Weekly Intelligence Report – 10 October 2025

Published On : 2025-10-10

Ransomware of the week

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows

Introduction
CYFIRMA Research and Advisory Team has found White Lock Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

White Lock Ransomware
Researchers have identified a new ransomware strain known as White Lock, which functions by encrypting user data and appending the .fbin extension to affected files. Once the encryption process is complete, the malware generates a ransom note in a file titled “c0ntact.txt”, where instructions to the victim are provided. The encryption mechanism ensures that files cannot be accessed without the corresponding decryption key held by the attackers, effectively locking the victim out of their own data.

The ransom notes contained in c0ntact.txt informs the victim that their network has been compromised, with both encryption and data exfiltration carried out during the attack. It states that the attackers demand 4 Bitcoin as payment, giving the victim a four-day deadline. The message outlines a sequence of consequences if the ransom is not met notifying customers of the breach, selling the stolen data to competitors, publishing it on the dark web, and eventually releasing it openly online. The note also includes explicit warnings against contacting law enforcement, using third-party recovery tools, or attempting manual decryption, claiming that such actions could result in permanent data loss. Victims are directed to use the Tor Browser to access a provided onion URL, where they are instructed to log in with a client ID to initiate communication with the attackers.

The following are the TTPs based on the MITRE Attack Framework

Tactic	Technique ID	Technique Name
Execution	T1129	Shared Modules
Persistence	T1543.003	Create or Modify System Process: Windows Service
Privilege Escalation	T1134	Access Token Manipulation
Privilege Escalation	T1543.003	Create or Modify System Process: Windows Service
Defense Evasion	T1027.002	Obfuscated Files or Information: Software Packing
Defense Evasion	T1027.005	Obfuscated Files or Information: Indicator Removal from Tools
Defense Evasion	T1027.009	Obfuscated Files or Information: Embedded Payloads
Defense Evasion	T1134	Access Token Manipulation
Defense Evasion	T1140	Deobfuscate/Decode Files or Information
Discovery	T1010	Application Window Discovery
Discovery	T1012	Query Registry
Discovery	T1016	System Network Configuration Discovery
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Discovery	T1518	Software Discovery
Commandand Control	T1071	Application Layer Protocol
Commandand Control	T1090	Proxy
Commandand Control	T1571	Non-Standard Port
Impact	T1486	Data Encrypted for Impact
Impact	T1489	Service Stop
Impact	T1529	System Shutdown/Reboot

Relevancy and Insights:

• The ransomware primarily affects the Windows operating system, which is commonly utilized in enterprise environments across multiple industries.
• Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.

ETLM Assessment:
CYFIRMA’s assessment indicates that White Lock represents an advanced threat blending strategic extortion with operational sophistication. Beyond immediate encryption, its design reflects potential for rapid adaptation, targeting multiple vectors within corporate networks while exploiting gaps in backup strategies and access controls. The malware’s architecture suggests future iterations could incorporate automated lateral movement, enhanced evasion of detection, and streamlined exfiltration pipelines, making containment more challenging and amplifying operational disruption for victims. White Lock as a high-stakes extortion actor that deliberately prioritizes large, enterprise-level victims to maximize payout potential. Its operational profile combining theft with crippling disruption indicates an appetite for high-value targets and negotiable demands far above consumer- or SMB-focused campaigns.

From a strategic perspective, White Lock highlights the increasing convergence of cybercrime and organizational risk management. Its evolution could push ransomware toward service-oriented models, where attack orchestration and leak management become highly scalable. Organizations should therefore prioritize proactive detection frameworks, continuous threat hunting, and resilient recovery planning to counter both present threats and the likely trajectory of similar, more sophisticated malware campaigns.

Sigma rule:
title: Potentially Suspicious Desktop Background Change Via Registry tags:
– attack.defense-evasion
– attack.impact
– attack.t1112
– attack.t1491.001 logsource:
product: windows category: registry_set
detection: selection_keys:
TargetObject|contains:
– ‘Control Panel\Desktop’
– ‘CurrentVersion\Policies\ActiveDesktop’
– ‘CurrentVersion\Policies\System’ selection_values_1:
TargetObject|endswith: ‘NoChangingWallpaper’
Details: ‘DWORD (0x00000001)’ # Prevent changing desktop background selection_values_2:
TargetObject|endswith: ‘\Wallpaper’ selection_values_3:
TargetObject|endswith: ‘\WallpaperStyle’
Details: ‘2’ # Stretch filter_main_svchost:
# Note: Excluding GPO changes Image|endswith: ‘\svchost.exe’
condition: selection_keys and 1 of selection_values_* and not 1 of filter_main_* falsepositives:
– Administrative scripts that change the desktop background to a company logo or other image.
level: medium (Source: Surface Web)

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems.

STRATEGIC RECOMMENDATION

• Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
• Ensure that backups of critical systems are maintained which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATION

• A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
• Enable zero-trust architecture and multifactor authentication (MFA) to mitigate the compromise of credentials.
• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATION

• Update all applications/software regularly with the latest versions and security patches alike.
• Add the Sigma rule for threat detection and monitoring which will help to detect anomalies in log events, identify and monitor suspicious activities.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

Trending Malware of the Week

Type: Trojan | Objectives: Data theft, Financial Fraud | Target Technology: Android OS| Target Industry: Finance sector (banking & crypto services) | Target Geographies: Australia, Malaysia, Singapore, Canada, South Africa, United Kingdom

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malware that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the week
This week “Datzbro” is trending.

Overview of Datzbro Malware
Researchers newly discovered an Android Trojan dubbed Datzbro, a device-takeover malware embedded within a deceptive campaign that exploited seniors through fake Facebook groups promoting “active senior trips” and similar social events. The threat gained global traction after its Command-and-Control builder was leaked online, allowing cybercriminals worldwide to weaponize it freely. Analysis revealed numerous Facebook groups filled with AI-generated posts and images, all posing as genuine communities for seniors in regions such as Australia, Malaysia, Singapore, Canada, South Africa, and the UK. Despite targeting diverse audiences, the uniform content and design across these groups indicates a single coordinated operation, highlighting how cybercriminals are shifting tactics to exploit emotional trust and social connection, turning familiar online spaces into tools for large-scale digital manipulation.

Technical Analysis
The campaign used AI-generated posts in fake Facebook groups to engage seniors, promoting “active senior trips” and similar activities. These posts successfully attracted the target audience, prompting fraudsters to contact interested users via Messenger or WhatsApp and direct them to download a “community” app. In some cases, victims were even asked to pay a sign-up fee, resulting in phishing attempts and theft of card details.

While links for iOS were inactive placeholders, clicking the Google Play button triggered the download of a malicious APK. Researchers observed instances where Datzbro was installed directly on devices, as well as cases where a dropper, such as Zombinder, was used to bypass Android 13+ restrictions, demonstrating the threat actors’ adaptability in reaching their targets.

Once installed, Datzbro provides attackers with extensive remote-control capabilities, allowing access to files, photos, audio, and video. Fraudulent activity is concealed through a “black overlay” feature, which hides any malicious actions from the user while still giving the operator full control of the device.

Additionally, Datzbro focuses on financial exploitation, logging accessibility events related to banking and crypto apps and prompting victims to enter PINs, passwords, and other sensitive credentials. This combination of social engineering and technical capabilities highlights the malware’s dual focus on device takeover and financial theft, making it a significant threat to users worldwide.

Origins and Global Reach
Analysis of Datzbro reveals its roots in China, with debug and logging strings in Chinese and some samples named “最强远控.apk” (“The most powerful remote control”), suggesting the developers’ origin. Unlike typical banking Trojans, Datzbro uses a desktop-
based command-and-control application, which was later leaked online and became accessible to cybercriminals globally. Early campaigns targeted Chinese-speaking users, showing that the malware evolved from a regional threat into one with international distribution and impact.

Following are the TTPs based on the MITRE Attack Framework for Mobile

Tactic	Technique ID	Technique Name
Initial Access	T1660	Phishing
Privilege Escalation	T1626	Abuse Elevation Control Mechanism
Defense Evasion	T1655	Masquerading
Credential Access	T1417.001	Input Capture: Keylogging
Credential Access	T1517	Access Notifications
Discovery	T1421	System Network Connections Discovery
Discovery	T1424	Process Discovery
Discovery	T1426	System Information Discovery
Discovery	T1430	Location Tracking
Collection	T1517	Access Notifications
Collection	T1429	Audio Capture
Collection	T1513	Screen Capture
Collection	T1512	Video Capture
Collection	T1636.003	Protected User Data: Contact List
Collection	T1636.004	Protected User Data: SMS Messages
Command and Control	T1437	Application Layer Protocol
Command and Control	T1509	Non-Standard Port
Command and Control	T1521	Encrypted Channel

INSIGHTS

• The emergence of Datzbro also underscores how cybercriminals are blending social manipulation with cultural familiarity to increase success. By using themes like “active senior trips” and warm community narratives, attackers exploited not just curiosity but also the human desire for belonging and trust. This deliberate emotional framing made the scam harder for victims to recognize as fraudulent and shows how the malware’s success rested as much on psychological tactics as on malicious code.
• Another revealing aspect of Datzbro is the way its underlying infrastructure and tools were leaked and circulated. Rather than a single, closely guarded toolkit, its command-and-control application and builder became widely available, creating a ripple effect where multiple, unrelated actors could weaponize the same capabilities. This mass accessibility didn’t just scale the threat — it fractured it, making attribution and coordinated response more complex as the same malware family appeared under different operators’ hands.
• Finally, the case of Datzbro highlights the operational challenges in tracking modern cybercrime. The coordinated use of AI-generated content across multiple regions and languages, combined with a desktop-based control panel, complicated traditional investigative methods. It represents a growing shift where malicious campaigns resemble legitimate digital marketing efforts — organized, data-driven, and transnational — which in turn makes it harder for platforms, researchers, and authorities to draw clear boundaries around the actors and their operations.

ETLM ASSESSMENT
From the ETLM perspective, CYFIRMA anticipates that campaigns like Datzbro could increasingly affect not just organizations and employees but also everyday users and digital ecosystems at large. As AI-generated content becomes more convincing and malware tools more widely accessible, ordinary users may face higher risks of account compromise, identity theft, and financial fraud even during casual online interactions. Social platforms and online communities could be exploited more frequently as vectors for trust-based manipulation, while cross-border distribution of such malware may challenge law enforcement and cybersecurity coordination. Over time, these trends suggest a growing environment where digital trust is harder to maintain, and the consequences of falling victims extend beyond individuals to families, social networks, and broader online infrastructures.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.

YARA Rule
rule Datzbro_Indicators
{
meta:
description = “Detects Datzbro malware indicators” author = “CYFIRMA”
malware_family = ” Datzbro”
strings:
// SHA256 File Hashes
$sha256_1 = “a57d70b2873d9a3672eda76733c5b2fb96dca502958064fab742cfc074bf0feb”
$sha256_2 = “453b0a62e414e9b40185c63842546fc96e8e1ab3f77d3230b02988dd8834c555”
$sha256_3 = “ed2313bfebe03ff29a7c802ddd471583cc8da76bf5cb9f418ae7d999d6a0b9fb”
$sha256_4 = “fac119c569ba7dd19df9154f22f928cf3f0b0165bbe7d6b11a77215bdfc2a11a”
condition:
any of ($sha256*)
}

Recommendations:

STRATEGIC:

• Implement Mobile Device Management (MDM) policy to enhance corporate data security by monitoring, managing, and securing mobile devices such as laptops, smartphones, and tablets that are used in enterprises.
• Maintain an up-to-date inventory of all active software used within the organization and perform regular self-audit of workstations, servers, laptops, mobile devices to identify unauthorized/ restricted software.
• Configure organization’s intrusion detection systems (IDS), intrusion prevention systems (IPS), or any network defence mechanisms in place to alert on — and upon review, consider blocking connection attempts to and from — the external IP addresses and domains listed in the appendix.

MANAGEMENT:

• Incorporate a written software policy that educates employees on good practices in relation to software and potential implications of downloading and using restricted software.
• Security Awareness training should be mandated for all company employees. The training should ensure that employees:
• Avoid downloading and executing files from unverified sources.
• Move beyond the traditional model of security awareness towards Improved Simulation and training exercises that mimic real attack scenarios, account for behaviors that lead to a compromise, and are measured against real attacks the organization receives.

TACTICAL RECOMMENDATIONS

• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
• Use multi-factor authentication (MFA) to mitigate credential theft and prevent attacker access. Keep MFA always-on for privileged accounts and apply risk- based MFA for normal accounts.
• Evaluate the security and reputation of each piece of open-source software or utilities before usage.
• Enforce policies to validate third-party software before installation.
• Add the Yara rules for threat detection and monitoring which will help to detect anomalies in log events and identify and monitor suspicious activities.

CYFIRMA’S WEEKLY INSIGHTS

1. Weekly Attack Types and Trends

Key Intelligence Signals:

• Attack Type: Ransomware Attacks, Malware Implant, Spear Phishing, Vulnerabilities & Exploits, Data Leaks.
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware – Killsec Ransomware, Medusa Ransomware| Malware – Datzbro
• Killsec Ransomware– One of the ransomware groups.
• Medusa Ransomware – One of the ransomware groups.
  Please refer to the trending malware advisory for details on the following:
• Malware – Datzbro
  Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

The Sandworm Playbook: How APT44 Wages Cyber War

• Threat Actor: APT44 aka Sandworm
• Attack Type: Malware Implant, Exploitation of Vulnerabilities, Zero-Day Exploits, Spear Phishing, Data Wiping, Supply Chain Attacks, Ransomware Attacks, Living off the Land, Credential Theft
• Objective: Information theft, Espionage
• Suspected Target Technology: Office Suites Software, Operating System, Web Application
• Suspected Target Geography: Afghanistan, Angola, Argentina, Australia, Austria, Azerbaijan, Belarus, Belgium, Bulgaria, Cambodia, Canada, China, Colombia, Czech, Denmark, Egypt, France, Georgia, Germany, Ghana, Hungary, India, Iran, Israel, Italy, Kazakhstan, Kyrgyzstan, Latvia, Lithuania, Luxembourg, Moldova, Myanmar, Netherlands, Nigeria, Oman, Norway, Pakistan, Paraguay, Peru, Poland, Portugal, Romania, Russia, Serbia, South Korea, Spain, Sweden, Syria, Thailand, Turkey, UK, Ukraine, USA, Uzbekistan, Vietnam.
• Suspected Target Industries: Electricity, Energy Equipment & Services, Industrial Control Systems (ICS), Power Generation, Government
• Business Impact: Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor
The advanced persistent threat group APT44, also known as Sandworm, is believed to be responsible for the Petya ransomware attack in Ukraine. Their activities were first observed in December 2016, when they targeted Ukrainian financial institutions and critical infrastructure. According to dark web sources, the group also operates under the names TeleBots & Electrum, and is believed to be funded by the Russian government. They maintain close ties with the BlackEnergy group, which was behind the infamous 2015 power outages in Ukraine.

Details on Exploited Vulnerabilities

CVE ID	Affected Products	CVSS Score	Exploit Links
CVE-2025- 0282	Ivanti Connect Secure	9.0	–
CVE-2020- 1472	Microsoft Windows domain controllers	10.0	Link1, link2
CVE-2022-30190	MSDT	7.8	link
CVE-2021-27065	Microsoft Exchange Server	7.8	link1, link2
CVE-2024- 7344	Howyar UEFI Application	8.2	–
CVE-2023-38831	RARLAB WinRAR	7.8	link
CVE-2017-11882	Microsoft Office	7.8	link

TTPs based on MITRE ATT&CK Framework

Tactic	ID	Technique
Reconnaissance	T1592.002	Gather Victim Host Information: Software
Reconnaissance	T1595.002	Active Scanning: Vulnerability Scanning
Reconnaissance	T1589.002	Gather Victim Identity Informati on: Email Addresses
Reconnaissance	T1589.003	Gather Victim Identity Information: Employee Names
Reconnaissance	T1590.001	Gather Victim Network Information: Domain Properties
Reconnaissance	T1591.002	Gather Victim Org Information: Business Relationships
Reconnaissance	T1598.003	Phishing for Information: Spear phishing Link
Reconnaissance	T1593	Search Open Websites/Domains
Reconnaissance	T1594	Search Victim-Owned Websites
Resource Development	T1583	Acquire Infrastructure
Resource Development	T1583.001	Acquire Infrastructure: Domains
Resource Development	T1583.004	Acquire Infrastructure: Server
Resource Development	T1586.001	Compromise Accounts: Social Media Accounts
Resource Development	T1584.004	Compromise Infrastructure: Server
Resource Development	T1584.005	Compromise Infrastructure: Botnet
Resource Development	T1587.001	Develop Capabilities: Malware
Resource Development	T1585.001	Establish Accounts: Social Media Accounts
Resource Development	T1585.002	Establish Accounts: Email Accounts
Resource Development	T1588.002	Obtain Capabilities: Tool
Resource Development	T1588.006	Obtain Capabilities: Vulnerabilities
Resource Development	T1608.001	Stage Capabilities: Upload Malware
Initial Access	T1190	Exploit Public-Facing Application
Initial Access	T1133	External Remote Services
Initial Access	T1195	Supply Chain Compromise
Initial Access	T1195.002	Supply Chain Compromise: Compromise Software Supply Chain
Initial Access	T1199	Trusted Relationship
Initial Access	T1078	Valid Accounts
Initial Access	T1078.002	Valid Accounts: Domain Accounts
Initial Access	T1566.001	Phishing: Spear phishing Attachment
Initial Access	T1566.002	Phishing: Spear phishing Link
Execution	T1059.001	Command and Scripting Interpreter: PowerShell
Execution	T1059.003	Command and Scripting Interpreter: Windows Command Shell
Execution	T1059.005	Command and Scripting Interpreter: Visual Basic
Execution	T1106	Native API
Execution	T1053.005	Scheduled Task/Job: Scheduled Task
Execution	T1072	Software Deployment Tools
Execution	T1047	Windows Management Instrumentation
Execution	T1204.001	User Execution: Malicious Link
Execution	T1203	Exploitation for Client Execution
Execution	T1204.002	User Execution: Malicious File
Persistence	T1098	Account Manipulation
Persistence	T1554	Compromise Host Software Binary
Persistence	T1136	Create Account
Persistence	T1136.002	Create Account: Domain Account
Persistence	T1543.002	Create or Modify System Process: Systemd Service
Persistence	T1543.003	Create or Modify System Process: Windows Service
Persistence	T1133	External Remote Services
Persistence	T1112	Modify Registry
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task
Persistence	T1505.003	Server Software Component: Web Shell
Persistence	T1505.001	Server Software Component: SQL Stored Procedures
Persistence	T1078	Valid Accounts
Persistence	T1078.002	Valid Accounts: Domain Accounts
Privilege Escalation	T1098	Account Manipulation
Privilege Escalation	T1543.002	Create or Modify System Process: Systemd Service
Privilege Escalation	T1543.003	Create or Modify System Process: Windows Service
Privilege Escalation	T1055	Process Injection
Privilege Escalation	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1078	Valid Accounts
Privilege Escalation	T1078.002	Valid Accounts: Domain Accounts
Defense Evasion	T1078	Valid Accounts
Defense Evasion	T1078.002	Valid Accounts: Domain Accounts
Defense Evasion	T1140	Deobfuscate/Decode Files or Information
Defense Evasion	T1484.001	Domain or Tenant Policy Modification: Group Policy Modification
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools
Defense Evasion	T1562.002	Impair Defenses: Disable Windows Event Logging
Defense Evasion	T1112	Modify Registry
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1070.004	Indicator Removal: File Deletion
Defense Evasion	T1027.002	Obfuscated Files or Information: Software Packing
Defense Evasion	T1036	Masquerading
Defense Evasion	T1036.004	Masquerading: Masquerade Task or Service
Defense Evasion	T1036.005	Masquerading: Match Legitimate Resource Name or Location
Defense Evasion	T1036.008	Masquerading: Masquerade File Type
Defense Evasion	T1036.010	Masquerading: Masquerade Account Name
Defense Evasion	T1027.010	Obfuscated Files or Information: Command Obfuscation
Defense Evasion	T1218.011	System Binary Proxy Execution: Rundll32
Defense Evasion	T1053.005	Scheduled Task/Job: Scheduled Task
Defense Evasion	T1055	Process Injection
Credential Access	T1555.003	Credentials from Password Stores: Credentials from Web Browsers
Credential Access	T1539	Steal Web Session Cookie
Credential Access	T1110	Brute Force
Credential Access	T1056.001	Input Capture: Keylogging
Credential Access	T1040	Network Sniffing
Credential Access	T1003.003	OS Credential Dumping: NTDS
Credential Access	T1003.001	OS Credential Dumping: LSASS Memory
Discovery	T1083	File and Directory Discovery
Discovery	T1087.002	Account Discovery: Domain Account
Discovery	T1087.003	Account Discovery: Email Account
Discovery	T1040	Network Sniffing
Discovery	T1018	Remote System Discovery
Discovery	T1082	System Information Discovery
Discovery	T1049	System Network Connections Discovery
Discovery	T1033	System Owner/User Discovery
Lateral Movement	T1072	Software Deployment Tools
Lateral Movement	T1570	Lateral Tool Transfer
Lateral Movement	T1021.002	Remote Services: SMB/Windows Admin Shares
Collection	T1213	Data from Information Repositories
Collection	T1005	Data from Local System
Collection	T1056.001	Input Capture: Keylogging
Command and Control	T1132.001	Data Encoding: Standard Encoding
Command and Control	T1071.001	Application Layer Protocol: Web Protocols
Command and Control	T1095	Non-Application Layer Protocol
Command and Control	T1571	Non-Standard Port
Command and Control	T1572	Protocol Tunneling
Command and Control	T1105	Ingress Tool Transfer
Command and Control	T1090	Proxy
Command and Control	T1219	Remote Access Tools
Command and Control	T1102.002	Web Service: Bidirectional Communication
Exfiltration	T1041	Exfiltration Over C2 Channel
Impact	T1485	Data Destruction
Impact	T1486	Data Encrypted for Impact
Impact	T1491.002	Defacement: External Defacement
Impact	T1561.002	Disk Wipe: Disk Structure Wipe
Impact	T1499	Endpoint Denial of Service
Impact	T1490	Inhibit System Recovery
Impact	T1489	Service Stop

Latest Developments Observed
The threat actor is carrying out a campaign, BadPilot, on a global scale, targeting energy, oil and gas, telecommunications, shipping, arms manufacturing, and government entities. The threat actor is potentially discovering and compromising numerous Internet-facing systems, exploiting vulnerabilities in ConnectWise ScreenConnect (CVE-2024-1709), Fortinet FortiClient EMS security software (CVE-2023-48788), predominantly affecting Ukraine, Europe, and specific verticals in Central and South Asia, and the Middle East.

ETLM Insights
Sandworm is an advanced persistent threat (APT) group, widely attributed to Russia’s General Staff Main Intelligence Directorate (GRU). The group is well-established and has had extensive time to develop, test, and refine its tactics, techniques, and procedures.

It is known for conducting long-duration, highly coordinated attack campaigns, with a consistent emphasis on destructive operations rather than traditional objectives, such as data theft or financial gain. This focus underscores the group’s role as a strategic, state- sponsored actor intent on disruption, destabilization, and long-term intelligence collection supporting Russian strategic objectives.

YARA Rules
rule APT_Multi_IOC_Match
{
meta:
author = “CYFIRMA”
description = “Detects presence of IOCs related to multiple CVEs, IPs, and suspicious files/domains”
date = “2025-10-07”
reference = “Generated from threat intelligence input”
strings:
// IP Addresses (as text)
$ip1 = “208.91.197.27”
$ip2 = “172.67.174.99”
$ip3 = “172.67.174.93”
$ip4 = “104.21.64.14”
$ip5 = “127.0.0.1”
// Domains
$domain1 = “mariamchurch.com”
$domain2 = “techzenspace.com”
$domain3 = “dattolocal.net”
// CVEs
$cve1 = “CVE-2025-0282”
$cve2 = “CVE-2020-1472”
$cve3 = “CVE-2022-30190”
$cve4 = “CVE-2021-27065”
$cve5 = “CVE-2024-7344”
$cve6 = “CVE-2023-38831”
$cve7 = “CVE-2017-11882”
// Suspicious file indicators
$file1 = “hrm3jvh9v.dll”
$file2 = “multi-user.target”
condition:
any of ($ip*) or
any of ($domain*) or any of ($cve*) or any of ($file*)
}

Recommendations Strategic

• Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
• Deploy Zero Trust Policy that leverages tools like security information management, advanced security analytics platforms, security user behaviour analytics, and other analytics systems to help the organization’s security personnel observe in real-time what is happening within their networks so they can orient defences more intelligently.
• Deploy an Extended Detection and Response (XDR) solution as part of the organization’s layered security strategy that provides detection/prevention for malware and malicious activities that do not rely on signature-based detection methods.

Management

• Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.
• Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.
• Establish and implement processes to identify, assess, and manage supply chain risks. A ransomware contingency plan must be coordinated with suppliers, vendors, and third-party service providers, which includes scenarios where they are impacted by ransomware.

Tactical

• For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
• Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
• Enable network traffic/security monitoring, security incident detection, notification, and alerting by leveraging SIEM solutions.
• Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events, identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

Chinese Hackers Breached Foreign Ministers
A Chinese-aligned hacking group, dubbed Phantom Taurus, has been targeting foreign ministries, embassies, and telecom providers across Africa, the Middle East, and Asia for about two-and-a-half years. The group aims to steal sensitive geopolitical and military intelligence, often timing attacks with major global or regional events. Phantom Taurus uses advanced tactics, including a new malware suite called NET-STAR, alongside known Chinese malware like China Chopper, to conduct covert operations and maintain long- term access to critical targets. The group has shifted from targeting emails to extracting entire databases, focusing on technology providers to governments to access diplomatic and defense-related information. NET-STAR, designed to target Microsoft’s Internet Information Services web servers, employs sophisticated evasion techniques, making it hard to detect by disabling security monitoring features.

ETLM Assessment:
Phantom Taurus shares infrastructure with other Chinese hacking groups like APT27, Winnti, and Mustang Panda, but stands out for its evolved tactics and custom tools. Chinese APT groups have long targeted foreign ministries and embassies in a variety of ways over the last decade. In addition to longstanding attacks on U.S. diplomats, Chinese groups have been accused of attacking governments and embassies in Sweden, France, the U.K., Ukraine, Hungary, Singapore, the Czech Republic, Japan, Lithuania, multiple Southeast Asian countries, and several Pacific islands.

4. Rise in Malware/Ransomware and Phishing

The Killsec Ransomware Impacts WalletKu Indompet Indonesia

• Attack Type: Ransomware
• Target Industry: Financial Technology (FinTech)
• Target Geography: Indonesia
• Ransomware: Killsec Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from Indonesia, WalletKu Indompet Indonesia (http [:] //www.walletku.com/), was compromised by Killsec Ransomware. Walletku is a digital financial service application created to facilitate online transactions, with a focus on micro, small, and medium enterprises (MSMEs) that often lack access to bank accounts or face difficulties conducting daily transactions via mobile devices. Developed by PT Walletku Indompet Indonesia and headquartered in Jakarta, Walletku stands as one of the pioneering digital wallet platforms in Indonesia, specifically catering to users without traditional banking access. The application offers a variety of services, including bill payments, prepaid phone credit sales, travel ticket purchases, and more, empowering small businesses and individuals to efficiently manage their financial activities digitally. The compromised data includes personally identifiable information (PII), financial records, confidential documents, and other sensitive information belonging to the organization.

Relevancy & Insights:

• Recent analysis revealed that KillSec employs supply chain attacks (injecting malicious code via legitimate software updates), legacy RDP (Remote Desktop Protocol) exploitation, and unpatched vulnerabilities (notably in healthcare software supply chains and remote access systems).
• The KillSec Ransomware group primarily targets countries like the United States of America, India, the United Kingdom, Australia, and Mexico.
• The KillSec Ransomware group primarily targets industries, such as Information Technology, Healthcare, Professional Goods & Services, Finance, and Real Estate & Construction.
• Based on the KillSec Ransomware victims list from 1st Jan 2025 to 08th October 2025, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the KillSec Ransomware victims list from 1st Jan 2025 to 08th October 2025 are as follows:
  

ETLM Assessment:
The emergence and evolution of KillSec’s Ransomware-as-a-Service (RaaS) platform represents a concerning development in the cybercrime landscape. By lowering the technical barrier to entry, this RaaS model allows less skilled individuals to engage in sophisticated ransomware attacks, potentially leading to an increase in such incidents globally.

According to CYFIRMA’s assessment, the KillSec ransomware group is expected to continue targeting a wide range of industries worldwide. Their advanced tactics, such as exploiting website vulnerabilities and conducting credential theft, make them a significant threat to organizations with inadequate security measures in place.

Medusa Ransomware Impacts Future Generali

• Attack Type: Ransomware
• Target Industry: Finance
• Target Geography: India
• Ransomware: Medusa Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
From the External Threat Landscape Management (ETLM) Perspective, CYFIRMA observed in an underground forum that a company from India, Future Generali(https[:]//online[.]futuregenerali[.]in/), was compromised by Medusa Ransomware. Future Generali India is a joint venture between the global Generali Group and Indian partners, offering both life and general insurance. The company provides a wide range of products, including motor, health, travel, savings, and protection plans. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.

Relevancy & Insights:

• Medusa ransomware has been active since late 2021 and has quickly established itself as a major player in the ransomware space, employing a double extortion strategy. Once inside, Medusa uses strong encryption methods (AES-256 and RSA- 2048) to secure files, rendering them inaccessible without the decryption key held by the attackers.
• The Medusa Ransomware group primarily targets countries like the United States of America, the United Kingdom, Canada, India, and Germany.
• The Medusa Ransomware group primarily targets industries, such as Consumer Goods & Services, Healthcare, Professional Goods & Services, Manufacturing, and Government & Civic.
• Based on the Medusa ransomware victims list from 1st Jan 2025 to 08th October 2025, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the Medusa ransomware victims list from 1st Jan 2025 to 08th October 2025 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, Medusa Ransomware continues to pose a significant threat across various sectors. The group’s sophisticated tactics and aggressive demands highlight the need for organizations to enhance their cybersecurity measures, including regular updates, employee training on phishing recognition, and robust incident response plans to mitigate risks associated with ransomware attacks.

5. Vulnerabilities and Exploits

Vulnerability in Logback

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Server application
• Vulnerability: CVE-2025-11226
• CVSS Base Score: 5.9 Source
• Vulnerability Type: Improper input validation
• Summary: The vulnerability allows a remote attacker to compromise the affected system.

Relevancy & Insights:
The vulnerability exists due to insufficient validation of user-supplied input when parsing the configuration file. A remote attacker can trick the victim into using a specially crafted configuration file and execute arbitrary code on the system.

Impact:
Successful exploitation of the vulnerability requires the presence of the Janino library and Spring Framework on the user’s class path.

Affected Products:
https://logback.qos.ch/news.html#1.5.19

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment
Logback is an open-source logging framework for Java applications, intended as the successor to Log4j. It is designed for high performance and flexibility, offering advanced filtering, configuration through XML or Groovy, and seamless integration with the SLF4J (Simple Logging Facade for Java) API.

6. Latest Cyber-Attacks, Incidents, and Breaches

The Gentlemen Ransomware attacked and published the data of Thai Future Incorporation Public Company Limited

• Threat Actor: The Gentlemen Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Manufacturing
• Target Geography: Thailand
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, the Gentlemen Ransomware was observed attacking and publishing the data of Thai Future Incorporation Public Company Limited (https[:]//thaifutureinc[.]com/) on its dark web website. Thai Future Incorporation Public Company Limited, formerly known as Thai Film Industries Public Company Limited, is a Thailand-based company engaged in the manufacturing and distribution of packaging films. Their product range includes biaxially oriented polypropylene (BOPP) films, cast polypropylene (CPP) films, and metallized films.

These films are used in various applications, such as flexible packaging, publishing, flower wraps, adhesive tapes, labels, textile bags, overwraps, fresh produce packaging, and biodegradable products. The company operates across Thailand, Asia, Europe, America, and other regions. Thai Future Incorporation PCL is recognized as the world’s leading manufacturer of BOPP films and is a pioneer in the film industry within Southeast Asia.

The data leak resulting from the ransomware attack encompasses information from various departments including Finance, Human Resources & Administration, Stock Exchange of Thailand (SET), Business Development, Commercial Team Center, Managing Director’s Office, Export Documentation, Warehouse, Purchasing, Budgeting, Marketing, Domestic Marketing, Management Information Systems (MIS), Accounting, Export Marketing, Business Strategy, and Audit.

Relevancy & Insights:

• The Gentlemen ransomware is a recently emerged, highly sophisticated threat group.
• The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Healthcare, Materials, Information Technology, and Consumer Goods & Services.

ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen ransomware group exemplifies the rising sophistication and persistence of modern ransomware actors, necessitating tailored enterprise defenses and vigilant threat monitoring.

7. Data Leaks

PT Surveyor Indonesia Data Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Professional Services
• Target Geography: Indonesia
• Objective: Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary:
The CYFIRMA Research team observed that a threat actor, “ KaruHunters”, claims to have breached and is selling data from PT Surveyor Indonesia, a state-owned enterprise that provides surveying, inspection, certification, and consulting services. The company, founded in 1991, provides independent assurance services across various sectors.

The actor posted the alleged data breach on a dark web forum, claiming to have exported 50,211 records from the company’s systems.

According to the actor, the compromised data includes a wide range of client and corporate information. The database headers listed in the breach notification suggest the following types of information were exposed:

• Full names and display names
• Company addresses and location details (province, city, sub-district)
• Postal codes
• Telephone and fax numbers
• Email addresses
• Websites
• Client status and type
• Taxpayer identification numbers (NPWP)
• Internal identifiers (pic_id, user_id, client_id, etc.)
• Creation and update timestamps

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Kiple Data Advertised on a Leak Site

• Attack Type: Data leak
• Target Industry: Finance
• Target Geography: Malaysia
• Objective: Data Theft, Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary:
The CYFIRMA Research team observed that a threat actor “888” claims to have breached Kiple, a Malaysian company specializing in digital payment solutions. According to a post on a dark web forum, the incident occurred in October 2025, resulting in the theft of the company’s source code. Kiple, a Greenpacket company, provides services including e-wallets, Visa prepaid cards, and e-wages for salary disbursements, and is a partner of Visa and Alibaba Cloud. The leak appears to encompass a wide range of the company’s internal and external-facing projects.

The actor claims to have stolen and leaked the company’s entire source code, posting a link to a 3.71 GB archive. Analysis of the leaked file structure suggests the compromised source code includes numerous projects and systems. According to the actor, the data includes:

• Source code for backend services, APIs, and payment gateways.
• Mobile application source code for both Android and iOS platforms.
• Frontend source code for customer and administrative portals.
• Source code for sensitive systems, including eKYC (Electronic Know Your Customer), fraud detection, and credit card processing.
• Database schemas, migrations, and configuration files.
• DevOps scripts, including Terraform infrastructure-as-code files.

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:
The threat actor known as “KaruHunters” is a highly active and sophisticated group specializing in data leaks. Numerous credible sources attribute multiple security breaches to this group, involving unauthorized access to systems and the illicit sale of stolen data on dark web marketplaces. KaruHunters’ operations highlight the persistent and evolving nature of cyber threats emerging from underground forums. These incidents underscore the critical importance for organizations to enhance their cybersecurity posture through continuous monitoring, leveraging advanced threat intelligence, and adopting proactive defense strategies to protect sensitive data and vital infrastructure.

Recommendations: Enhance the cybersecurity posture by:

1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
2. Ensure proper database configuration to mitigate the risk of database-related attacks.
3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA Research team observed that a threat actor is selling network access to a leading software development company based in Vietnam. The company is reported to have an annual revenue of $17 million.

According to the actor, the offered access includes sensitive corporate systems. The allegedly compromised access includes:

• AWS S3 buckets
• Jira
• Bitbucket
• MySQL databases

The authenticity of this access sale remains unverified at the time of reporting, as the claim originates solely from the threat actor.

STRATEGIC RECOMMENDATIONS

• Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Delay a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response plan.
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATIONS

• Take advantage of global Cyber Intelligence providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions remediations, and lessons learned.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM solutions.
• Detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies and continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATIONS

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Consider using security automation to speed up threat detection, improved incident response, increased the visibility of security metrics, and rapid execution of security checklists.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence provided.
• Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security control such as reCAPTCHA (completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.