CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Introduction:
CYFIRMA Research and Advisory Team has found UMBRA Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
UMBRA Ransomware
UMBRA is a file-encrypting ransomware that targets data stored on an infected Windows system. During execution, it encrypts accessible files and appends the .umbra extension to their existing filenames, resulting in filenames such as 1.jpg.umbra and 2.png.umbra. It also creates a victim-specific ransom note named README_[victim_ID].txt and modifies the desktop wallpaper with a custom image, providing visible indicators of compromise. The malware follows a double-extortion model: in addition to encrypting local data, the operators claim to exfiltrate sensitive information and threaten to disclose it if the ransom demand is not fulfilled.
Screenshot: File encrypted by ransomware (Source: Surface Web)
The ransom note informs the victim that their files have been encrypted and states that stolen data may be publicly released if communication with the operators is not established. Each infected system is assigned a unique hexadecimal decryption ID, which the victim is instructed to provide through an anonymous communication portal. The note also contains operational warnings intended to prevent interference with the encrypted data, specifically advising against deleting or modifying encrypted files and against attempting recovery with external decryption utilities, claiming such actions could result in permanent data corruption or loss. Overall, the note functions as both a notification of encryption and a mechanism for directing victims toward attacker-controlled communication while reinforcing the extortion threat.
Screenshot: The appearance of UMBRA’s ransom note (README_[victim_ID].txt) (Source: Surface Web)
Screenshot: The appearance of UMBRA’s ransomware Wallpaper (Source: Surface Web)
The following are the TTPs based on the MITRE ATT&CK Framework
| Tactic | Technique ID | Technique Name |
| Execution | T1053 | Scheduled Task/Job |
| Execution | T1059 | Command and Scripting Interpreter |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Privilege Escalation | T1053 | Scheduled Task/Job |
| Privilege Escalation | T1055 | Process Injection |
| Privilege Escalation | T1548 | Abuse Elevation Control Mechanism |
| Credential Access | T1003 | OS Credential Dumping |
| Credential Access | T1552.001 | Unsecured Credentials: Credentials In Files |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1614.001 | System Location Discovery: System Language Discovery |
| Collection | T1005 | Data from Local System |
| Collection | T1114 | Email Collection |
| Command and Control | T1071 | Application Layer Protocol |
| Impact | T1485 | Data Destruction |
| Impact | T1486 | Data Encrypted for Impact |
| Impact | T1490 | Inhibit System Recovery |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1036 | Masquerading |
| Stealth | T1055 | Process Injection |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1574 | Hijack Execution Flow |
Relevancy and Insights:
ETLM Assessment:
UMBRA could evolve beyond its current file-encryption capability by adopting more sophisticated intrusion and evasion mechanisms. Future variants may focus on compromising systems before encryption, obtaining higher privileges, disabling or bypassing security controls, and targeting network-connected resources rather than limiting activity to individual endpoints. The malware could also become more selective about which files and systems it affects, allowing attackers to maximize operational disruption while reducing the chance of early detection. This direction is consistent with the broader ransomware landscape, where attackers increasingly combine credential abuse, lateral movement, data theft, and rapid exploitation into a single intrusion chain.
The extortion component of UMBRA is also likely to become more significant. Future versions could place greater emphasis on stealing sensitive information before encryption, allowing attackers to maintain leverage even when victims can recover their files from backups. The current double-extortion model could therefore develop into multi-stage extortion involving threats to disclose stolen information or cause additional operational disruption. Ransomware operations are already showing movement toward data-exfiltration-only attacks because stolen information can remain valuable even when encryption is successfully defeated. Consequently, a future UMBRA variant may rely less on the .umbra encryption impact itself and more on persistent access, data theft, and pressure against the victim to increase the likelihood of payment.
Sigma rules:
title: Boot Configuration Tampering Via Bcdedit.EXE tags:
– attack.impact
– attack.t1490 logsource:
category: process_creation product: windows
detection: selection_img:
– Image|endswith: ‘\bcdedit.exe’
– OriginalFileName: ‘bcdedit.exe’ selection_set:
CommandLine|contains: ‘set’ selection_cli:
– CommandLine|contains|all:
– ‘bootstatuspolicy’
– ‘ignoreallfailures’
– CommandLine|contains|all:
– ‘recoveryenabled’
– ‘no’
condition: all of selection_* falsepositives:
– Unlikely level: high
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Type: Infostealer | Objectives: Credential Theft and Data Exfiltration | Target Technology: Windows | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week
This week, NyxStealer Malware is in focus.
Overview of Operation NyxStealer Malware
The analyzed sample, identified as NyxStealer, is a malicious program designed to operate quietly on compromised systems while maintaining access over time. Its behavior shows clear intent to interact with the affected machine, monitor information of interest, and establish a continued presence rather than performing a single, isolated malicious action.
The malware shows particular interest in information that may be present during normal user activity, including clipboard content, local files, and system settings. This creates a potential risk for sensitive business information, credentials, account details, and other data that may temporarily reside on an employee’s workstation.
The sample also demonstrates mechanisms intended to survive system restarts and user logons. This means that simply restarting an affected machine may not remove the threat, allowing the malware to continue operating without requiring additional action from the user. Its efforts to remain less visible further increase the difficulty of identifying and removing the compromise.
Overall, the presence of NyxStealer should be treated as a serious security incident rather than an isolated malware detection. Its ability to maintain access, observe user activity, interact with locally stored information, and communicate with external infrastructure indicates that the affected system may have been deliberately targeted for information collection and continued access.
Attack Method
Upon execution on a Windows system, the malware begins by establishing controls over its own execution and profiling the host environment. It creates mutex objects, including OneSettingQueryMutex+compat+encapsulation and AmiProviderMutex_InventoryApplicationFile, to prevent multiple instances of the payload from operating simultaneously. It then performs host reconnaissance using native system utilities such as tasklist, allowing it to identify running processes and gather information about the system, user environment, network configuration, installed software, and available security controls. The malware can use these environmental indicators to determine whether the host is suitable for continued execution and may terminate or modify its behavior when conditions appear suspicious.
The sample subsequently employs memory-oriented execution and process manipulation to make its activity more difficult to inspect. Its use of reflective, memory-based techniques reduces reliance on conventional on-disk execution and can complicate static analysis because important payload components may only become available during runtime. The malware also demonstrates behavior consistent with code injection, enabling its malicious code to operate within the context of a legitimate process. By abusing trusted process execution, it can attempt to blend with normal system activity and reduce the effectiveness of application-control mechanisms that rely primarily on identifying suspicious executable files.
For persistence, the malware places components within the user’s Windows Startup directory, causing the malicious code to be launched automatically when the affected user signs in. This provides a straightforward mechanism for maintaining execution across system restarts without requiring the victim to manually launch the malware again. In parallel, the sample uses techniques intended to evade visibility and attempts to bypass User Account Control (UAC), potentially allowing it to obtain higher privileges while reducing the likelihood of generating obvious user-facing warnings. The combination of automatic startup, privilege elevation, and concealed execution gives the malware a stronger foothold on the compromised workstation.
Data collection represents a major component of the malware’s operation. The sample systematically accesses local files and documents that may contain valuable information while also monitoring clipboard activity, potentially capturing passwords, cryptocurrency wallet addresses, copied credentials, confidential text, and other transient data. Before transferring information externally, it performs additional reconnaissance of processes, system conditions, and security-related components to understand the compromised environment. The collected information can then be communicated to attacker-controlled infrastructure through multiple external endpoints, including legitimate internet-facing services such as api.ipify.org. This combination of host discovery, persistence, privilege escalation, stealth, information collection, and external communication demonstrates a multi-stage attack method designed to maintain access while extracting valuable information from the compromised system.
The following are the TTPs based on the MITRE ATT&CK Framework for Enterprise
| Tactic | Technique | Technique Name |
| Execution | T1059 | Command and Scripting Interpreter |
| T1129 | Shared Modules | |
| T1574 | Hijack Execution Flow | |
| Persistence | T1112 | Modify Registry |
| T1547.009 | Boot or Logon Autostart Execution: Shortcut Modification | |
| Privilege Escalation | T1055 | Process Injection |
| T1134 | Access Token Manipulation | |
| T1548 | Abuse Elevation Control Mechanism | |
| Stealth | T1027 | Obfuscated Files or Information |
| T1036 | Masquerading | |
| T1202 | Indirect Command Execution | |
| T1497.001 | Virtualization/Sandbox Evasion: System Checks | |
| T1564.003 | Hide Artifacts: Hidden Window | |
| Defense Impairment | T1222 | File and Directory Permissions Modification |
| T1010 | Application Window Discovery | |
| T1012 | Query Registry | |
| T1033 | System Owner/User Discovery | |
| Discovery | T1057 | Process Discovery |
| T1082 | System Information Discovery | |
| T1083 | File and Directory Discovery | |
| Collection | T1115 | Clipboard Data |
| Command and control | T1071 | Application Layer Protocol |
INSIGHTS
ETLM ASSESSMENT
For the ETLM perspective, the future impact of threats such as NyxStealer is likely to extend beyond individual endpoints, as stolen information increasingly becomes a catalyst for wider business disruption. Organizations may face greater exposure to fraudulent transactions, unauthorized use of employee accounts, privacy incidents, and loss of customer trust when compromised information is reused elsewhere. Employees are also likely to experience more targeted and convincing follow-on attacks, where information gathered from one compromise is used to make subsequent deception appear legitimate. As a result, a single infected device could increasingly become the starting point for broader organizational consequences, making information-stealing malware a growing business risk rather than simply an endpoint security issue.
IOCs:
Kindly refer to the IOCs below to exercise controls on your security systems.
(Source: Open Surface)
YARA Rules
rule NyxStealer_Malware
{
meta:
description = “Detection rule for the analyzed malware sample” author = ” CYFIRMA Research”
strings:
$hash = “84114420fc4a73b25f6d70d44893bf7a5d5ac7d7418dcca1e5574681cee85c36”
$s1 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”tasklist /fo csv 2>nul”
$s2 = “tasklist /FI \”USERNAME eq <USER>\” /FI \”IMAGENAME eq SyncClient.exe\” /FO csv”
$s3 = “C:\\Windows\\system32\\find.exe\” \”SyncClient.exe”
$s4 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding”
$s5 = “C:\\Users\\<USER>\\AppData\\Local\\Programs\\chiloutvrmod\\SyncClient.exe ”
$s6 = “C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Appinfo”
$s7 = “C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted –
p”
$s8 = “consent.exe 1552 516 000001F3E143A600”
$s9 = “wscsvc”
$s10 = “PcaSvc”
$s11 = “WSearch”
$s12 = “SyncClient.exe”
$s13 = “program.exe”
$s14 = “C:\\Users\\<USER>\\Desktop\\program.exe”
$s15 = “FO csv”
$s16 = “syncclient.exe”
$s17 = “%LOCALAPPDATA%\\programs\\chiloutvrmod\\syncclient.exe”
$s18 = “tlovhurr.exe”
$s19 = “C:\\tflq\\tlovhurr.exe”
$s20 = “C:\\Users\\user\\Desktop\\program.exe”
$s21 = “3472 – taskhost.exe SYSTEM”
$s22 = “3576 – taskhost.exe $(Arg0)”
$s23 = “OneSettingQueryMutex+compat+encapsulation”
$s24 = “AmiProviderMutex_InventoryApplicationFile”
$s25 = “chiloutvrmodProcessSingletonStartup”
$s26 = “7cde390c-5ca8-54f7-812f-4146f75ded62”
$s27 = “SyncRootManager”
$s28 = “\\REGISTRY\\A\\{8e9d7769-f601-4364-39fd-
e5b0e969c619}\\Root\\InventoryApplicationFile\\WritePermissionsCheck”
$s29 = “\\REGISTRY\\A\\{8e9d7769-f601-4364-39fd-
e5b0e969c619}\\Root\\InventoryApplicationFile\\syncclient.exe|e5d6d61295a855 0f\\ProgramId”
$s30 = “\\REGISTRY\\A\\{8e9d7769-f601-4364-39fd-
e5b0e969c619}\\Root\\InventoryApplicationFile\\syncclient.exe|e5d6d61295a855 0f\\FileId”
$s31 = “NyxStealer”
condition:
$hash or 2 of ($s*)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Key Intelligence Signals:
Lazarus Group: Campaign Activity, Targeting and Infrastructure Evolution
About the Threat Actor
Lazarus Group is a highly sophisticated North Korea-linked threat actor that has been active since at least 2009 and is widely assessed to operate in support of the DPRK’s strategic and intelligence objectives. Also tracked by the U.S. government as Hidden Cobra, the group is associated with Lab 110, an entity linked to North Korean military intelligence. Lazarus Group possesses advanced malware development capabilities, allowing it to rapidly evolve its toolsets, adapt existing exploits, and develop new offensive capabilities designed to evade detection.
The group has conducted a broad range of cyber espionage, disruptive, and financially motivated operations, with recent campaigns increasingly targeting cryptocurrency organizations to generate revenue and support state objectives. Historically, the threat actor has been linked to high-profile operations including the Sony Pictures attack, Bangladesh Bank SWIFT heist, WannaCry ransomware, Operation Troy, DarkSeoul, and several long-running espionage campaigns. The group is believed to comprise multiple operational subgroups, including Andariel, which primarily targets South Korean interests, and Bluenoroff, which specializes in financially motivated operations and global espionage. Additionally, UNC1069 has been assessed to share infrastructure overlaps with Bluenoroff, indicating potential operational coordination within the broader Lazarus ecosystem.
Details on Exploited Vulnerabilities
TTPs based on MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1591 | Gather Victim Org Information |
| Reconnaissance | T1591.004 | Gather Victim Org Information: Identify Roles |
| Reconnaissance | T1589.002 | Gather Victim Identity Information: Email Addresses |
| Reconnaissance | T1593.001 | Search Open Websites/Domains: Social Media |
| ResourceDevelopment | T1587.001 | Develop Capabilities: Malware |
| ResourceDevelopment | T1587.002 | Develop Capabilities: Code Signing Certificates |
| ResourceDevelopment | T1583.001 | Acquire Infrastructure: Domains |
| ResourceDevelopment | T1583.004 | Acquire Infrastructure: Server |
| ResourceDevelopment | T1583.006 | Acquire Infrastructure: Web Services |
| ResourceDevelopment | T1584.001 | Compromise Infrastructure: Domains |
| ResourceDevelopment | T1584.004 | Compromise Infrastructure: Server |
| ResourceDevelopment | T1585.001 | Establish Accounts: Social Media Accounts |
| ResourceDevelopment | T1585.002 | Establish Accounts: Email Accounts |
| ResourceDevelopment | T1588.002 | Obtain Capabilities: Tool |
| ResourceDevelopment | T1588.003 | Obtain Capabilities: Code Signing Certificates |
| ResourceDevelopment | T1588.004 | Obtain Capabilities: Digital Certificates |
| Initial Access | T1189 | Drive-by Compromise |
| Initial Access | T1566.001 | Phishing: Spear phishing Attachment |
| Initial Access | T1566.002 | Phishing: Spear phishing Link |
| Initial Access | T1078 | Valid Accounts |
| Initial Access | T0865 | Spear phishing Attachment |
| Initial Access | T1566.003 | Phishing: Spear phishing via Service |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Execution | T1106 | Native API |
| Execution | T1204.001 | User Execution: Malicious Link |
| Execution | T1204.002 | User Execution: Malicious File |
| Execution | T1203 | Exploitation for Client Execution |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1059.005 | Command and Scripting Interpreter: Visual Basic |
| Execution | T1574.001 | Hijack Execution Flow: DLL |
| Execution | T1574.013 | Hijack Execution Flow: KernelCallbackTable |
| Persistence | T1505.004 | Server Software Component: IIS Components |
| Persistence | T1542.003 | Pre-OS Boot: Bootkit |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Persistence | T1078 | Valid Accounts |
| Persistence | T1098 | Account Manipulation |
| Persistence | T1547.009 | Boot or Logon Autostart Execution: Shortcut Modification |
| Privilege Escalation | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1098 | Account Manipulation |
| Privilege Escalation | T1547.009 | Boot or Logon Autostart Execution: Shortcut Modification |
| Privilege Escalation | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1055.001 | Process Injection: Dynamic-link Library Injection |
| Privilege Escalation | T1078 | Valid Accounts |
| Privilege Escalation | T1134.002 | Access Token Manipulation: Create Process with Token |
| Stealth | T1134.002 | Access Token Manipulation: Create Process with Token |
| Stealth | T1218 | System Binary Proxy Execution |
| Stealth | T1218.005 | System Binary Proxy Execution: Mshta |
| Stealth | T1218.010 | System Binary Proxy Execution: Regsvr32 |
| Stealth | T1218.011 | System Binary Proxy Execution: Rundll32 |
| Stealth | T1620 | Reflective Code Loading |
| Stealth | T1070 | Indicator Removal |
| Stealth | T1070.003 | Indicator Removal: Clear Command History |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1036.003 | Masquerading: Rename Legitimate Utilities |
| Stealth | T1036.004 | Masquerading: Masquerade Task or Service |
| Stealth | T1036.005 | Masquerading: Match Legitimate Resource Name or Location |
| Stealth | T1036.008 | Masquerading: Masquerade File Type |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1027.007 | Obfuscated Files or Information: Dynamic API Resolution |
| Stealth | T1027.009 | Obfuscated Files or Information: Embedded Payloads |
| Stealth | T1027.013 | Obfuscated Files or Information: Encrypted/Encoded File |
| Stealth | T1220 | XSL Script Processing |
| Stealth | T1497.003 | Virtualization/Sandbox Evasion: Time-Based Evasion |
| Stealth | T1622 | Debugger Evasion |
| Stealth | T1140 | Deobfuscate/Decode Files or Information |
| Stealth | T1564.001 | Hide Artifacts: Hidden Files and Directories |
| Stealth | T1684.001 | Social Engineering: Impersonation |
| Stealth | T1221 | Template Injection Authentication Process: Conditional Access Policies |
| Stealth | T1574.001 | Hijack Execution Flow: DLL |
| Stealth | T1574.013 | Hijack Execution Flow: KernelCallbackTable |
| Stealth | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Stealth | T1078 | Valid Accounts |
| DefenseImpairment | T1686.003 | Disable or Modify System Firewall: Windows Host Firewall |
| DefenseImpairment | T1685 | Disable or Modify Tools |
| Credential Access | T1056.001 | Input Capture: Keylogging |
| Credential Access | T1110.003 | Brute Force: Password Spraying |
| Credential Access | T1557.001 | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Discovery | T1497.003 | Virtualization/Sandbox Evasion: Time-Based Evasion |
| Discovery | T1087.002 | Account Discovery: Domain Account |
| Discovery | T1010 | Application Window Discovery |
| Discovery | T1046 | Network Service Discovery |
| Discovery | T1622 | Debugger Evasion |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1012 | Query Registry |
| Discovery | T1614.001 | System Location Discovery: System Language Discovery |
| Discovery | T1016 | System Network Configuration Discovery |
| Discovery | T1049 | System Network Connections Discovery |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1680 | Local Storage Discovery |
| Discovery | T1124 | System Time Discovery |
| LateralMovement | T1021.002 | Remote Services: SMB/Windows Admin Shares |
| LateralMovement | T1021.001 | Remote Services: Remote Desktop Protocol |
| LateralMovement | T1021.004 | Remote Services: SSH |
| LateralMovement | T1534 | Internal Spear phishing |
| Collection | T1056.001 | Input Capture: Keylogging |
| Collection | T1560 | Archive Collected Data |
| Collection | T1560.001 | Archive Collected Data: Archive via Utility |
| Collection | T1560.002 | Archive Collected Data: Archive via Library |
| Collection | T1560.003 | Archive Collected Data: Archive via Custom Method |
| Collection | T1557.001 | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay |
| Collection | T1005 | Data from Local System |
| Collection | T1074.001 | Data Staged: Local Data Staging |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1571 | Non-Standard Port |
| Command and Control | T1132.001 | Data Encoding: Standard Encoding |
| Command and Control | T1001.003 | Data Obfuscation: Protocol or Service Impersonation |
| Command and Control | T1573.001 | Encrypted Channel: Symmetric Cryptography |
| Command and Control | T1090.001 | Proxy: Internal Proxy |
| Command and Control | T1090.002 | Proxy: External Proxy |
| Command and Control | T1104 | Multi-Stage Channels |
| Command and Control | T1008 | Fallback Channels |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1102.002 | Web Service: Bidirectional Communication |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Exfiltration | T1567.002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
| Exfiltration | T1048.003 | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol |
| Impact | T1561.001 | Disk Wipe: Disk Content Wipe |
| Impact | T1561.002 | Disk Wipe: Disk Structure Wipe |
| Impact | T1489 | Service Stop |
| Impact | T1485 | Data Destruction |
| Impact | T1529 | System Shutdown/Reboot |
| Impact | T1491.001 | Defacement: Internal Defacement |
Latest Developments Observed
The threat actor is suspected of targeting South Korean automotive and media organizations with a previously undocumented Linux-based toolkit designed for long-term access and surveillance. The toolkit includes a custom HAProxy-based “ted” backdoor, trojanized system daemons, an SSH keylogger, and CurlRAT, enabling credential harvesting, remote command execution, data exfiltration, traffic interception, and selective malicious script injection. The activity has been assessed with medium confidence as linked to DPRK-aligned APT activity, with APT37 infrastructure associations identified in the observed C2 infrastructure.
ETLM Insights
Lazarus Group continues to demonstrate a highly adaptive and multi-dimensional operational model combining cyber espionage, disruptive activity, and financially motivated operations in support of broader DPRK strategic objectives. Its ability to rapidly develop malware, adapt existing exploits, and evolve offensive capabilities enables the group to maintain persistent access while adjusting its tradecraft against changing defensive environments.
The threat actor’s operations reflect:
Looking ahead, Lazarus Group is expected to further mature its malware-development and exploitation capabilities while continuing to diversify its operational objectives and targeting. The group is likely to refine its ability to rapidly adapt offensive tooling and intrusion techniques, enabling more persistent and resilient campaigns across espionage, disruptive, and financially motivated operations.
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules
rule Threat_Indicators_2026
{
meta:
description = “Detects files containing provided threat intelligence indicators” author = “CYFIRMA”
date = “2026-09-08”
reference = “Threat Intelligence IOCs”
strings:
// IP addresses
$ip1 = “209.127.228.186” ascii wide
$ip2 = “162.241.230.122” ascii wide
$ip3 = “82.118.248.205” ascii wide
$ip4 = “162.241.99.71” ascii wide
$ip5 = “24.199.118.157” ascii wide
// Domains / configuration
$domain1 = “config.data” ascii wide
$domain2 = “uxtramine.org” ascii wide
$domain3 = “enveil.online” ascii wide
$domain4 = “envell.xyz” ascii wide
// CVEs
$cve1 = “CVE-2026-54121” ascii wide
$cve2 = “CVE-2012-5687” ascii wide
$cve3 = “CVE-2013-5947” ascii wide
$cve4 = “CVE-2013-7389” ascii wide
$cve5 = “CVE-2014-1225” ascii wide
// Files / malware artifacts
$file1 = “myreader.apk” ascii wide
$file2=”remotepe_2024-05-11_710f15302859c7af1c1e25219d704841b3fdbc48f16a5a574d5ab6cf4f4842e8.bin” ascii wide
// Generic artifact indicators
$shell = “shell script” ascii wide
$winexe = “win32 exe” ascii wide
condition:
1 of ($ip*) or
1 of ($domain*) or 1 of ($cve*) or
1 of ($file*) or
$shell or
$winexe
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Russian and other state-backed hackers target EU officials via messaging apps
The European Union confirmed that state-sponsored threat actors – primarily originating from Russia, Iran, and China – are rapidly shifting their phishing vectors from traditional email to encrypted messaging applications like Signal and WhatsApp.
Throughout 2026, the European Union’s Joint Cyber Unit identified at least eight “significant” account-takeover incidents targeting high-ranking officials across member states. In Germany, attackers compromised the Bundestag President (speaker of parliament) via Signal, while Dutch authorities reported widespread campaigns targeting dignitaries, military personnel, and diplomats across both WhatsApp and Signal. The risk reached a point where the European Commission instructed a group of senior officials to abandon a high-level Signal group chat due to fear of active compromise.
ETLM Assessment:
Rather than relying on zero-day software vulnerabilities or complex malware, these groups leverage pure social engineering to exploit the implicit trust, speed, and urgency with which high-level government employees interact with instant messaging. Attackers frequently impersonate official support teams or automated chatbots, issuing fake security alerts to trick targets into revealing their account PINs, or prompt them to scan QR codes that silently link an attacker’s secondary device to the victim’s account. Moving communications to these consumer apps allows threat actors to operate entirely outside the visibility of standard enterprise security monitoring while enabling them to wipe their tracks using disappearing message features.
US Senate Considers Private Sector Contracts for Military Hacking
Under a provision in the Senate’s fiscal 2027 defense authorization bill, private contractors would be permitted to conduct offensive cyber operations with U.S. government authorization – potentially marking the first time Congress would have explicitly authorized private sector military hacking.
The proposal creates a pilot program under U.S. Cyber Command, permitting private firms to execute “access generation” operations (breaking into targeted adversary systems) under Pentagon oversight. This initiative aligns with the administration’s National Cybersecurity Strategy, which aims to leverage private sector capabilities to scale national defense against foreign cyber threats. It also builds on a White House memorandum issued earlier this summer that authorized private firms to perform broader “cyber effects operations” – including disruption and destruction – against foreign cyber-enabled transnational criminal organizations under the direction of the Justice Department and Department of Homeland Security.
ETLM Assessment:
This shift toward privatization occurs amid major structural strain and an ongoing overhaul known as “Cybercom 2.0.” U.S. Cyber Command faces severe workforce pressures, persistent talent shortages, intensifying workloads driven by multiple overseas conflicts, and rising internal concerns over operational burnout and operator mental health. Boosters view private contractors as a necessary force multiplier to address government shortfalls. Conversely, critics warn that establishing a commercial military hacking industry introduces significant risks of unintended escalation, foreign retaliation, and insufficient oversight. If enacted in the final National Defense Authorization Act (NDAA), the pilot program would launch by March 1, 2027.
RansomHouse Ransomware Impacts a Retail and E-commerce Company from Japan
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by RansomHouse ransomware. The compromised company is a Japanese retail and e-commerce company headquartered in Shinjuku, Tokyo. The company operates a diversified portfolio of entertainment, reuse, apparel, lifestyle-goods, and e-commerce businesses through several retail brands. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, RansomHouse ransomware predominantly targets large enterprises and high-value organizations through phishing and spear phishing campaigns. The group also employs third-party frameworks such as Vatet Loader, Metasploit, and Cobalt Strike to gain initial access and perform lateral movements within victim networks. RansomHouse typically skips data encryption, focusing instead on exfiltrating sensitive data to extort victims by threatening to publicly release the stolen information. This approach allows the group to maintain stealth and prolong their presence in targeted environments.
The Gentlemen Ransomware Impacts a Manufacturing Company from Malaysia
Summary: CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Malaysia was compromised by The Gentlemen Ransomware. The compromised company is a Malaysian publicly listed company primarily involved in automotive manufacturing and automotive component production. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in Elastic Agent
Relevancy & Insights:
The vulnerability exists due to incorrect permission assignment for a critical resource in resources used by the Elastic Agent service when running on Windows systems with Elastic Agent installed in unprivileged mode.
Impact:
A local user can replace binaries to execute arbitrary code with SYSTEM privileges.
Only Windows deployments using the unprivileged installation mode are affected.
Affected Products:
https[:]//discuss[.]elastic[.]co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment:
The vulnerability in Elastic Agent presents a significant security risk to organizations using affected versions on Windows systems configured with the unprivileged installation mode. The vulnerability is caused by incorrect permission assignment for critical resources used by the Elastic Agent service, potentially allowing a local low-privileged user to replace or tamper with binaries used by the service. Successful exploitation could allow threat actors to execute arbitrary code with SYSTEM privileges and potentially gain full control of the affected Windows system. Although exploitation requires existing local access and low-level privileges, the vulnerability does not require user interaction and could enable a significant escalation of privileges following initial access to an endpoint. Organizations using affected versions of Elastic Agent should prioritize upgrading to the latest available security update and identify systems where the unprivileged installation mode is in use. In addition, organizations should review access permissions associated with Elastic Agent resources and restrict local user access to critical binaries and service-related files. Security teams should also monitor affected endpoints for unauthorized modifications to Elastic Agent binaries, suspicious local processes, and unexpected SYSTEM-level process execution. Prompt remediation and continuous monitoring are recommended to reduce the risk of local privilege escalation and potential compromise of affected Windows systems.
Dire Wolf Ransomware attacked and published the data of an Industrial Machinery & Equipment company from Indonesia
Summary:
Recently, we observed that Dire Wolf Ransomware attacked and published the data of an Industrial Machinery & Equipment company from Indonesia on its dark web website. The compromised organisation is s a prominent Indonesian corporation established in 1970. Initially focused on heavy equipment solutions, the company has grown into a diversified holding group operating across multiple sectors supporting industrial development and infrastructure in Indonesia. The compromised data reportedly includes approximately 64 GB of sensitive corporate information, primarily related to financial and payment operations, including financial documents, email backups, Purchase-to-Pay (P2P) records, payment requests and approvals, purchase orders (POs), invoices, general-ledger records, bank-account information, cost-centre details, tax records, vendor and customer numbers, employee-related information, and SAP user IDs. The exposed dataset also reportedly contains master-data and financial reports, more than 27,000 detailed payment-request records containing hundreds of PO line items, and over 30,000 purchase-order documents, including trade and non-trade POs and associated document URLs. The data warehouse reportedly totals approximately 63.3 GB across more than 183,000 objects, indicating substantial exposure of financial, procurement, accounting, banking, and business-operational information.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Dire Wolf ransomware group emerged in May 2025, distinguished by its use of double-extortion tactics combining data encryption with data theft and threats of public exposure via an onion-based leak site. The group appears to operate solely for financial gains, without ideological motives. Its emergence highlights the evolving nature of ransomware threats in 2025, particularly the increased reliance on data exfiltration to amplify extortion efforts. These activities reinforce the urgent need for strong cybersecurity defenses and effective incident response strategies across all sectors.
Cryptocurrency Customer Database Advertised on a Leak Site
Summary
The CYFIRMA research team identified a post on a cybercrime forum advertising a large database allegedly associated with a cryptocurrency-related service operating in Singapore. According to the advertisement, the dataset reportedly contains more than 2.4 million recent customer/contact records. The forum post includes sample information and claims to offer the complete database for sale.
Based on the information visible in the advertisement, the allegedly exposed dataset may contain:
The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.
Source: Underground Forums
Customer, Rider and Vendor Database Advertised for Sale on a Leak Site
Summary:
The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of databases allegedly associated with a Malaysian community-focused digital platform operating in the food delivery and local commerce sector. According to the advertisement, the seller claims to possess separate datasets relating to customers, delivery riders, and vendors, along with information concerning e-wallet transactions. The post states that the data was current as of September 7, 2026, and includes sample information as proof of possession.
According to the information visible in the advertisement, the allegedly exposed datasets include:
Customer Database: Approximately 300,518 records
Delivery Rider Database: Approximately 22,508 records
Vendor Database: Approximately 28,562 records
E-Wallet Transaction Data:
The authenticity, source, completeness, and current availability of the alleged datasets remain unverified. The assessment is based solely on information displayed in the cybercrime-forum advertisement and should therefore be treated as an alleged data-leak incident pending independent verification.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure.
Recommendations: Enhance the cybersecurity posture by:
1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
2. Ensure proper database configuration to mitigate the risk of database-related attacks.
3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.
The CYFIRMA research team identified a post on a cybercrime forum in which a threat actor claims to have uploaded a large database allegedly obtained from a global communications and messaging service provider. According to the advertisement, the organization provides real-time SMS traffic, OTP delivery, and global messaging connectivity to organizations across multiple industries. The post claims that the allegedly compromised dataset is approximately 12 TB in size, with a sample of around 28,000 records reportedly made available.
According to the information displayed in the advertisement, the organization handles high-volume and time-sensitive messaging traffic, including authentication and verification messages. The screenshot also shows an example of an SMS verification message containing a verification code, indicating that the allegedly exposed information may involve messaging or OTP-related traffic.
Allegedly Exposed Information
Based on the advertisement and visible material, the compromised data may potentially include:
Potential Impact
If the alleged breach is authentic, exposure of messaging and OTP-related information could create significant risks for organizations and individuals. Threat actors could potentially exploit the information for:
Exposure of authentication-related messages is particularly concerning because OTPs and verification codes may be used as part of account-login, password-reset, transaction-confirmation, or identity-verification processes. If active or recently generated authentication information were exposed, attackers could potentially attempt to use it before expiration, depending on the affected systems and associated security controls.
The authenticity, origin, completeness, and actual accessibility of the alleged 12 TB dataset could not be independently verified from the screenshot alone. Therefore, the incident should be treated as an alleged data breach pending independent verification.
Source: Underground Forums
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.
