Ransomware in focus
CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Targeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, Chile
Targeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation
Introduction:
CYFIRMA Research and Advisory Team has found Fiasco Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
Fiasco Ransomware
Fiasco Ransomware is a file-encrypting ransomware that compromises systems, encrypts files using the AES algorithm, and appends the .secure extension to affected filenames. For example, files such as 1.jpg and 2.png are renamed to 1.jpg.secure and 2.png.secure. The malware also creates a ransom note named CONTACT US.txt after encryption. In addition to file encryption, the attackers claim to have exfiltrated sensitive information before encryption, including personal records, financial documents, customer information, business-confidential files, source code, databases, accounting data, and audit reports. This makes the threat a double-extortion ransomware, combining data encryption with the threat of public data disclosure.
Screenshot: File encrypted by ransomware
(Source: Surface Web)
The ransom note informs victims that their network has been compromised and that their files have been encrypted, while threatening to publish the allegedly stolen data if the victim does not cooperate. It instructs victims to establish contact through a private messaging service and provide a specified identification key so the attackers can identify the victim and continue ransom negotiations. No fixed ransom amount is provided; payment demands and further instructions are apparently given after communication is established. The note also attempts to discourage victims from seeking outside assistance by warning against third-party decryption tools, authorities, recovery specialists, and intermediaries, while threatening permanent data loss, fraud, identity theft, reputational damage, financial losses, regulatory consequences, and exposure of confidential information if the ransom demands are not followed.
Screenshot: The appearance of Fiasco’s ransom note (CONTACT US.txt) (Source: Surface Web)
Following are the TTPs based on the MITRE Attack Framework.
| Tactic | Technique ID | Technique Name |
| Tactic | Technique ID | Technique Name |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1129 | Shared Modules |
| Execution | T1569.002 | System Services: Service Execution |
| Execution | T1574 | Hijack Execution Flow |
| Persistence | T1542.003 | Pre-OS Boot: Bootkit |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1055 | Process Injection |
| Privilege Escalation | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1548 | Abuse Elevation Control Mechanism |
| Credential Access | T1003 | OS Credential Dumping |
| Credential Access | T1552.001 | Unsecured Credentials: Credentials In Files |
| Discovery | T1007 | System Service Discovery |
| Discovery | T1012 | Query Registry |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1135 | Network Share Discovery |
| Discovery | T1497 | Virtualization/Sandbox Evasion |
| Discovery | T1518.001 | Software Discovery: Security Software Discovery |
| Collection | T1005 | Data from Local System |
| Collection | T1074 | Data Staged |
| Collection | T1114 | Email Collection |
| Collection | T1560 | Archive Collected Data |
| Command and Control | T1071 | Application Layer Protocol |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1573 | Encrypted Channel |
| Impact | T1485 | Data Destruction |
| Impact | T1486 | Data Encrypted for Impact |
| Impact | T1489 | Service Stop |
| Impact | T1490 | Inhibit System Recovery |
| Stealth | T1014 | Rootkit |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1036 | Masquerading |
| Stealth | T1055 | Process Injection |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1497 | Virtualization/Sandbox Evasion |
| Stealth | T1542.003 | Pre-OS Boot: Bootkit |
| Stealth | T1564.003 | Hide Artifacts: Hidden Window |
| Stealth | T1564.004 | Hide Artifacts: NTFS File Attributes |
| Stealth | T1574 | Hijack Execution Flow |
Relevancy and Insights:
ETLM Assessment:
Fiasco Ransomware is likely to evolve by improving its stealth, environment awareness, and encryption capabilities to make detection and analysis more difficult. Future variants may expand their use of Windows-native utilities, system APIs, WMI, registry modifications, and other legitimate system components to blend malicious activity with normal administrative operations. The malware may also strengthen its anti-analysis mechanisms by performing more extensive checks for virtual machines, sandboxes, debugging environments, BIOS characteristics, security software, and other indicators of automated analysis. Additional techniques for disabling recovery mechanisms, terminating security-related processes, deleting backups and shadow copies, and maintaining persistence could further increase its impact on compromised Windows systems.
Future versions may also place greater emphasis on data theft and double-extortion operations, potentially targeting a wider range of sensitive files before encryption. Attackers could automate the identification and collection of high-value information such as financial records, databases, credentials, source code, and confidential business documents, followed by threats of public disclosure to increase pressure on victims. The ransomware may further evolve through more sophisticated command-and-control mechanisms, configurable encryption routines, and improved evasion techniques. Overall, the likely evolution of Fiasco is toward a more stealthy, automated, and resilient ransomware operation that combines rapid file encryption, recovery inhibition, sensitive-data exfiltration, and extortion to maximize operational and financial impact.
Sigma rule:
title: Boot Configuration Tampering Via Bcdedit.EXE
tags:
– attack.impact
– attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
– Image|endswith: ‘\bcdedit.exe’
– OriginalFileName: ‘bcdedit.exe’
selection_set:
CommandLine|contains: ‘set’
selection_cli:
– CommandLine|contains|all:
– ‘bootstatuspolicy’
– ‘ignoreallfailures’
– CommandLine|contains|all:
– ‘recoveryenabled’
– ‘no’
condition: all of selection_*
falsepositives:
– Unlikely
level: high
(Source: Surface Web)
Indicators of Compromise
Kindly refer to the IOCs section to exercise control of your security systems
(Source: Surface Web)
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Active Malware of the Week
Type: RAT (Remote Access Trojean)
Objectives: Survillance and Data Exfiltration
Target Technology: Windows
Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the week
This week “LiquidRAT” Malware is in focus.
Overview of Operation LiquidRAT Malware
LiquidRAT is a malicious remote-access threat designed to establish and maintain unauthorized control over a compromised system. Its observed behavior indicates that the malware is intended to operate quietly in the background while providing an attacker with continued access to the affected environment. Rather than performing a single disruptive action, it combines several capabilities that allow an intrusion to remain active and potentially expand over time.
The sample demonstrates a clear interest in information available on the compromised device, including sensitive account information, browser-related data, local files, and system configuration. This activity indicates that the malware is focused on gathering information that could be useful to an attacker. From an organizational perspective, such behavior creates the possibility of unauthorized access to business information, user accounts, and other valuable resources.
LiquidRAT also incorporates mechanisms intended to maintain its presence after routine system events such as restarts or user logons. At the same time, its behavior shows an effort to reduce the likelihood of being discovered and removed. This combination of persistence and stealth increases the potential exposure period, allowing unauthorized activity to continue even when the original point of compromise is no longer obvious.
The overall assessment indicates that LiquidRAT represents a significant security concern because it provides a sustained foothold from which an attacker can monitor the affected system, gather information, and maintain communication with external infrastructure. Organizations should therefore treat any confirmed presence of the malware as a potential compromise rather than an isolated malware detection and conduct appropriate investigation, containment, and remediation activities.
Attack Method
Upon execution on a Windows system, LiquidRAT establishes an initial execution state by creating mutex objects that help prevent multiple copies of the malware from running simultaneously. The use of unique mutex names, including OneSettingQueryMutex+compat+encapsulation and WillyRat_Client_SingleInstance_Mutex, indicates that the sample performs an instance check before continuing its activity. It also performs limited host-level checks to understand the environment in which it is running. The malware further employs memory-based execution techniques that reduce the amount of directly observable code on disk and complicate conventional static examination. Activity consistent with code injection allows portions of its functionality to operate within legitimate processes, making process-level identification more challenging.
The malware establishes persistence through multiple Windows autostart locations. It modifies the user’s Run registry configuration so that the malicious component can be launched when the affected user signs in. It also places a component in the user’s Startup directory, providing a second mechanism for automatic execution during logon. This redundancy increases the likelihood that the malware will remain operational if one persistence location is removed. In parallel, LiquidRAT incorporates techniques intended to conceal its activity, remove selected traces from the system, and obtain elevated privileges. These behaviors collectively make remediation more difficult and can reduce the amount of evidence available for subsequent investigation.
A significant part of the malware’s operation is dedicated to collecting information from the compromised host. It accesses Windows credential-related data and attempts to obtain cached authentication material without requiring direct user interaction. The malware also targets browser data stores, including locations containing saved credentials and session-related information such as cookies. In addition, it searches and reads files stored locally on the system, potentially exposing documents, configuration information, and other sensitive content. Before or alongside collection, the malware performs host and process discovery and examines aspects of the system and its security environment, allowing it to understand the available resources and identify information of potential value.
The collected information is prepared for communication with external infrastructure controlled by the operator. Analysis identified communication with multiple external endpoints, including services such as api.ipify.org, demonstrating that the malware maintains network connectivity as part of its operational workflow. This communication channel provides the implant with a means to exchange information with its remote infrastructure and potentially support additional activity after the initial compromise. The combination of single-instance control, memory-based execution, persistent autostart mechanisms, privilege-related activity, host discovery, credential and browser-data collection, local file access, and external communication demonstrates a multi-stage attack method designed to maintain access while extracting valuable information from the compromised Windows environment.
Following are the TTPs based on the MITRE Attack Framework for Enterprise
| Execution | T1129 | Shared Modules |
| Persistence | T1112 | Modify Registry |
| T1546.001 | Event Triggered Execution: Change Default File Association | |
| Privilege Escalation | T1055 | Process Injection |
| T1548 | Abuse Elevation Control Mechanism | |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| T1027.009 | Obfuscated Files or Information: Embedded Payloads | |
| T1036 | Masquerading | |
| T1070.004 | Indicator Removal: File Deletion | |
| T1564.003 | Hide Artifacts: Hidden Window | |
| Credential Access | T1539 | Steal Web Session Cookie |
| Discovery | T1033 | System Owner/User Discovery |
| T1082 | System Information Discovery | |
| T1083 | File and Directory Discovery | |
| T1614 | System Location Discovery | |
| Collection | T1185 | Browser Session Hijacking |
| Command and Control | T1071 | Application Layer Protocol |
| T1105 | Ingress Tool Transfer | |
| T1573 | Encrypted Channel |
INSIGHTS
ETLM ASSESSMENT
From an ETLM perspective, LiquidRAT-like threats are likely to contribute to a future where malware-driven compromises become increasingly intertwined with normal business activity rather than appearing as isolated security incidents. Organizations may face greater operational and financial consequences as compromised identities are used across legitimate services, making the boundary between genuine employee activity and attacker activity harder to distinguish. For employees, this could translate into greater disruption to routine work, increased scrutiny of account activity, and a higher likelihood that a single compromised identity triggers consequences beyond the original device. As criminal ecosystems become more organized, the value of access may increasingly extend beyond immediate data theft, with compromised accounts potentially becoming steppingstones for fraud, impersonation, and broader business disruption. The resulting incidents are therefore likely to demand faster organizational decision-making and stronger coordination between security, IT, and business teams, particularly as the distinction between a malware infection and a wider identity-related compromise becomes less clear.
IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.
(Source: Surface Web)
YARA Rule
rule LiquidRAT_Malware
{
meta:
description = “Detection rule for the analyzed malware sample”
author = “CYFIRMA”
date = “9-01-2026”
strings:
$hash = “38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057”
$s1 = “C:\\Windows\\System32\\fodhelper.exe”
$s2 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding”
$s3 = “C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\” /svc”
$s4 = “C:\\Windows\\System32\\svchost.exe -k NetworkService -p”
$s5 = “C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup”
$s6 = “C:\\Windows\\system32\\sppsvc.exe”
$s7 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc”
$s8 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost”
$s9 = “C:\\Windows\\system32\\lsass.exe”
$s10 = “C:\\Windows\\system32\\svchost.exe -k LocalService -s W32Time”
$s11 = “C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p”
$s12 = “C:\\Users\\user\\AppData\\Roaming\\WindowsRuntime\\winrt.exe\” –u USERNAME_PLACEHOLDER –n \”NOTE_PLACEHOLDER”
$s13 = “C:\\Users\\user\\AppData\\Roaming\\WindowsRuntime\\winrt.exe –u USERNAME_PLACEHOLDER –n \”NOTE_PLACEHOLDER”
$s14 = “VaultSvc”
$s15 = “clipsvc”
$s16 = “PcaSvc”
$s17 = “BITS”
$s18 = “WSearch”
$s19 = “dnsCache”
$s20 = “executable.exe”
$s21 = “C:\\Users\\<USER>\\Desktop\\executable.exe”
$s22 = “winrt.exe”
$s23 = “%APPDATA%\\windowsruntime\\winrt.exe”
$s24 = “stealer.exe”
$s25 = “%TEMP%\\windowsruntime\\stealer.exe”
$s26 = “trtlvpe.exe”
$s27 = “C:\\gqqwhk\\trtlvpe.exe”
$s28 = “file.exe”
$s29 = “C:\\Users\\user\\Desktop\\file.exe”
$s30 = “http://c.pki.goog/r/gsr1.crl”
$s31 = “c.pki.goog/r/gsr1.crl”
$s32 = “http://c.pki.goog/r/gsr1.crl0”
$s33 = “c.pki.goog/r/gsr1.crl0”
$s34 = “http://c.pki.goog/r/r4.crl”
$s35 = “c.pki.goog/r/r4.crl”
$s36 = “http://c.pki.goog/r/r4.crl0”
$s37 = “c.pki.goog/r/r4.crl0”
$s38 = “http://c.pki.goog/we1/JWW3Gj56Zd4.crl”
$s39 = “c.pki.goog/we1/JWW3Gj56Zd4.crl”
$s40 = “LiquidRAT”
condition:
$hash or
3 of ($s*)
}
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Key Intelligence Signals:
Tortoiseshell: Recent Infrastructure Expansion and Evolution of Operational Capabilities
About the Threat Actor
UNC1549, an Iranian threat actor linked to Tortoiseshell and potentially to the IRGC, has been active since at least June 2022 and has targeted entities globally, with a primary focus on organizations across the Middle East. Threat actor is suspected of leveraging spear-phishing and credential harvesting for initial access, followed by the deployment of custom malware, including the MINIBIKE and MINIBUS backdoors. The threat actor has also employed evasion techniques and the LIGHTRAIL tunneler during its operations. While UNC1549 maintains a strong regional focus on Middle Eastern targets, its observed activities indicate a potential expansion toward entities across other regions globally.
TTPs based on MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Initial Access | T1566.002 | Phishing: Spearphishing Link |
| Initial Access | T1189 | Drive-by Compromise |
| Execution | T1574.001 | Hijack Execution Flow: DLL |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Persistence | T1542.003 | Pre-OS Boot: Bootkit |
| Stealth | T1574.001 | Hijack Execution Flow: DLL |
| Stealth | T1542.003 | Pre-OS Boot: Bootkit |
| Stealth | T1497 | Virtualization/Sandbox Evasion |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1218.011 | System Binary Proxy Execution: Rundll32 |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1497 | Virtualization/Sandbox Evasion |
| Discovery | T1518.001 | Software Discovery: Security Software Discovery |
| Discovery | T1082 | System Information Discovery |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1572 | Protocol Tunneling |
| Command and Control | T1573 | Encrypted Channel |
| Command and Control | T1105 | Ingress Tool Transfer |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
Latest Developments Observed
The threat actor Tortoiseshell is assessed to be expanding its operational infrastructure and geographic targeting across the Middle East and Europe, with newly identified infrastructure containing subdomains resembling country names, including the UAE, Saudi Arabia, UK, Belgium, Canada, Australia, and Japan. The investigation also uncovered previously unreported malware, including an SSH-based tunneling utility and a TWOSTROKE backdoor capable of executing shell or file commands, uploading and exfiltrating files, downloading files, and conducting reconnaissance. The findings indicate continued development of Tortoiseshell’s operational capabilities and ongoing use of infrastructure and tooling to maintain access to targeted environments.
ETLM Insights
Tortoiseshell (UNC1549) is demonstrating increasing operational maturity through the expansion of infrastructure and continued use of custom tooling to support access to targeted environments. The discovery of infrastructure across the Middle East and Europe indicates that the actor may be broadening its operational reach beyond its historically observed regional focus.
The threat actor’s recent activity highlights:
Infrastructure diversification through geographically distributed servers and country-themed subdomains, potentially supporting operations against a wider range of regional targets.
Network-level access capabilities through reverse SSH tunneling, enabling traffic from attacker-controlled infrastructure to reach compromised internal networks.
Expanded post-compromise functionality through the TWOSTROKE-like backdoor, supporting command execution, file transfer, reconnaissance, and in-memory DLL execution.
C2 resilience through multiple hardcoded C2 servers, allowing compromised systems to communicate with alternative infrastructure if a primary server becomes unavailable.
Looking ahead, the threat actor is likely to further diversify its infrastructure and refine its remote-access capabilities to support persistent operations across strategically relevant targets. The continued use of tunneling utilities and capable backdoors suggests that maintaining reliable access and extending control within compromised environments will remain important elements of the actor’s operations.
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules
rule Threat_Indicators_Secur32_Domains_CVEs
{
meta:
description = “Detects known domains, CVE references, and secur32.dll indicator”
author = “CYFIRMA”
date = “2026-08-31”
strings:
$domain1 = “ramiltons-finance.azurewebsites.net” ascii wide nocase
$domain2 = “ramiltonsfinance.azurewebsites.net” ascii wide nocase
$domain3 = “ramiltonsfinance.com” ascii wide nocase
$domain4 = “premier-healthadvisory.azurewebsites.net” ascii wide nocase
$cve1 = “CVE-2023-2033” ascii wide nocase
$cve2 = “CVE-2023-2136” ascii wide nocase
$cve3 = “CVE-2023-41991” ascii wide nocase
$cve4 = “CVE-2023-41992” ascii wide nocase
$cve5 = “CVE-2023-41993” ascii wide nocase
$dll = “secur32.dll” ascii wide nocase
condition:
1 of ($domain*) or
1 of ($cve*) or
$dll
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
China-Linked Hackers Targeting NASA, DOJ, Fed and US Senate
US authorities have disrupted online infrastructure used by a Chinese state-sponsored hacking group targeting key American agencies and critical infrastructure. According to the Department of Justice, the FBI and partner agencies disabled two platforms – QScan and QTRouter – operated by QTFY, a contractor linked to Nanjing Xinjiuwei Network Technology. The group, which offers cyber operations to China’s Ministry of State Security and People’s Liberation Army, used the platforms to mask malicious traffic while targeting entities including NASA, the Department of Energy, the Federal Reserve, and the US Senate.
ETLM Assessment:
According to the statement, QScan scans and automatically infects thousands of [IoT] devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers. QTRouter then serves as an ‘obfuscation network’ – meaning it allows QTFY and other malicious cyber actors to conceal the PRC origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks. The campaign underscores what US officials describe as a sustained, strategic effort by Beijing to infiltrate key American networks and collect critical intelligence.
Iran Recruiting Thousands of Hacktivist Hackers
Ravin Academy, a US-sanctioned Iranian cybersecurity training firm, has announced its largest recruitment drive to date, offering up to 1,200 free scholarships despite federal efforts to shut it down. According to public reporting, the yearlong program recruits Iranians aged 17 to 30, drawing on unauthorized materials from major US tech firms and offering pathways to fulfill military service or work for Iran’s Ministry of Intelligence. While there is no direct evidence linking the academy to recent breaches – such as July cyberattacks on US water systems linked to Iranian-affiliated groups – analysts warn the expanding academy serves as a key feeder for Iran’s strategic cyberwarfare operations. The firm also maintains ties to Positive Technologies, a US-sanctioned Russian cybersecurity company linked to Russian intelligence.
ETLM Assessment:
Stripped of cash by US sanctions and facing targeted strikes on its state-run cyber command, Iran has adapted its defense doctrine to a distributed mosaic approach, relying on private academies and outsourced hacktivists to maintain its offensive posture on a budget.
This decentralized pipeline offers Tehran a low-cost, resilient engine to scale up proxy hacktivism and persistent nuisance attacks while navigating severe domestic financial constraints.
Krybit Ransomware Impacts a Manufacturing Company from Thailand
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Thailand was compromised by Krybit Ransomware. The compromised company is a Thai manufacturer and distributor of metal sheet products established in 2002 as a joint venture, providing high-quality metal roofing, siding, flooring, and ceiling solutions for factories, warehouses, and homes across Thailand. Products are crafted from premium materials like Zincalume and Colorbond from NS BlueScope Steel, ensuring durability, style, and cost-effectiveness. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
The following screenshot was observed published on the dark web:
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
The Gentlemen Ransomware Impacts a Manufacturing Company from Japan
Summary: CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a Japanese manufacturing company based in Numazu, Shizuoka, established in 1971. They specialize in powder handling technology, providing comprehensive solutions for the storage, feeding, weighing, and transportation of bulk powders. The company designs and manufactures custom industrial equipment and container systems for various industries dealing with fine particulate materials. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in Spring Cloud Gateway
Relevancy & Insights:
The vulnerability exists due to improper access control in JsonToGrpcGatewayFilterFactory when processing proto descriptor resource locations.
Impact :
A remote privileged user can specify an arbitrary Spring Resource location to access native files and perform server-side request forgery.
Affected Products:
https[:]//spring[.]io/security/cve-2026-47879
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED PRODUCTS OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment:
The vulnerability in Spring Cloud Gateway presents a significant security risk to organizations using the affected versions, particularly because successful exploitation can allow unauthorized access to native files and enable server-side request forgery. The JsonToGrpcGatewayFilterFactory, when processing proto descriptor resource locations, allows a remote privileged user to specify an arbitrary Spring Resource location. Successful exploitation could allow threat actors to access sensitive files from the underlying system, interact with unintended internal or external resources, disclose sensitive information, and potentially compromise the security of systems accessible from the affected Gateway instance. As exploitation requires privileged access, organizations should prioritize protecting administrative and configuration interfaces and limiting access to trusted users and networks. Organizations using affected versions of Spring Cloud Gateway should upgrade to the latest available security update and ensure that resource locations used for proto descriptors are restricted to trusted and permitted resource prefixes. In addition, organizations should monitor Gateway activity for anomalous resource requests, attempts to access native files, and suspicious server-side requests to unexpected destinations. Prompt remediation and continuous monitoring are recommended to reduce the risk of sensitive information disclosure and server-side request forgery resulting from exploitation of this vulnerability.
Settra Ransomware Attacked and Published the Data of a Real Estate Company from Japan
Summary:
Recently, we observed that Settra Ransomware attacked and published the data of a Real Estate company from Japan on its dark web website. The compromised organisation is a Japanese real estate management group operating through several legal entities, including a real estate agency, a property management subsidiary, a holding division, and an investment arm. The group manages residential properties across Tokyo and Kanagawa through a network of offices, providing lease and property management services to both individual and corporate clients. The ransomware attack reportedly involved the exposure of approximately 437 GB of data, including internal corporate documents, a full VPN network diagram with public IP addresses, employee login credentials, 449 lease transaction files, background-check records, 363 active insurance policies, customer-portal credentials, banking IP-VPN configuration containing a pre-shared key, and an insurance payment database containing 833 transactions with recipient banking details. The exposed archive also reportedly includes investment-related documents concerning participation as a shareholder in a blockchain company, along with lease agreements, insurance-related records, financial documents, invoices, and other sensitive business information.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Settra represents an emerging, financially motivated ransomware and data-extortion threat that relies on data theft and public exposure to increase pressure on victims. The group maintains a leak site and has demonstrated an opportunistic targeting strategy across multiple industries and countries. Although Settra has been associated with ransomware-style encryption and double-extortion activity, its technical attribution and operational structure remain under assessment due to its recent emergence in 2026. Organizations should therefore prioritize strong identity and access controls, protection of VPN and privileged credentials, continuous network monitoring, endpoint detection, data-loss prevention, and resilient offline backups to detect and mitigate potential Settra-related intrusions.
Thailand-Based Healthcare Technology Database Advertised on a Leak Site
Summary: The CYFIRMA research team identified a post observed on a dark web leak platform that claims the exposure of approximately 24 GB of database data belonging to a Thailand-based healthcare technology organization. The organization develops technology solutions for hospitals and healthcare providers, with services reportedly including custom software and hardware, Electronic Health Record (EHR) systems, telemedicine platforms, healthcare consulting, and research and development (R&D). The post identifies the database as a leaked dataset and lists a dump date of 29 August 2026.
Organization Profile
According to the information displayed in the post, the affected organization operates in the healthcare technology sector and provides technology-driven solutions intended to support hospitals and healthcare organizations.
Its reported areas of operation include:
Leaked Data
The post claims that approximately 24 GB of database information has been leaked. However, the provided image cuts off immediately after the statement “In this leak, the database contains:” and does not display the specific categories of records contained in the database.
Therefore, the following cannot be reliably confirmed from the supplied evidence:
The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.
Source: Underground Forums
A major Vietnamese food and consumer-goods group Database Advertised on a Leak Site
Summary: The CYFIRMA research team identified a post on a dark web forum claiming that approximately 3.5 TB of corporate data belonging to a Vietnam-based organization has been compromised and is being offered through an exclusive bidding process. The advertised dataset reportedly consists of fully structured files, unredacted corporate documents, and raw database dumps. The post claims access to multiple repositories across the organization’s corporate network, including communication archives, SharePoint databases, central file-server repositories, and human-resources-related information.
Allegedly Exposed Data
According to the post, the compromised data reportedly includes:
Executive Communication Hub
SharePoint Production & Legal Databases
Central File Server Repositories & Databases
Human Resources Profiles & Asset Transfer Vault
Data Characteristics
The advertisement describes the dataset as containing:
The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure
Recommendations: Enhance the cybersecurity posture by
The CYFIRMA research team identified a post observed on a dark web forum claiming that a Qatar-based organization has been breached. The post includes a sample of allegedly compromised database records and identifies an associated IP address. The displayed sample contains database fields related to user accounts, including identifiers, names, email addresses, partner information, roles, account status, and creation and update timestamps.
Allegedly Exposed Data
The sample displayed in the post contains database fields including:
The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.
Source: Underground forums
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
Geography-Wise Graph
Industry-Wise Graph
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, technology, please access DeCYFIR.
