Weekly Intelligence Report – 14 November 2025

Published On : 2025-11-14

 

Ransomware of the week

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.

Type: Ransomware
Target Technology: Windows OS

Introduction

CYFIRMA Research and Advisory Team has found BAGAJAI Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

BAGAJAI Ransomware:

Researchers have discovered a new ransomware strain called BAGAJAI. This ransomware encrypts victims’ files, renaming them and appending a random extension to filenames (e.g., .BAGAJAI) and creating a ransom note (“read_to_decrypt_files.html “)

Screenshot of files encrypted by ransomware (Source: Surface Web)

CYFIRMA’s assessment indicates that the BAGAJAI ransomware group is demonstrating a steady transition from a traditional file-encryption model to a mature, data-extortion-driven operation. The group employs strong hybrid encryption (RSA-4096 and AES-256), threatens the publication of exfiltrated data, and leverages time-bound ransom escalation alongside anonymous negotiation channels, such as Tor and qTox. Its tactics, offering free file decryption to build trust, emphasizing confidentiality in communication, and using psychological pressure through data-leak threats reflect an increasingly professional and structured operational model. Based on these established behaviors, CYFIRMA assesses that BAGAJAI is likely to expand its double-extortion practices, refine leak-site infrastructure for public exposure, and develop more automated negotiation and payment workflows to scale operations. Over time, the group could evolve into a sustained, service-oriented ransomware entity, aligning with broader trends observed among organized cyber-extortion collectives.

Screenshot: The appearance of BAGAJAI ‘s ransom note (“read_to_decrypt_files.html”) (Source: Surface Web)

The following are the TTPs based on the MITRE Attack Framework

Tactic	Technique ID	Technique Name
Execution	T1059	Command and Scripting Interpreter
Execution	T1129	Shared Modules
Persistence	T1112	Modify Registry
Persistence	T1542	Pre-OS Boot
Persistence	T1542.003	Pre-OS Boot: Bootkit
Persistence	T1547	Boot or Logon Autostart Execution
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	T1134.004	Access Token Manipulation: Parent PID Spoofing
Privilege Escalation	T1547	Boot or Logon Autostart Execution
Privilege Escalation	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Defense Evasion	T1014	Rootkit
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1027.002	Obfuscated Files or Information: Software Packing
Defense Evasion	T1027.005	Obfuscated Files or Information: Indicator Removal from Tools
Defense Evasion	T1070	Indicator Removal
Defense Evasion	T1070.004	Indicator Removal: File Deletion
Defense Evasion	T1112	Modify Registry
Defense Evasion	T1134.004	Access Token Manipulation: Parent PID Spoofing
Defense Evasion	T1140	Deobfuscate/Decode Files or Information
Defense Evasion	T1202	Indirect Command Execution
Defense Evasion	T1222	File and Directory Permissions Modification
Defense Evasion	T1497	Virtualization/Sandbox Evasion
Defense Evasion	T1497.001	Virtualization/Sandbox Evasion: System Checks
Defense Evasion	T1542	Pre-OS Boot
Defense Evasion	T1542.003	Pre-OS Boot: Bootkit
Defense Evasion	T1564	Hide Artifacts
Defense Evasion	T1564.003	Hide Artifacts: Hidden Window
Credential Access	T1056	Input Capture
Credential Access	T1056.001	Input Capture: Keylogging
Discovery	T1010	Application Window Discovery
Discovery	T1012	Query Registry
Discovery	T1016	System Network Configuration Discovery
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Discovery	T1497	Virtualization/Sandbox Evasion
Discovery	T1497.001	Virtualization/Sandbox Evasion: System Checks
Discovery	T1614	System Location Discovery
Collection	T1056	Input Capture
Collection	T1056.001	Input Capture: Keylogging
Collection	T1074	Data Staged
Command and Control	T1071	Application Layer Protocol
Command and Control	T1090	Proxy
Command and Control	T1105	Ingress Tool Transfer
Command and Control	T1573	Encrypted Channel
Impact	T1486	Data Encrypted for Impact
Impact	T1490	Inhibit System Recovery

Relevancy and Insights:

• The ransomware primarily targets Windows OS, which is utilised by enterprises in a variety of industries.
• Long-sleeps: Ransomware utilizes extended sleep intervals to evade detection by security software, enabling it to operate stealthily and increasing the likelihood of completing file encryption before being identified.
• Detect-Debug-Environment: Debugging environments are used by developers to analyze and troubleshoot software. This technique is used by the ransomware to determine whether it is operating in a debug This feature aids the ransomware in avoiding analysis and detection attempts.
• Persistence: The ransomware exhibits persistence mechanisms to ensure its survival and ongoing malicious activities within the compromised This could involve creating autostart entries or modifying system settings to maintain a foothold and facilitate future attacks.

ETLM Assessment:

CYFIRMA’s assessment indicates that the BAGAJAI ransomware group, based on the material provided and its stated cryptographic choices (AES-256-CTR and RSA- 4096), claims of exfiltrating large volumes of sensitive data, use of timed price/pressure demands (72 hours; 7–14 days), offers of limited free decryptions to build trust, and reliance on anonymous communications (Tor/qTox/email). It is likely to pursue several concrete operational steps: continue and scale combined encryption-plus-data-theft campaigns to increase leverage for extortion; professionalize negotiation and payment workflows (more automated Tor portals, standardized ransom communications and price-adjustment mechanics); broaden and formalize proof-of-theft tactics (expanded sample disclosures and routine test decryptions to accelerate trust and payments); maintain strong anti-forensics and anti-recovery guidance to deter third-party remediation efforts; operate or expand a persistent leak publication capability to maximize reputational pressure; diversify and harden contact/payment channels to retain anonymity and operational resilience; and, over time, explore revenue-scaling arrangements, such as affiliate or partnership models, that would allow third parties to deploy their encryptor under a shared brand—each inference drawn solely from the behaviors and capabilities documented in the material you supplied.

Sigma rule:

title: New RUN Key Pointing to Suspicious Folder tags:

• privilege-escalation
• persistence

– attack.t1547.001 logsource:

category: registry_set product: windows

detection: selection_target:

TargetObject|contains:

• ‘\Software\Microsoft\Windows\CurrentVersion\Run’
• ‘\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run’
• ‘\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run’ selection_suspicious_paths_1:

Details|contains:

• ‘:\Perflogs’
• :\ProgramData’
• ‘:\Windows\Temp’
• ‘:\Temp’
• ‘\AppData\Local\Temp’
• ‘\AppData\Roaming’
• ‘:\$Recycle.bin’
• ‘:\Users\Default’
• ‘:\Users\public’
• ‘%temp%’

– ‘%tmp%’

• ‘%Public%’
• ‘%AppData%’

selection_suspicious_paths_user_1: Details|contains: ‘:\Users\’

selection_suspicious_paths_user_2: Details|contains:

• ‘\Favorites’
• ‘\Favourites’
• ‘\Contacts’
• ‘\Music’
• ‘\Pictures’
• ‘\Documents’
• ‘\Photos’ filter_main_windows_update:

TargetObject|contains: ‘\Microsoft\Windows\CurrentVersion\RunOnce\’ Image|startswith: ‘C:\Windows\SoftwareDistribution\Download\’ Details|contains|all:

• ‘rundll32.exe ‘
• ‘C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32’ Details|contains:
• ‘\AppData\Local\Temp\’
• ‘C:\Windows\Temp\’ filter_optional_spotify:

Image|endswith:

• ‘C:\Program Files\Spotify\Spotify.exe’
• ‘C:\Program Files (x86)\Spotify\Spotify.exe’
• ‘\AppData\Roaming\Spotify\Spotify.exe’ TargetObject|endswith:

‘SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify’

Details|endswith: ‘Spotify.exe –autostart –minimized’

condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_*

falsepositives:

– Software using weird folders for updates level: high
(Source: Surface Web)

IOCs:

Kindly refer to the IOCs section to exercise control of your security systems.

RECOMMENDATIONS

STRATEGIC RECOMMENDATIONS

• Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
• Ensure that backups of critical systems are maintained, which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATIONS

• A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
• Enable zero-trust architecture and multifactor authentication (MFA) to mitigate the compromise of credentials.
• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATIONS

• Update all applications/software regularly with the latest versions and security patches alike.
• Add the Sigma rule for threat detection and monitoring, which will help to detect anomalies in log events, identify and monitor suspicious
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defense based on the tactical intelligence provided.

Trending Malware of the Week

Type: Remote Access Trojan | Objectives: Credential Theft & Data Exfiltration | Target Technology: Windows OS | Target Industry: Health & Tourism sector| Target Geography: Global

CYFIRMA collects data from various forums, based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the week
This week, “PureRAT” is trending.

Overview of PureRAT Malware

Researchers have recently identified an extensive phishing campaign targeting customers across the global hospitality industry. The operation employed deceptive communication methods, including messages distributed via compromised hotel Booking.com accounts and the WhatsApp platform. Active since April 2025, the campaign distinguished itself through its persistence and authenticity, as threat actors utilized legitimate customer and reservation details to enhance the credibility of their messages. The intrusion process often began with emails designed to resemble genuine customer inquiries, incorporating Booking.com’s visual identity to reinforce legitimacy. Victims were deceived by clicking on malicious links through a method known as the ClickFix social engineering tactic, which enabled attackers to compromise hotel accounts.

Once obtained, these accounts were either sold on illicit platforms or repurposed to disseminate fraudulent messages to guests, primarily to extract financial or personal data. The attackers further employed a sophisticated remote access tool, PureRAT, capable of covertly controlling infected systems and exfiltrating sensitive information. This campaign exemplifies the growing trend of cybercriminals exploiting trusted digital services and psychological manipulation techniques to undermine user confidence, emphasizing the critical need for enhanced cybersecurity awareness and protective measures within the hospitality sector.

Attack Method

The attackers initiated their campaign by exploiting compromised corporate email accounts to deliver malicious messages to hotels across multiple countries. These emails, often impersonating Booking.com, contained legitimate-looking booking references or customer messages to appear trustworthy. Embedded within the emails were URLs that triggered the ClickFix social engineering tactic, a technique designed to deceive victims through a multilayered redirection chain. Once the recipient clicked the malicious link, they were redirected through several domains before arriving at a counterfeit Booking.com extranet page. This fake page instructed users to copy and execute a PowerShell command, masquerading as a routine verification step. By leveraging familiarity with Booking.com’s interface and branding, the attackers successfully exploited human trust to initiate the infection.

Malware Delivery Process

When the PowerShell command was executed, it initiated a sequence of downloads from an attacker-controlled infrastructure. The script first collected system details such as the hostname, OS version, and antivirus information before retrieving a compressed archive containing an executable and multiple DLL files. These files were extracted into the user’s AppData directory, where persistence was established through Windows registry modifications and startup shortcuts. The executable then performed DLL side- loading, activating a loader component that downloaded additional payloads and ensured that the malware could restart automatically after system reboots. Throughout this process, the infected system communicated with the attacker’s command-and- control (C2) server to report progress and confirm successful installation.

PureRAT Malware Execution

The final payload in this chain was the PureRAT remote access trojan (RAT), a powerful malware tool sold as Malware-as-a-Service (MaaS) by the developer “PureCoder.” Once deployed, PureRAT provided full remote control over the compromised system, allowing attackers to perform actions such as screen capture, keylogging, file transfer, webcam and microphone access, and command execution. The malware’s modular design enabled it to dynamically load plugins based on the operator’s objectives, extending its capabilities for data theft or further exploitation. To evade analysis, PureRAT used .NET Reactor obfuscation, encrypted communications over TLS, and fileless execution through AddInProcess32.exe, ensuring its presence remained concealed from most antivirus solutions.

The following are the TTPs based on the MITRE Attack Framework for Mobile

Tactic	Technique ID	Technique Name
Initial Access	T1566.002	Phishing: Spear phishing Link
Initial Access	T1566.003	Phishing: Spear phishing via Service
Execution	T1204.002	User Execution: Malicious File
Execution	T1059.001	Command and Scripting Interpreter: PowerShell
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	T1574.001	Hijack Execution Flow: DLL Side-Loading
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1055	Process Injection
Discovery	T1082	System Information Discovery
Discovery	T1016	System Network Configuration Discovery
Collection	T1113	Screen Capture
Collection	T1056.001	Input Capture: Keylogging
Command and control	T1071.001	Application Layer Protocol: Web Protocols
Exfiltration	T1041	Exfiltration Over C2 Channel

INSIGHTS

• Malware today reflects the growing industrialization of cybercrime, where digital threats operate within organized, profit-driven ecosystems rather than isolated acts of Behind each infection lies a network of developers, brokers, and operators who specialize in different stages of the attack chain from code creation and distribution to monetization through data theft or access resale. This compartmentalized structure allows campaigns to scale efficiently while maintaining anonymity among participants. The result is a self-sustaining underground economy in which malware functions less as a singular tool and more as a commercial product, exchanged, customized, and deployed with the same coordination seen in legitimate business operations.
• This coordinated campaign reflected a professionalized cybercrime ecosystem, where each stage of the attack, from phishing to malware deployment, was streamlined for maximum Compromised hotel administrator accounts were sold or reused in underground markets to launch secondary frauds targeting guests.
• The use of the ClickFix tactic, combined with technical stealth and advanced malware such as PureRAT, demonstrates the evolving sophistication of threat actors targeting the global hospitality By exploiting trusted digital platforms and layering social engineering with persistence techniques, the attackers achieved both scale and longevity, underscoring the urgent need for heightened vigilance and cybersecurity awareness among Booking.com partners and the wider hospitality sector.

ETLM ASSESSMENT
From the ETLM perspective, CYFIRMA anticipates that in the coming years, tactics exemplified by the ClickFix technique and tools like PureRAT are likely to evolve into even more seamless and adaptive threats. ClickFix-style social engineering—built around trusted digital workflows—may become harder to distinguish from legitimate verification or update processes, allowing attackers to compromise systems through routine user actions. Meanwhile, remote-access tools such as PureRAT are expected to grow more modular and covert, integrating easily with everyday business software and cloud environments. This combination of subtle psychological manipulation and silent technical control could blur the line between compromise and normal activity, making detection increasingly challenging. For both organizations and employees, the lasting consequence may be a gradual erosion of digital trust, where even verified platforms or familiar interfaces could conceal sophisticated intrusions.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.

YARA Rules

rule indicators_all

{

meta:

author = “Cyfirma”

description = “Detects supplied malicious URLs, domains, hashes and C2 IP:port indicators”

strings:

/* Explicit URLs */

$u1 = “https://headkickscountry.com/lz1y”

$u2 = “https://activatecapagm.com/j8r3”

$u3 = “https://homelycareinc.com/po7r”

$u4 = “https://byliljedahl.com/8anf”

$u5 = “https://jamerimprovementsllc.com/ao9o”

$u6 = “https://seedsuccesspath.com/6m8a”

$u7 = “https://zenavuurwerkofficial.com/62is”

$u8  = “https://brownsugarcheesecakebar.com/ajm4”

$u9 = “https://hareandhosta.com/95xh”

$u10  =  “https://customvanityco.com/izsb”

$u11 = “https://byliljedahl.com/lv6q”

$u12  =  “https://ctrlcapaserc.com/loggqibkng”

$u13  =  “https://bqknsieasrs.com/loggqibkng”

$u14 = “https://confirmation887-booking.com/17149438”

$u15 = “https://verifyguest02667-booking.com/17149438”

$u16 = “https://guest03442-booking.com/17149438”

$u17 = “https://confirmation8324-booking.com/17149438”

$u18 = “https://cardverify0006-booking.com/37858999”

$u19 = “https://verifycard45625-expedia.com/67764524”

$u20  =  “https://ctrlcapaserc.com/bomla”

$u21  =  “https://bknqsercise.com/bomla”

$u22  =  “https://bkngssercise.com/bomla”

$u23  =  “https://bkngpropadm.com/bomla”

$u24  =  “https://cquopymaiqna.com/bomla”

$u25  =  “https://emprotel.net.bo/updserc.zip”

$u26  =  “https://cabinetifc.com/upseisser.zip”

/* Explicit domains */

$d1 = “whooamisercisea.com”

$d2 = “sqwqwasresbkng.com”

$d3 = “whooamisercise.com”

$d4 = “aidaqosmaioa.com”

$d5 = “bqknsieasrs.com”

$d6 = “update-infos616.com”

$d7 = “mccplogma.com”

$d8 = “mccp-logistics.com”

$d9 = “cquopymaiqna.com”

$d10 = “contmasqueis.com”

$d11 = “update-info1676.com”

$d12 = “admin-extranet-reservationsinfos.com”

$d13 = “eiscoaqscm.com”

$d14 = “comsquery.com”

$d15 = “caspqisoals.com”

$d16 = “ctrlcapaserc.com”

$d17 = “admin-extranet-reservationsexp.com”

$d18 = “admin-extranetmngrxz-captcha.com”

$d19 = “admin-extranetrservq-cstmrq.com”

$d20 = “admin-extranetadmns-captcha.com”

$d21 = “extranet-admin-reservationssept.com”

$d22 = “bkngssercise.com”

$d23 = “admin-extranetmnxz-captcha.com”

$d24 = “bknqsercise.com”

$d25 = “admin-extranetadm-captcha.com”

$d26 = “bookreservfadrwer-customer.com”

$d27 = “bookingadmin-updateofmay2705.com”

$d28 = “breserve-custommessagehelp.com”

$d29 = “confvisitor-doc.com”

$d30 = “confirminfo-hotel20may05.com”

$d31 = “guestinfo-aboutstay1205.com”

$d32 = “confsvisitor-missing-items.com”

$d33 = “guesting-servicesid91202.com”

$d34 = “booking-agreementstatementapril0429.com”

$d35 = “booking-agreementaprilreviews042025.com”

$d36 = “booking-viewdocdetails-0975031.com”

$d37 = “booking-agreementstatementapril0225.com”

$d38 = “api-notification-centeriones.com”

$d39 = “booking-visitorviewdetails-64464043.com”

$d40 = “booking-reservationsdetail-id0025911.com”

$d41 = “booking-refguestitem-09064111.com”

$d42  =  “reserv-captchaapril04152025.com”

$d43 = “booking-reviewsguestpriv-10101960546.com”

$d44 = “booking-aprilreviewstir-9650233.com”

$d45 = “booking-confviewdocum-0079495902.com”

$d46 = “booking-confview-doc-00097503843.com”

$d47 = “booking-reservationinfosid0251358.com”

/* SHA256 hashes provided */

$hash1 = “703355e8e93f30df19f7f7b8800bd623f1aee1f020c43a4a1e11e121c53b5dd1”

$hash2 = “5301f5a3fb8649edb0a5768661d197f872d40cfe7b8252d482827ea27077c1ec”

$hash3 = “64838e0a3e2711b62c4f0d2db5a26396ac7964e31500dbb8e8b1049495b5d1f3”

/* IP:port combos */

$ip1 = “85.208.84.94:56001”

$ip2 = “77.83.207.106:56001”

condition:

any of ($u*) or any of ($d*) or any of ($hash*) or any of ($ip*)

}

STRATEGIC RECOMMENDATIONS:

• Establish an integrated Threat Intelligence and Monitoring Framework to identify emerging malware distribution domains and campaigns (like ClickFix and PureRAT) before they impact internal
• Enforce a zero-trust architecture with strict identity validation to prevent external command-and-control (C2) callbacks.
• Prioritize supply chain and third-party risk assessments, ensuring partner websites and communication channels are verified and monitored for compromise.
• Institutionalize continuous awareness programs that educate employees about spear-phishing and fake booking or service confirmation links.

MANAGEMENT RECOMMENDATIONS:

• Implement centralized logging and anomaly correlation through a SIEM or NDR solution to detect early indicators of malicious activity or outbound traffic to suspicious IPs and domains.
• Conduct regular malware simulation exercises to test incident response readiness and employee recognition of phishing links.
• Review and strengthen access control and privilege management, especially for systems that could be exploited by remote access tools like PureRAT
• Maintain a rapid response playbook for malware infection, including domain/IP blocking, host isolation, and immediate credential resets.

TACTICAL RECOMMENDATIONS

• Block all identified malicious domains, URLs, and IP addresses at firewalls, secure email gateways, and endpoint protection layers to prevent further
• Deploy the developed YARA rules and perform IOC-based scanning across all endpoints and servers to identify and contain any potential infections.
• Ensure endpoint detection and response (EDR) solutions actively monitor for PowerShell or script-based payload execution, commonly associated with PureRAT and ClickFix infections.
• Maintain up-to-date IOC feeds within network and endpoint defense systems to ensure timely detection and mitigation of newly emerging
• Continuously monitor and strengthen security defenses based on tactical intelligence and detected anomalies within system and network logs.

CYFIRMA’S WEEKLY INSIGHTS

1. Weekly Attack Types and Trends

Key Intelligence Signals:

• Attack Type: Ransomware Attacks, Spear Phishing, Malware Implant, Vulnerabilities & Exploits, Data
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains,
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware – Warlock Ransomware, Qilin Ransomware| Malware – PureRA
• Warlock Ransomware– One of the ransomware
• Qilin Ransomware – One of the ransomware
  Please refer to the trending malware advisory for details on the following:

• Malware – PureRAT
  Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

APT37: North Korea’s Shift Toward Mobile Espionage

• Threat Actor: APT37 (ScarCruft) aka Reaper, Group123
• Attack Type: Connection Proxy, Credential Dumping, Exploitation of Vulnerabilities, Spear-Phishing, Code Obfuscation, Malware
• Objective: Information theft, Espionage
• Suspected Target Technology: Office Suites Software, Operating System, Web Application, Android.
• Suspected Target Geography: China, Hong Kong, India, Japan, Kuwait, Middle East, Nepal, Romania, Russia, South Korea, UK, USA, Vietnam
• Suspected Target Industries: Automotive, Chemical, Education, Finance, Government, Healthcare, High-Tech, Manufacturing, Media, Research, Technology, Transportation, Aerospace
• Business Impact: Compromised user accounts, Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor

Reaper (APT37) is a suspected North Korean cyber espionage group active since 2012, known for its advanced malware development and sophisticated tactics, techniques, and procedures (TTPs). Initially targeting South Korea, Reaper has expanded its operations to Japan, Vietnam, and the Middle East. Their notable campaigns include Operation Daybreak, Erebus, Golden Time, FreeMilk, Are You Happy?, and Evil New Year.

Additionally, malware families and tools such as Konni, Nokki, DogCall, and CarrotBat have been associated with the group’s operations, further demonstrating its technical capability and adaptability. The group has been linked to attacks on academic and strategic institutions, including a Japanese entity associated with a UN human rights project. Reaper’s activities align closely with North Korean state objectives, making it a persistent and evolving threat.

Details on Exploited Vulnerabilities

CVE ID	Affected Products	CVSS Score	Exploit Links
CVE-2018-4878	Adobe Flash Player	9.8	link
CVE-2022-41128	Windows Scripting Languages	8.8	–
CVE-2024-38178	Scripting Engine Memory	7.5	–
CVE-2020-1380	Internet Explorer	8.8	Link
CVE-2017-8291	Artifex Ghostscript	7.8	link

TTPs based on MITRE ATT&CK Framework

Tactic	ID	Technique
Initial Access	T1189	Drive-by Compromise
Initial Access	T1566.001	Phishing: Spear phishing Attachment
Execution	T1059	Command and Scripting Interpreter
Execution	T1059.003	Command and Scripting Interpreter: Windows Command Shell
Execution	T1059.005	Command and Scripting Interpreter: Visual Basic
Execution	T1059.006	Command and Scripting Interpreter: Python
Execution	T1203	Exploitation for Client Execution
Execution	T1559.002	Inter-Process Communication: Dynamic Data Exchange
Execution	T1106	Native API
Execution	T1053.005	Scheduled Task/Job: Scheduled Task
Execution	T1204.002	User Execution: Malicious File
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1548.002	Abuse Elevation Control Mechanism: Bypass User Account Control
Privilege Escalation	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

 

Privilege Escalation	T1055	Process Injection
Defense Evasion	T1548.002	Abuse Elevation Control Mechanism: Bypass User Account Control
Defense Evasion	T1036.001	Masquerading: Invalid Code Signature
Defense Evasion	T1027	Obfuscated Files or Information
Defense Evasion	T1027.003	Obfuscated Files or Information: Steganography
Defense Evasion	T1055	Process Injection
Credential Access	T1555.003	Credentials from Password Stores: Credentials from Web Browsers
Discovery	T1120	Peripheral Device Discovery
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1033	System Owner/User Discovery
Collection	T1123	Audio Capture

Collection	T1005	Data from Local System
Command and Control	T1105	Ingress Tool Transfer
Command and Control	T1071.001	Application Layer Protocol: Web Protocols
Command and Control	T1102.002	Web Service: Bidirectional Communication
Impact	T1561.002	Disk Wipe: Disk Structure Wipe
Impact	T1529	System Shutdown/Reboot

Latest Developments Observed

The threat actor is suspected of exploiting Google’s Find My Device (Find Hub) functionality to track the GPS locations of targeted individuals and remotely perform factory resets on Android devices. The group has been observed targeting South Korean users via the KakaoTalk messenger platform, with the primary objective appearing to be the exfiltration of sensitive personal and device data.

ETLM Insights

APT37’s evolution reflects a deliberate alignment between its cyber operations and North Korea’s broader intelligence and geopolitical objectives. The group effectively blends espionage with hybrid disruption, with an increasing emphasis on mobile and identity exploitation. Its targeting of NATO-aligned nations and Western- affiliated states underscores the expanding risk landscape associated with North Korea–linked cyber activity.

APT37 operates with a high degree of adaptability and operational tempo, leveraging both custom-developed malware and open-source tools to sustain persistent access and evade detection. The group’s digital footprint has extended beyond its traditional areas of focus, now encompassing a wider range of technologies and infrastructures—including Windows, Android, web browsers, and cloud environments—to support long-term intelligence collection and strategic espionage objectives.

Recent campaigns highlight increasingly sophisticated tactics, techniques, and procedures (TTPs), such as targeted spear-phishing, exploitation of software vulnerabilities, and deployment of advanced modular malware frameworks.

APT37’s evolving capabilities indicate a clear pivot toward mobile platform exploitation and abuse of legitimate services to enable surveillance, data exfiltration, and remote device control.

Looking ahead, the group is expected to integrate cross-platform malware, AI- enabled social engineering, and strategic supply-chain compromises to enhance persistence and extend its intelligence-gathering reach across both state and private-sector targets.

IOCs

Kindly refer to the IOCs Section to exercise controls on your security systems.

YARA Rules

 rule APT37_Indicators

{

meta:

description = “Detects indicators related to APT37 (ScarCruft) including CVEs, IPs, and domains”

author = “CYFIRMA” date = “2025-11-11”

threat_actor = “APT37 / ScarCruft”

 

strings:

// Known CVE strings often referenced in attack artifacts or logs

$cve1 = “CVE-2018-4878”

$cve2 = “CVE-2022-41128”

$cve3 = “CVE-2024-38178”

$cve4 = “CVE-2020-1380”

$cve5 = “CVE-2017-8291”

 

// Domains linked to APT37 infrastructure

$domain1 = “st0746.net”

$domain2 = “crowdon.info”

$domain3 = “joinupvts.org”

$domain4 = “seoulhobi.biz”

$domain5 = “pcpaathshala.com”

// IP addresses associated with malicious activity

$ip1 = “127.0.0.1”

$ip2 = “209.85.147.147”

$ip3 = “209.85.147.106”

$ip4 = “74.125.195.147”

$ip5 = “173.194.67.106”

$ip6 = “173.194.78.99”

condition:

any of ($cve*) or any of ($domain*) or any of ($ip*)

}

Recommendations

Strategic Recommendations:

• Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
• Assess and deploy alternatives for an advanced endpoint protection solution that provides detection/prevention for malware and malicious activities that do not rely on signature-based detection methods.
• Block exploit-like Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more by identifying such patterns.

Management Recommendations:

• Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation Reinforce this training with context-aware banners and in-line prompts to help educate users.
• Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.

Tactical Recommendations

• For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
• Protect accounts with multi-factor Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
• Add the YARA rule for threat detection and monitoring, which will help to detect anomalies in log events, identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

Russia’s attacks against Ukraine’s grain sector

Researchers have found that Sandworm, a threat actor linked to Russia’s military intelligence, is deploying wipers against Ukrainian entities in the government, energy, logistics, and grain sectors, trying to undermine the Ukrainian economy. The grain sector is a notable addition to Sandworm’s targeting, as grain exports are one of Ukraine’s primary sources of hard currency revenue.

The researchers add that these attacks are a reminder that wipers very much remain a frequent tool of Russia-aligned threat actors in Ukraine. Although there have been reports suggesting an apparent refocusing on espionage activities by such groups in late 2024, we have seen Sandworm conducting wiper attacks against Ukrainian entities on a regular basis since the start of 2025.

ETLM Assessment:

Sandworm, aka APT44, operates under Russia’s Main Intelligence Directorate (GRU), specifically Military Unit 74455 (Main Center for Special Technologies). The group has been active since at least 2009 and is known for blending espionage, sabotage, and destructive attacks, often in support of Russian geopolitical objectives. Sandworm’s operations have caused billions in global damages and targeted critical infrastructure worldwide, with a primary focus on Ukraine amid Russia’s ongoing invasion. The recent attack shows Russia’s disregard for the global availability of foodstuffs – as we have reported previously – in which Ukraine’s grain plays a large role, as some Middle Eastern and African nations depend on affordable Ukrainian grain. The war will keep affecting Ukraine’s grain exports, and some of the largest importers in the most vulnerable countries will be forced to spend extra on the very basic foodstuffs their populations depend on.

China to execute 5 Myanmar scam bosses

A Chinese court in Shenzhen, Guangdong Province, sentenced five members of a Myanmar-based crime syndicate to death for operating massive scamming compounds near the China-Myanmar border. The court announced the death penalties for syndicate leader Bai Suocheng, his son Bai Yingcang, and other high-profile associates. Five others received life sentences, nine were given prison terms ranging from three to 20 years, and two were handed two-year suspended death sentences, meaning execution could follow further crimes.

Bai Suocheng and Bai Yingcang, former heads of the Kokang Border Guard Force— a militia tied to Myanmar’s military junta—profited from illegal activities, including large-scale scams targeting Chinese citizens. In response, China launched a 2023 cross-border crackdown, arresting tens of thousands, including Kokang crime family leaders. In September, 11 members of the Ming crime family were also sentenced to death for similar scam operations.

Xinhua reported that the Bai syndicate built 41 industrial parks, engaging in telecom and online fraud, casino operations, murder, assault, kidnapping, extortion, forced prostitution, and illegal border crossings. The court alleged they defrauded victims of over 29 billion yuan (approximately $4 billion) and caused at least six Chinese deaths.

ETLM Assessment:

Myanmar remains a hub for the global scamming industry, driving billions in losses through schemes like pig butchering. Recently, Myanmar’s junta claimed to have raided and destroyed parts of the notorious KK Park scam compound near Thailand. Thai authorities detained over 1,600 people fleeing these centers while attempting to cross the border.

4. Rise in Malware/Ransomware and Phishing

Warlock Ransomware Impacts TEIN, INC.

Attack Type: Ransomware
Target Industry: Manufacturing
Target Geography: Japan
Ransomware: Warlock Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:

CYFIRMA observed in an underground forum that a company from Japan, TEIN, INC., (https[:]//www[.]tein[.]co[.]jp/), was compromised by Warlock Ransomware. TEIN, Inc. is a Japanese company specializing in the design, development, manufacturing, and sales of automotive suspension systems and related parts. The company serves both passenger vehicles and motorsports markets, offering a wide range of products, including lowering springs, OE- shaped shock absorbers, coilovers, and motorsport gear. TEIN operates globally with manufacturing and sales facilities in Japan, the United States, and the United Kingdom. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data contains confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

• Warlock Ransomware is a new and sophisticated ransomware operation that first surfaced in June
• Warlock employs classic “double extortion” tactics, encrypting victim files and threatening to release stolen data if ransom demands are not met.
• The Warlock Ransomware group primarily targets countries such as the United States of America, India, Russia, the United Kingdom, and
• The Warlock Ransomware group primarily targets industries, such as Information Technology, Manufacturing, Professional Goods & Services, Consumer Goods & Services, and Real Estate & Construction.
• Based on the Warlock Ransomware victims list from 1st June 2025 to 11th November 2025, the top 5 Target Countries are as follows:

• The Top 10 Industries most affected by the Warlock Ransomware victims list from 1st June 2025 to 11th November 2025 are as follows:

ETLM Assessment:

 According to CYFIRMA’s assessment, Warlock ransomware represents a rapidly evolving and high-impact threat in the global cybersecurity landscape in 2025. Warlock operators have demonstrated advanced technical capabilities in gaining initial access, escalating privileges, moving laterally, and deploying ransomware with data exfiltration. Their use of DLL sideloading, legitimate administrative tools for lateral movement, and the “double extortion” tactic of encrypting files while threatening to release stolen data makes this ransomware particularly disruptive.

Qilin Ransomware Impacts Tass Meister Patent Firm

• Attack Type: Ransomware
• Target Industry: Law Firms & Legal Services
• Target Geography: Japan
• Ransomware: Qilin Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary

CYFIRMA observed in an underground forum that a company from Japan, Tass Meister Patent Firm (https[:]//tassmeister[.]com/), was compromised by Qilin Ransomware. Tass Meister Patent Firm is an intellectual-property law firm based in Japan, offering global IP filing, licensing, and enforcement services. The compromised data includes sensitive personally identifiable information (PII), financial records, and other confidential organizational information. The total size of the leaked data is estimated to be approximately 210 gigabytes.

Source: Dark Web

Relevancy & Insights:

• The Qilin Ransomware group primarily targets countries such as the United States of America, Canada, South Korea, France, and Spain.
• The Qilin Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Healthcare, Consumer Goods & Services, and Information Technology.
• Based on the Qilin Ransomware victims list from 1stJan 2025 to 11th November 2025, the top 5 Target Countries are as follows:

• The Top 10 Industries most affected by the Qilin Ransomware victims list from 1stJan 2025 to 11th November 2025 are as follows:

ETLM Assessment:

 According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and a focus on speed and evasion, make it a particularly dangerous actor.

5. Vulnerabilities and Exploits

Vulnerability in the expr-eval JavaScript library

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Web applications / JS libraries
• Vulnerability: CVE-2025-12735
• CVSS Base Score: 6 Source
• Vulnerability Type: Exposed Dangerous Method or Function
• Summary: The vulnerability allows a remote attacker to compromise the affected application.

Relevancy & Insights: The vulnerability exists because the application uses the unsafe evaluate() method on untrusted input.

Impact: A remote attacker can pass specially crafted data to the application and execute arbitrary JavaScript code.

Affected Products: https[:]//github[.]com/advisories/GHSA-jc85-fpwf-qm7x

Recommendations:

• Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK

This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment

Vulnerability in the expr-eval JavaScript library can pose significant threats to user privacy and application security. This can impact various industries globally, including technology, finance, healthcare, and education. Ensuring the security of expr-eval is crucial for maintaining the integrity and protection of applications that rely on dynamic expression parsing and evaluation.

6. Latest Cyber-Attacks, Incidents, and Breaches

NightSpire Ransomware attacked and published the data of KONCISE COMPANY LIMITED

• Threat Actor: NightSpire Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Construction
• Target Geography: Thailand
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:

Recently, we observed that NightSpire Ransomware attacked and published the data of the KONCISE COMPANY LIMITED (https[:]//koncise01[.]com/) on its dark web website. KONCISE COMPANY LIMITED is a company primarily operating in Thailand, specializing in design, construction, and project development services for hotels, resorts, hospitals, and large-scale commercial buildings. The data leak, following the ransomware attack, encompasses sensitive and confidential records originating from the organizational database. The total size of the data compromised is approximately 2 GB.

Relevancy & Insights:

• NightSpire employs a double extortion strategy, encrypting data and threatening to leak stolen information unless a ransom is This approach is typical of modern ransomware groups and adds pressure on victims to comply with demands.
• NightSpire’s operations show strong influences from existing Ransomware-as-a- Service (RaaS) models, suggesting they might be an emerging group or a rebrand of an existing actor.

ETLM Assessment:

According to CYFIRMA’s assessment, NightSpire is a new ransomware group that emerged in early 2025, marking itself as a formidable player in the rapidly evolving ransomware landscape. Despite its recent appearance, NightSpire has already gained attention for its aggressive tactics and well-structured operations.

7. Data Leaks

Pruksa Holding Data Advertised on a Leak Site

• Attack Type: Data leak
• Target Industry: Construction
• Target Geography: Thailand
• Objective: Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary: |
The CYFIRMA Research team observed that a threat actor “AgSlowly” claims to have breached Pruksa Holding Public Company Limited (PSH), one of Thailand’s largest real estate developers. The actor is advertising a database for sale that allegedly originates from the company’s website, pruksa[.]com.

The data dump, totaling 476 MB, reportedly contains a table

named exp_pruksa_member with hundreds of thousands of user records.

According to the actor, the compromised data includes a significant amount of personally identifiable information (PII). The main table alone allegedly contains 463,577 names.

The exposed data fields include:

• Full names
• Email addresses (460,106 records)
• Phone numbers (417,843 records)
• Hashed passwords (MD5)
• Dates of birth
• Physical addresses (province, zip code, )
• Nationality
• Facebook IDs and other sensitive member profile details

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

Internet Initiative Japan (IIJ) Data Advertised on a Leak Site

• Attack Type: Data leak
• Target Industry: Telecommunications
• Target Geography: Japan
• Objective: Data Theft, Financial Gains
• Business Impact: Data Loss, Reputational Damage

Summary:

The CYFIRMA Research team observed that a hacking group called “KaruHunters” claims the exfiltration and leak of the proprietary source code of Internet Initiative Japan (IIJ), a leading Japanese internet service provider and telecommunications company. This data breach is significant, spotlighting critical cybersecurity challenges faced by major infrastructure and telecom providers.

The dark web post offers downloads of stolen IIJ source code, allegedly obtained through unauthorized access to internal development environments or source code repositories. Source code represents the core intellectual property for IIJ’s network services and cloud infrastructure. The breach indicates a severe compromise either from phishing, vulnerability exploitation, insider threats, or an advanced persistent threat (APT) actor leveraging stealthy tactics.

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

Relevancy & Insights:

Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:

The threat actor known as “KaruHunters” is a highly active and sophisticated group specializing in data leaks. Numerous credible sources attribute multiple security breaches to this group, involving unauthorized access to systems and the illicit sale of stolen data on dark web marketplaces. KaruHunters’ operations highlight the persistent and evolving nature of cyber threats emerging from underground forums. These incidents underscore the critical importance for organizations to enhance their cybersecurity posture through continuous monitoring, leveraging advanced threat intelligence, and adopting proactive defense strategies to protect sensitive data and vital infrastructure.

Recommendations:
Enhance the cybersecurity posture by:

1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being
2. Ensure proper database configuration to mitigate the risk of database-related
3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA Research team observed that a threat actor claims to have breached the National Informatics Centre (NIC), India’s government technology agency. The breach specifically targets the Kavach Authentication App, a two-factor authentication (2FA) tool developed by the NIC for securing access to government email services (like NIC/GOV) and other IT systems. The actor claims to have stolen 1.7 million records.

According to the threat actor, the compromised data from the Kavach app includes:

• User ID
• Email
• Password
• Seed
• sha256_key
• Backup code
• Private Keys

The actor also claims to be selling further access, including:

• Remote Code Execution (RCE)
• SMTP
• Bitbucket
• MSSQL
• AWS S3 Buckets

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

The CYFIRMA Research team observed that a threat actor claims to have breached and stolen data from Envía, a major Colombian logistics company operated by Colvanes SAS. Envía is a prominent logistics and courier service specialising in freight transport and e-commerce solutions, with operations across more than 1,400 destinations.

The threat actor is offering a large database for sale, allegedly exfiltrated from the company’s systems. The proof provided includes screenshots of internal databases and application backends, suggesting access to sensitive operational and customer information.

According to the actor, the breach involves over 500GB of data, totalling more than 140 million data points. The allegedly compromised data includes:

• Full names of individuals and customers
• Addresses
• Contact numbers
• Personal and corporate identification documents

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

STRATEGIC RECOMMENDATIONS

• Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Delay a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATIONS

• Take advantage of global Cyber Intelligence, providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions, remediations, and lessons learned.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM
• Detection processes are tested to ensure awareness of anomalous Timely communication of anomalies should be continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATIONS

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Consider using security automation to speed up threat detection, improved incident response, increased the visibility of security metrics, and rapid execution of security checklists.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence
• Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security controls such as reCAPTCHA (completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News
Geography-Wise Graph

 

Industry-Wise Graph

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.