Weekly Intelligence Report – 21 Aug 2026

Published On : 2026-08-21

Ransomware In Focus

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows OS
Targeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, Chile
Targeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation

Introduction:
CYFIRMA Research and Advisory Team has found MAJINAHANASHI Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

MAJINAHANASHI Group Ransomware
MAJINAHANASHI is a Windows-based ransomware family that encrypts files in place using AES-256 and generates a unique key for each file. The per-file keys are protected using an RSA public key embedded within the ransomware binary, preventing straightforward recovery without the corresponding private key. Encrypted files are renamed with the .majin extension, and the malware creates a README.txt ransom note. The ransomware can execute as a Windows service and supports multiple command-line modes, including targeted-path execution. It also creates a custom lock screen and wallpaper to reinforce the ransom demand after encryption.

Screenshot: File encrypted by ransomware (Source: Surface Web)

Before encryption, MAJINAHANASHI performs extensive recovery inhibition and defense-evasion activities. It deletes volume shadow copies, removes the USN journal, disables System Restore and hibernation, modifies boot-recovery settings, clears Windows event logs, and can terminate security and backup-related processes and services. The malware also employs direct system calls, dynamic API resolution, PEB access, XOR-obfuscated stack strings, geographic and keyboard-layout checks, and I/O-priority manipulation. Network-related functionality based on Windows Filtering Platform and QoS policy controls may be used to interfere with endpoint-security or cloud-agent communications during execution. These capabilities indicate that the ransomware is designed not only to encrypt data but also to reduce detection opportunities and prevent common recovery mechanisms.

Screenshot: The appearance of MAJINAHANASHI’s ransom note (README.txt) (Source: Surface Web)

MAJINAHANASHI follows a double-extortion model by claiming to exfiltrate internal data in addition to encrypting local files. The ransom note threatens public disclosure of stolen information if negotiations fail and provides a short deadline intended to increase pressure on victims. Technical artifacts associated with the malware include a distinctive mutex, encryption marker, service name, dropped-file paths, wallpaper files, and characteristic ransom-note strings, which can support host-based detection and incident investigation. Overall, the malware combines conventional AES/RSA-based encryption with aggressive recovery inhibition, security-control interference, and data-leak threats, making the primary risk a combination of operational disruption, loss of data availability, and potential exposure of sensitive organizational information.

Screenshot: The appearance of MAJINAHANASHI’s DLS site (Source: Dark web)

The following are the TTPs based on the MITRE ATT&CK framework

Tactic	Technique ID	Technique Name
Tactic	Technique ID	Technique Name
Execution	T1047	Windows Management Instrumentation
Execution	T1129	Shared Modules
Persistence	T1542.003	Pre-OS Boot: Bootkit
Persistence	T1543.003	Create or Modify System Process: Windows Service
Privilege Escalation	T1055	Process Injection
Privilege Escalation	T1543.003	Create or Modify System Process: Windows Service
Discovery	T1033	System Owner/User Discovery
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Discovery	T1614.001	System Location Discovery: System Language Discovery
Command and Control	T1090	Proxy
Impact	T1486	Data Encrypted for Impact
Impact	T1490	Inhibit System Recovery
Stealth	T1027.005	Obfuscated Files or Information: Indicator Removal from Tools
Stealth	T1036	Masquerading
Stealth	T1055	Process Injection
Stealth	T1070	Indicator Removal
Stealth	T1070.004	Indicator Removal: File Deletion
Stealth	T1542.003	Pre-OS Boot: Bootkit

Relevancy and Insights:

The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities.
Defense evasion: Multiple evasion techniques were observed, including direct system calls, dynamic API resolution, PEB access, XOR-obfuscated strings, process and service manipulation, geographic and keyboard-layout checks, I/O-priority manipulation, and network-control mechanisms designed to reduce security-monitoring visibility.
Recovery inhibition: The ransomware deletes Volume Shadow Copies, removes the USN Journal, clears Windows event logs, disables System Restore and hibernation, and modifies boot-recovery configurations. These actions are intended to prevent victims from using native recovery mechanisms and to reduce forensic artifacts following the attack.
Security and backup targeting: The malware can terminate security and backup-related processes and services, with observed targeting of endpoint-security and backup products. It also uses Windows Filtering Platform and network QoS controls, potentially to interfere with security-agent or cloud-based communications during execution.
Data encryption and extortion: Files are encrypted using AES-256, with unique per-file keys protected through RSA. The ransomware appends the .majin extension and uses a ransom note to communicate the recovery demand. The operation additionally claims to exfiltrate internal data, introducing a double-extortion component involving the threatened public disclosure of stolen information.

ETLM Assessment:

MAJINAHANASHI is likely to evolve toward stronger defense evasion and more automated disruption of enterprise security and recovery infrastructure. Its existing use of direct system calls, dynamic API resolution, process termination, recovery inhibition, and Windows Filtering Platform controls provides a foundation for expanding anti-analysis and security-agent interference capabilities. Future variants may further automate the identification and termination of endpoint protection, backup, virtualization, and monitoring services before encryption, while improving privilege escalation, environment checks, and execution logic to adapt the attack to different Windows environments. The ransomware may also refine its encryption workflow for greater performance and reliability across large enterprise file systems and network-accessible storage.

The double-extortion model is also likely to become more operationally mature, with greater emphasis on data theft, victim profiling, and coordinated leak pressure alongside file encryption. Based on the observed combination of encryption, recovery destruction, network-control capabilities, and data-disclosure threats, future versions could expand their targeting of centralized backup repositories, file servers, and virtualized infrastructure to maximize operational impact. The malware may additionally introduce stronger anti-forensic mechanisms, more flexible command-and-control functionality, and improved mechanisms for selectively encrypting high-value data. Overall, its likely evolution is toward a more resilient and enterprise-focused threat that combines rapid encryption, suppression of recovery and security controls, and sustained pressure through exfiltration-based extortion.

Sigma rules:

title: Boot Configuration Tampering Via Bcdedit.EXE
tags:
– attack.impact
– attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
– Image|endswith: ‘\bcdedit.exe’
– OriginalFileName: ‘bcdedit.exe’
selection_set:
CommandLine|contains: ‘set’
selection_cli:
– CommandLine|contains|all:
– ‘bootstatuspolicy’
– ‘ignoreallfailures’
– CommandLine|contains|all:
– ‘recoveryenabled’
– ‘no’
condition: all of selection_*
falsepositives:
– Unlikely
level: high
(Source: Surface Web)

IOCs:

Kindly refer to the IOCs section to exercise control of your security systems (Source: Surface Web)

RECOMMENDATIONS

STRATEGIC RECOMMENDATION

Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
Ensure that backups of critical systems are maintained which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATION

A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) If there is a requirement to inform the local authority.
To reduce the risk of credentials being compromised, enable multifactor authentication (MFA) and zero-trust architecture.
Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATION

Ensure that all applications and software are consistently maintained by deploying the most recent releases and applying available security updates and patches in a timely manner.
Incorporate the Sigma rule for threat detection and monitoring, which will assist in identifying and tracking suspicious activity as well as detecting anomalies in log events.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

Active Malware of the Week

Type: RAT
Objectives: Surveillance/ Data Exfiltration
Target Technology: Windows
Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the week
This week “HeroinRAT” Malware is in focus.

Overview of Operation HeroinRAT Malware

The analyzed malware sample exhibits a broad set of behaviors indicating that it is designed to gain control of a Windows system, remain active, collect valuable information, and create additional opportunities for abuse. Its observed activity goes beyond simple information gathering, with the sample interacting extensively with the host environment and attempting to establish a foothold that can survive beyond its initial execution. The overall behavior suggests a multi-purpose threat capable of affecting both user data and system security.

A significant concern is the sample’s focus on information that could be valuable to an attacker. Observed behavior includes keystroke collection, access to stored credentials, examination of local files, and attempts to obtain sensitive information such as Wi-Fi credentials and credit-card-related data. The malware also gathers information about the system, users, running processes, installed software, and security products, allowing it to understand the environment in which it is operating.

The sample also demonstrates several behaviors intended to make detection and removal more difficult. It can establish recurring execution through scheduled tasks and registry-based startup mechanisms, while its activity includes attempts to weaken Windows security protections. During analysis, the sample was observed stopping or disabling Windows Defender and using hidden scripting activity, creating conditions in which additional malicious components could operate with reduced interference.

Another notable aspect is the sample’s ability to support secondary malicious activity. Its observed behavior includes retrieving and executing an external mining-related script, suggesting that a compromised system could potentially be used to generate cryptocurrency for an attacker in addition to serving as a source of sensitive information. Taken together, the findings indicate a threat with the potential to compromise confidentiality, weaken endpoint defenses, maintain continued access, and misuse system resources. Organizations should therefore treat detections associated with this sample as a high-priority security event and investigate affected systems for persistence, credential exposure, and unauthorized resource usage.

Attack Method

The malware begins its activity by executing on a Windows host and interacting directly with the operating system to identify the environment and prepare itself for subsequent actions. It gathers host information such as the logged-in username, hostname, system characteristics, available memory, running processes, installed software, accounts, files, and security products. The sample also uses mutex-related checks to identify an existing instance and contains anti-analysis capabilities, including checks intended to identify analysis or sandbox environments. Its executable structure includes a TLS section and runtime API resolution, while memory-related operations include allocating executable memory and manipulating thread execution, which can complicate conventional analysis.

For persistence, the malware uses multiple mechanisms rather than depending on a single startup location. Analysis identified scheduled-task activity and registry-based startup persistence, including the creation of a task named “MicrosoftEdgeUpdate” that periodically launches an executable from a temporary directory. The sample also demonstrates registry modification and service-related activity, providing additional avenues for maintaining execution. This multi-layered persistence approach increases the likelihood that the malware can regain execution after a reboot or interruption of its primary process.

Malware places substantial emphasis on credential and information collection. Its observed capabilities include polling-based keylogging, accessing credential stores, credential dumping-related activity, collecting information from the local system, reading files, and examining user and account information. It also attempts to obtain saved Wi-Fi credentials by using netsh wlan export profile key=clear, while its behavior indicators show an interest in credit-card information. These activities are supported by discovery routines covering processes, system information, directories, installed software, security products, and registry data, allowing the malware to identify potentially valuable information before further actions are performed.

The sample additionally attempts to weaken endpoint defenses and execute externally retrieved content. During behavioral analysis, it invoked PowerShell to disable Windows Defender real-time monitoring and used sc commands to stop and disable the Defender service. It also executed PowerShell with hidden-window and execution-bypass options to retrieve an external xmrig.ps1 script associated with cryptocurrency mining. The malware therefore combines host reconnaissance, credential collection, persistence, defense impairment, scripting, and resource hijacking within a single attack chain. Its use of XOR-based data encoding, runtime API linking, process/thread manipulation, and reflective or memory-based execution further demonstrates an emphasis on maintaining control while reducing the visibility of its activities.

The following are the TTPs based on the MITRE ATT&CK Framework for Enterprises

Execution	T1059.001	Command and Scripting Interpreter: PowerShell
	T1106	Native API
	T1129	Shared Modules
	T1569	System Services
Persistence	T1112	Modify Registry
	T1543	Create or Modify System Process
	T1547	Boot or Logon Autostart Execution
Stealth	T1027	Obfuscated Files or Information
	T1036	Masquerading
	T1070	Indicator Removal
	T1202	Indirect Command Execution
	T1497	Virtualization/Sandbox Evasion
	T1620	Reflective Code Loading
Credential Access	T1003	OS Credential Dumping
	T1056	Input Capture
	T1552	Unsecured Credentials
	T1555	Credentials from Password Stores
Discovery	T1012	Query Registry
	T1033	System Owner/User Discovery
	T1057	Process Discovery
	T1082	System Information Discovery
	T1083	File and Directory Discovery
	T1087	Account Discovery
	T1518	Software Discovery
Collection	T1005	Data from Local System
Command and control	T1071	Application Layer Protocol
Command and control	T1573	Encrypted Channel
Impact	T1496	Resource Hijacking

INSIGHTS

The analyzed activity indicates that malware is not limited to a single objective. Its behavior reflects an opportunistic approach in which a compromised system can become a source of multiple types of value for an attacker. Sensitive user information, system context, and computing resources are all potentially useful, allowing the same infection to support different criminal objectives rather than relying on one specific outcome.
Another notable insight is the malware’s ability to operate across different stages of a compromise without requiring highly specialized infrastructure at every stage. It combines information gathering, system manipulation, and external content retrieval in a way that allows its activity to change according to the environment. This makes the sample more representative of a flexible intrusion tool than a narrowly focused piece of malware.
The sample also demonstrates a clear overlap between information theft and resource abuse. The presence of both data-collection behavior and cryptocurrency-mining activity suggests that the infected machine can serve as both an information source and a monetizable computing asset. This combination increases the potential value of a successful infection to an attacker, particularly because the objectives do not depend on one another.

ETLM ASSESSMENT

From an ETLM perspective, this malware represents a growing risk for organizations because future variants of similarly versatile threats may increasingly combine information theft, system misuse, and financial objectives within a single compromise. Organizations could face greater disruption when employee endpoints are abused for multiple purposes, while employees may become more exposed to the loss of credentials, personal information, and system resources. Over time, such infections are likely to increase the cost and complexity of incident response, particularly when attackers use compromised employee systems for several interconnected objectives rather than pursuing a single form of exploitation.

IOCs:

Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)

YARA Rules

rule HeroinRAT_Malware
{
meta:
description = “Detection rule for the analyzed malware sample”
author = “Threat Research”
date = “2026-08-17”

strings:
$hash = “f3755d4d4fe143a1757bcadc32c848331de371dd7fa8ce3821e87a671a7cecf7”
$s1 = “Set-MpPreference -DisableRealtimeMonitoring $true”
$s2 = “sc config WinDefend start= disabled”
$s3 = “sc stop WinDefend”
$s4 = “MicrosoftEdgeUpdate”
$s5 = “netsh wlan export profile key=clear”
$s6 = “malicious-miner.com/xmrig.ps1”
$s7 = “powershell -window hidden -exec bypass”
$s8 = “xmrig.ps1”
$s9 = “HeroinRAT”

condition:
$hash or
(
uint16(0) == 0x5A4D and
4 of ($s*)
)
}

Recommendations

STRATEGIC RECOMMENDATION

Establish an organization-wide endpoint security strategy covering malware prevention, detection, and response.
Prioritize protection of sensitive credentials and business information stored or accessed from employee endpoints.
Adopt layered security controls so that a single compromised endpoint does not provide prolonged access to organizational resources.
Conduct periodic threat assessments to identify exposure to multi-purpose malware and similar information-stealing threats.

MANAGEMENT RECOMMENDATION

Ensure endpoint protection and security monitoring capabilities are consistently deployed across employee systems.
Establish clear incident-response procedures for suspected malware infections, including isolation, investigation, and recovery.
Provide regular security-awareness training focused on suspicious files, links, downloads, and unexpected system activity.
Maintain appropriate controls over access to sensitive corporate information and user accounts.

TACTICAL RECOMMENDATION

Monitor endpoints for unusual PowerShell activity, unauthorized scheduled tasks, registry changes, and unexpected process execution.
Investigate abnormal attempts to disable or interfere with security software.
Monitor for unauthorized collection of credentials, Wi-Fi profiles, sensitive files, and other user information.
Block and investigate connections to known malicious infrastructure associated with the malware.
Perform endpoint hunting for persistence mechanisms and unauthorized files following any confirmed infection.
Isolate compromised systems promptly and reset potentially exposed credentials after containment.

CYFIRMA’s Weekly Insights

1. Weekly Attack Types and Trends

Key Intelligence Signals:

Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
Ransomware –Gunra Ransomware, The Gentlemen Ransomware | Malware – HeroinRAT
- Gunra Ransomware – One of the ransomware groups.
- The Gentlemen Ransomware – One of the ransomware groups.
Please refer to the trending malware advisory for details on the following:
- Malware – HeroinRAT
Behaviour –Most of these malware use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

APT36: Evolving Espionage Tradecraft Across South Asian Critical Infrastructure

Threat Actor: APT36 aka Transparent Tribe
Attack Type: Spear-Phishing, Malware Implant, Exploitation of Vulnerabilities, ClickFix Technique, Watering-hole Attacks
Objective: Espionage, Information Theft
Target Technology: Office Suites Software, Operating System, Web Application, Linux BOSS
Target Geography: Afghanistan, Australia, Azerbaijan, Belgium, Botswana, Bulgaria, Canada, China, Czech Republic, Germany, India, Iran, Japan, Kazakhstan, Kenya, Malaysia, Mongolia, Nepal, Netherlands, Oman, Pakistan, Romania, Saudi Arabia, Spain, Sweden, Thailand, Turkey, UAE, UK, USA.
Target Industries: Aerospace & Defense, Capital Goods, Diplomats, Education, Embassies, Government, Military, Rail & Road, Transportation
Business Impact: Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor

Transparent Tribe, also known as APT36, is a state-sponsored Pakistani threat actor believed to have been active since 2016. The group conducts cyber-espionage operations aimed at collecting sensitive information to support Pakistan’s military and diplomatic interests. The threat actor primarily relies on spear-phishing and watering-hole attacks to gain initial access, using malicious macro-enabled documents or vulnerability-based RTF files as delivery mechanisms.

Details on Exploited Vulnerabilities:

CVE ID	Affected Products	CVSS Score	Exploit Links
CVE-2026-21509	Microsoft Office	7.8	–
CVE-2025-10035	Fortra’s GoAnywhere MFT	9.8	–
CVE-2017-8759	Microsoft .NET Framework	7.8	link
CVE-2023-39234	TKWave 3.3.115	7.8	–
CVE-2021-40539	Zoho ManageEngine	9.8	link

TTPs based on MITRE ATT&CK Framework

Tactic	ID	Technique
Resource Development	T1583.001	Acquire Infrastructure: Domains
Resource Development	T1584.001	Compromise Infrastructure: Domains
Resource Development	T1608.001	Stage Capabilities: Upload Malware
Resource Development	T1587.003	Develop Capabilities: Digital Certificates
Resource Development	T1608.004	Stage Capabilities: Drive-by Target
Initial Access	T1566.001	Phishing: Spear phishing Attachment
Initial Access	T1189	Drive-by Compromise
Initial Access	T1566.002	Phishing: Spear-phishing Link
Execution	T1203	Exploitation for Client Execution
Execution	T1204.001	User Execution: Malicious Link
Execution	T1059.005	Command and Scripting Interpreter: Visual Basic
Execution	T1204.002	User Execution: Malicious File
Stealth	T1036.005	Masquerading: Match Legitimate Name or Location
Stealth	T1027.013	Obfuscated Files or Information: Encrypted/Encoded File
Stealth	T1564.001	Hide Artifacts: Hidden Files and Directories
Command and Control	T1568	Dynamic Resolution

Latest Developments Observed

The threat actor is suspected of deploying the newly identified PATCHCORD backdoor through sector-specific lures impersonating Afghan Telecom and other legitimate organizations to target telecom and critical infrastructure entities across South Asia. The campaign has also introduced SHEETCORD and HACKERAI C2 Agent, leveraging Google Sheets and GitHub Gists for command-and-control. The activity appears aimed at establishing persistent access and exfiltrating sensitive information for intelligence-gathering purposes.

ETLM Insights:

APT36 (Transparent Tribe), a state-sponsored threat actor assessed to operate in alignment with Pakistan’s strategic intelligence objectives, continues to demonstrate an intelligence-driven and adaptive operational model focused on sustained access, surveillance, and sensitive information collection. The group’s evolving tradecraft reflects a deliberate emphasis on social engineering, credential-focused intrusion, and custom malware to establish covert access while maintaining operational persistence.
The threat actor’s operations reflect:

Intelligence-driven social engineering designed to exploit trust, context, and human interaction for initial access.
Persistent access and surveillance through custom malware and credential-focused intrusion techniques.
Adaptive delivery mechanisms incorporating tailored lures and evolving malware capabilities to improve successful compromise.
Operational resilience through diversified tooling and evolving intrusion techniques that support sustained intelligence collection.

Looking ahead, APT36 is expected to further mature its espionage tradecraft by refining social-engineering techniques, diversifying malware and delivery mechanisms, and strengthening persistence-oriented capabilities. The continued evolution of its operational model is likely to enhance its ability to conduct long-term intelligence collection while maintaining stealth and resilience against modern defensive controls.

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

YARA Rules
rule APT36_Suspicious_Malware_Indicators
{
meta:
description = “Detects malware associated with APT36-related activity using provided indicators”
author = “CYFIRMA”
date = “2026-08-17”
threat_actor = “APT36 (Transparent Tribe)”

strings:
$domain1 = “departmentofdefence.live” ascii nocase
$domain2 = “accounts.mgovcloud.in.departmentofdefence.live” ascii nocase
$domain3 = “mdgovindia.space” ascii nocase
$domain4 = “securestore.tv” ascii nocase
$domain5 = “sorlastore.com” ascii nocase

$file1 = “nbtscan-1.0.35.exe” ascii nocase
$file2 = “nbt.exe” ascii nocase
$file3 = “abuse-ransomware.csv” ascii nocase
$file4 = “ransomware.csv” ascii nocase

condition:
2 of ($domain*) or
2 of ($file*)
}

Recommendations

Strategic Recommendations

Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
Deploy Zero Trust Policy that leverages tools like security information management, advanced security analytics platforms, security user behaviour analytics, and other analytics systems to help the organization’s security personnel observe in real-time what is happening within their networks so they can orient defences more intelligently.
Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more by identifying such patterns.

Management Recommendations

Regularly reinforce awareness related to different cyberattacks using impersonated domains/spoofed webpages with end-users across the environment and emphasize the human weakness in mandatory information security training sessions.
Look for email security solutions that use ML- and AI-based anti-phishing technology for BEC protection to analyze conversation history to detect anomalies, as well as computer vision to analyze suspect links within emails.

Tactical Recommendations

Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
Set up DMARC (Domain-based Message Authentication Reporting & Conformance) to stop phishers from spoofing your domain (that is, making their emails look like they come from your organization).
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

Poland describes a cyberattack against a heat-and-power plant from this winter

According to Poland’s CERT, hackers breached a combined heat-and-power plant by leveraging a wind farm’s compromised firewall to tunnel through a misconfigured private APN network. The attackers accessed a power plant controller secured with default credentials, temporarily disabling a steam turbine and water treatment system before authorities restored full operations without public impact. The December 29, 2025, attack – the first recorded instance of an APN being used for lateral OT network movement – was part of a broader campaign linked to Russia’s Electrum APT aimed at shutting down heating facilities across Poland during mid-winter.

ETLM Assessment:

Poland serves as the logistical, military, and humanitarian hub for Western assistance to Ukraine. Because direct military aggression against a NATO member state would trigger Article 5, Moscow relies on non-kinetic, “grey-zone” operations (such as cyberattacks, sabotage, and disinformation) to inflict infrastructure friction and economic costs on Warsaw without crossing the threshold into open war.

Beyond immediate disruption, successful intrusions act as strategic signaling to NATO. Probing or briefly disabling turbines communicates capability: it demonstrates to Western leadership that Russia possesses the cyber tools to paralyze civilian life deep inside NATO territory, should regional tensions escalate further.

U.K. Naval Drones Component Sent Signals to China

Cameras mounted on British naval drones were discovered sending signals to an internet address in China, exposing severe supply chain vulnerabilities in Western military hardware. A Ministry of Defence investigation confirmed that while the component broadcast a signal, no sensitive data or systems were compromised. The issue affected the K3 Scout drone boat – manufactured by UK-based Kraken Technology, which recently secured a $49 million U.S. Special Operations Command contract – though company officials state the vulnerability has since been resolved.

ETLM Assessment:

The incident highlights the defense sector’s deep reliance on Chinese components, particularly for low-cost parts like motors, cameras, and batteries. While the U.K. banned new Chinese drones and components, tracing small electronics deep within global supply chains remains exceptionally difficult. The challenge is further complicated by cost: Western-made alternatives can cost up to ten times more than Chinese parts. As naval and aerial drones become central to modern warfare – as demonstrated in recent operations across Ukraine and the Middle East – Western militaries face an ongoing struggle to purge Chinese hardware without driving production costs out of reach.

Under Chinese legal frameworks such as the National Intelligence Law, domestic companies operating in China can be compelled by Beijing to assist state intelligence work, feed state actors backdoors, or hand over remote access infrastructure to any of its products.

4. Rise in Malware/Ransomware and Phishing

Gunra Ransomware Impacts an Agricultural Biotechnology and Fertilizer Manufacturing Company from Indonesia

Attack Type: Ransomware
Target Industry: Agricultural Biotechnology and Fertilizer Manufacturing
Target Geography: Indonesia
Ransomware: Gunra Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:

CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Indonesia was compromised by Gunra Ransomware. The compromised company is an agricultural biotechnology and fertilizer manufacturing company. Its core activity is the manufacturing and sale of biochemical/organic compound fertilizers, with an emphasis on improving soil quality, crop productivity, and more sustainable agricultural practices. The compromised data includes confidential and sensitive information belonging to the organization. The total size of compromised data is approximately 150 GB.

The following screenshot was observed published on the dark web:

Source: Dark Web

Relevancy & Insights:

Gunra is a highly sophisticated double-extortion ransomware group that emerged in April 2025, leveraging leaked Conti ransomware code and operating with advanced encryption and evasion capabilities.
The Gunra Ransomware group primarily targets countries such as the United States of America, Spain, Thailand, South Korea, and Brazil.
The Gunra Ransomware group primarily targets industries, including Professional Goods & Services, Materials, Transportation & Logistics, Real Estate & Construction, and Healthcare.
Based on the Gunra Ransomware victims list from 1st Jan 2026 to 18th August 2026, the top 5 Target Countries are as follows:

The Top 10 Industries most affected by the Gunra Ransomware group victims list from 1st Jan 2026 to 18th August 2026 are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, Gunra Ransomware is a financially motivated ransomware group that emerged in April 2025, rapidly establishing itself as a significant threat within the evolving ransomware landscape. Leveraging a double-extortion model, Gunra encrypts victim data while simultaneously exfiltrating sensitive information to pressure organizations into paying ransom demands.

The Gentlemen Ransomware Impacts a Healthcare Company from Japan

Attack Type: Ransomware
Target Industry: Healthcare
Target Geography: Japan
Ransomware: The Gentlemen Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:

CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a prominent Japanese brand renowned for its high-quality cosmetics, dietary supplements, and health foods. Originally founded as a translation company, it achieved global success by focusing on pure, natural ingredients—most notably its signature olive oil skincare. Today, the company is trusted worldwide for combining rigorous scientific research with effective, affordable wellness products. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Germany.
The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 18th August 2026, the top 5 Target Countries are as follows:

The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 18th August 2026 are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploit

Vulnerability in Vault Secrets Operator

Attack Type: Vulnerabilities & Exploits
Target Technology: Kubernetes
Vulnerability: CVE-2026-8715
CVSS Base Score: 9.6 Source
Vulnerability Type: Credentials exfiltration
Summary: The vulnerability allows a remote user to disclose sensitive information.

Relevancy & Insights:

The vulnerability exists due to improper access control in the AppRole authentication configuration when processing tenant-supplied spec.appRole.secretIDPath and VaultConnection.spec.address values. A remote user can configure the operator to read an accessible file from the operator pod filesystem and transmit its contents to a tenant-controlled endpoint to disclose sensitive information.

Impact :

Exploitation requires an authenticated Kubernetes user with create and get permissions on VaultAuth, VaultConnection, and VaultStaticSecret resources in their namespace. The issue can potentially lead to privilege escalation within the cluster.

Affected Products:

https[:]//discuss[.]hashicorp[.]com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645

Recommendations:

Monitoring and Detection:

Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK

This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment:

The vulnerability in Vault Secrets Operator presents a critical security risk to organizations using affected versions in Kubernetes environments. The issue allows a tenant with limited Kubernetes RBAC permissions to read files from the operator pod’s filesystem and transmit their contents to a tenant-controlled endpoint through the AppRole authentication configuration. Successful exploitation could result in the exposure of sensitive files and credentials and may facilitate privilege escalation within the Kubernetes cluster. Organizations using Vault Secrets Operator versions 1.3.0 through 1.4.1 should prioritize upgrading to version 1.5.0 or later. Organizations should also review Kubernetes RBAC permissions, monitor operator activity and outbound connections, and rotate potentially exposed credentials where necessary. Prompt remediation and continuous monitoring are recommended to reduce the risk of unauthorized access and credential compromise.

6. Latest Cyber-Attacks, Incidents, and Breaches

Krybit Ransomware attacked and published the data of a Healthcare company from Singapore

Threat Actor: Krybit Ransomware
Attack Type: Ransomware
Objective: Data Leak, Financial Gains
Target Technology: Web Applications
Target Industry: Healthcare
Target Geography: Singapore
Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:

Recently, we observed that Krybit Ransomware attacked and published the data of a Healthcare company from Singapore on its dark web website. The compromised company is a Singaporean private primary healthcare group founded in the 1990s, headquartered in Singapore. Starting from a single clinic, the group has expanded to 11 primary care medical clinics spread across Singapore. The group offers a comprehensive range of quality primary healthcare services including: treatment for common acute and chronic ailments; minor surgeries; weight management; health screenings and counselling; adult and children vaccinations; skin and food allergy testing; laboratory services; and aesthetic services (Botox, chemical skin peels, micro-dermabrasion, laser and IPL treatments). The Total size of the compromised data is approximately 114.15 GB.

Source: Dark Web

Relevancy & Insights:

Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is paid.
The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Government & Civic, Consumer Goods & Services, and Information Technology.

ETLM Assessment:

According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.

7. Data Leaks

Unauthorized Food Delivery Platform Database Exposure Advertised on a Leak Site

Attack Type: Data Leak
Target Industry: Food Delivery / Online Food Services
Target Geography: South Korea
Objective: Financial Gain
Business Impact: Exposure of Personally Identifiable Information (PII), Financial Data Exposure, Customer Privacy Risks, Credential Compromise, Payment Fraud, Operational Disruption, Regulatory Compliance Concerns, Financial Loss, and Reputational Damage

Summary:
The CYFIRMA research team identified a post on a dark web forum claiming the availability of a large database allegedly originating from a South Korean food-delivery platform. According to the advertisement, the dataset reportedly contains approximately 47.9 million database records, totaling around 46.6 GB of data.
According to the advertisement, the exposed environment allegedly contains recent production data and was accessible without authentication through misconfigured cloud services.
The post claims:

Database and cloud storage resources were accessible without authentication.
Firestore and cloud storage repositories were reportedly exposed with read and write permissions.
The advertised data allegedly includes records collected between August 13 and August 14, 2026.
Approximately 8.14 million orders are reportedly included.
Customer order information allegedly contains home GPS coordinates and apartment/building door codes.
Approximately 11,000 delivery rider profiles are reportedly exposed.
Rider information allegedly includes Resident Registration Numbers (RRNs) and plaintext passwords.
Approximately 8,600 restaurants/stores are reportedly represented in the dataset.
Customer information allegedly covers approximately 22 million customer accounts.
The advertisement also claims exposure of payment-related infrastructure, including payment-gateway API keys and terminal credentials.
The dataset reportedly contains additional operational files, order images, management-related files, and application/database information.

Allegedly Exposed Information

Based on the information visible in the advertisement, the exposed dataset may contain:
Customer account information
Customer names and identifying information
Resident Registration Numbers (RRNs)
Bank account information
Customer contact information
Customer order records
Delivery addresses
Home GPS coordinates
Apartment/building door access codes
Delivery rider profiles
Rider authentication credentials
Plaintext passwords
Restaurant/store information
Payment-related information
Payment gateway API keys
Payment terminal credentials
Order images
Restaurant and operational records
Management-related files
Application configuration information
Cloud database records
Cloud storage objects
Internal business and operational data

The advertised exposure represents a potentially high-impact data security incident due to the alleged combination of large-scale customer records, identity information, delivery-location data, authentication credentials, restaurant information, and payment-related infrastructure.
The reported exposure of GPS coordinates, apartment door codes, RRNs, bank information, passwords, and payment credentials increases the potential consequences beyond a conventional database leak. If the claimed unauthenticated read/write access is accurate, the incident could also involve risks of data manipulation, account takeover, payment fraud, and operational disruption.
The authenticity and completeness of the advertised dataset have not been independently verified. This assessment is based on information visible in the provided dark-web advertisement and should therefore be treated as an alleged exposure until independently confirmed.

Source: Underground Forums

Unauthorized Subscription and Invoice Data Advertised on a Leak Site

Attack Type: Data Leak
Target Industry: Food & Beverage / Subscription Meal Services
Target Geography: Saudi Arabia, Egypt, and the United Arab Emirates
Objective: Financial Gain
Business Impact: Exposure of Customer Information, Subscription Data, Invoice Records, Personally Identifiable Information (PII), Internal Business Information, Privacy Risks, Regulatory Compliance Concerns, Financial Loss, and Reputational Damage

Summary: The CYFIRMA research team identified a post observed on a dark web forum that claims the availability of a large collection of subscription-related information allegedly originating from a food and meal subscription service operating in Saudi Arabia, Egypt, and the United Arab Emirates.
According to the advertisement, the seller claims to possess 25,919 images of subscription invoices and other internal images, along with multiple datasets containing customer, subscription, invoice, and operational information.
The advertisement also provides sample information and attached screenshots as alleged proof of possession.
Based on the information visible in the forum advertisement, the allegedly exposed data may include:

25,919 images of subscription invoices and other internal documents.
Customer information associated with approximately 1,291 records.
Subscription-related information associated with approximately 12,248 records.
Invoice-related JSON data covering approximately 26,555 records.
Additional subscription data covering approximately 13,553 records.
Customer identification and account information.
Customer names and customer types.
Registration and subscription dates.
Subscription status and plan information.
Customer phone numbers and contact information.
Customer addresses.
Delivery-related information.
Remaining subscription days and delivery-day information.
Meal-type information.
Invoice numbers and invoice status.
Payment-related and financial fields within invoice records.
Discount, tax, net amount, and total invoice values.
Subscription branch and delivery branch information.
Internal application and business records.

Allegedly Exposed Information
The advertisement indicates that several categories of customer and business information may have been exposed.

Customer Information
Customer ID
Customer name
Customer type
Registration date
Customer status
Customer category
Customer address
Customer phone number
Contact information
Delivery-related information
Subscription Information
Subscription ID
Customer ID
Customer name
Driver information
Start date
Subscription status
Subscription plan
Creation date
Remaining subscription days
Last delivery date
Delivery duration
Delivery days
Meal types
Phone number
Address
Delivery branch information
Invoice Information
Customer identifiers
Customer name
Invoice date
Invoice number
Invoice status
Subscription information
Subscription branch
Delivery branch
Currency
Currency rate
Total amount
Discount
Net amount
Tax
Invoice type
Payment-related fields
Notes
Action and expiration dates
Payment date
Manual discount information
Confirmation status
Additional invoice metadata
Internal Images and Documents
The forum advertisement claims possession of:
Subscription invoice images
Internal business images
Customer-related documents
Subscription-related records
Invoice documentation
Operational information
Application-generated data
Additional internal business records

The authenticity and completeness of the advertised dataset have not been independently verified. This assessment is based on the information visible in the provided dark-web advertisement and should therefore be treated as an alleged exposure until independently confirmed.

Source: Underground Forums

Relevancy & Insights:

Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:

The threat actor is assessed as an active and capable entity primarily engaged in data-leak operations, with multiple credible indications linking them to incidents involving unauthorized system access and the dissemination or sale of stolen data on dark web forums. These activities underscore the growing sophistication of cyber threats driven by organized underground networks and highlight the urgent need for organizations to enhance their cybersecurity posture through continuous monitoring, improved threat intelligence, and proactive defensive measures to protect sensitive information and critical infrastructure.

Recommendations: Enhance the cybersecurity posture by

Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
Ensure proper database configuration to mitigate the risk of database-related attacks.
Establish robust password management policies, incorporating multi-factor authentication and role-based access, to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a post observed on a cybercrime forum that claims the availability of a large engineering data archive allegedly associated with an automotive and electric vehicle manufacturer.
According to the advertisement, the dataset reportedly contains approximately 5.08 TB of engineering information distributed across more than 56,000 files. The material is claimed to consist of engineering and design information developed between approximately 2023 and 2025.
The advertised archive reportedly contains detailed engineering information related to critical vehicle systems and components.
Based on the information visible in the advertisement, the allegedly exposed dataset may include:

High-fidelity 3D CAD models.
CATIA, STEP, and IGES engineering files.
Simulation results.
Finite Element Analysis (FEA) data.
NVH analysis and simulation data.
Static and modal analysis.
Topology optimization data.
Large-scale Computational Fluid Dynamics (CFD) simulations.
Engineering project reports.
Bills of Materials (BOMs).
Design documentation.
Validation documentation.
Design for Manufacturing (DFM) information.
Vehicle component and system designs.
Engineering service documentation.
Structural and aerodynamic analysis information.

Critical Vehicle Components Allegedly Exposed
The advertisement specifically claims that the collection covers engineering information associated with several vehicle components and systems, including:

ADAS mounting brackets and structures
Protective covers and housings
LiDAR cleaning systems
Display and cluster housings
Structural and NVH analyses
Other associated vehicle engineering components and designs.
Scale of the Alleged Exposure
The advertisement claims a substantial engineering-data archive:
Approximately 5.08 TB of data
More than 56,000 files
Engineering information reportedly developed between 2023 and 2025
Multiple categories of CAD and engineering simulation files
Project reports and engineering documentation
BOM and manufacturing-related information
Design, validation, and DFM-related material

The combination of CAD models, simulation results, BOMs, and engineering documentation could provide extensive insight into vehicle design and development processes.
The authenticity and completeness of the advertised dataset have not been independently verified. This assessment is based on the information visible in the provided cybercrime-forum advertisement and should therefore be treated as an alleged exposure until independently confirmed.

Source: Underground forums

RECOMMENDATIONS

STRATEGIC RECOMMENDATION

Attack Surface Management should be adopted by organizations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, active network monitoring, through next generation security solutions and ready to go incident response plan.
Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATION

Take advantage of global Cyber Intelligence providing valuable insights on threat actor activity, detection, and mitigation techniques.
Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied and the proper implementation of security technologies, followed by corrective actions remediations, and lessons learned.
Move beyond the traditional model of security awareness towards improved simulation and training exercises that mimic real attack scenarios, account for behaviours that lead to a compromised, and, are measured against real attacks the organization receives.
Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcoming of EDR and SIEM solutions.
Detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies and continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATION

Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthen defences based on tactical intelligence provided
Deploy detection technologies that are behavioural anomaly-based to detect ransomware attacks and help to take appropriate measures.
Implement a combination of security control such as reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.