a web hosting services provider based in India, has allegedly become the victim of a significant data breach. A threat actor recently posted on a dark web forum, claiming to have exfiltrated and leaked the company’s entire customer database. The leaked data, shared publicly in a CSV file format, reportedly contains 23,400 lines of customer information, exposing the company’s clientele to potential cyber threats.

An initial analysis of the data sample suggests that sensitive customer information has been compromised. While the passwords in the database appear to be hashed, the exposure of other personally identifiable information (PII) puts customers at risk of phishing, spam, and targeted social engineering attacks. The exposed data allegedly includes:

• Full Names
• Phone Numbers
• Hashed Passwords
• User Timestamps

STRATEGIC RECOMMENDATIONS

• Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Delay a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response plan.
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATIONS

• Take advantage of global Cyber Intelligence providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions remediations, and lessons learned.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM solutions.
• Detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies and continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATIONS

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Consider using security automation to speed up threat detection, improved incident response, increased the visibility of security metrics, and rapid execution of security checklists.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence provided.
• Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security control such as reCAPTCHA (completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

Geography-Wise Graph

Industry-Wise Graph

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.