CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Introduction:
CYFIRMA Research and Advisory Team has found Regulus Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
Regulus Ransomware
Regulus is a ransomware threat that encrypts files and appends a variant-specific extension, such as .regulus16, to the affected filenames. It also creates an HTML ransom note after encryption. The malware follows a double-extortion model by claiming to have copied confidential data to an external server and threatening to publish or sell it if the ransom is not paid. The note warns victims against modifying encrypted files or using third-party recovery methods and states that a small number of files may be decrypted without charge as proof of the attackers’ capability.
Screenshot: File encrypted by the ransomware (Source: Surface Web)
The ransom note provides email and Tor-based communication channels for negotiating payment and obtaining a decryptor. It imposes a 72-hour contact deadline and threatens increased ransom demands afterward, while attempting to discourage victims from seeking alternative recovery services. From a technical impact perspective, the primary consequences are file unavailability through encryption and potential exposure of stolen information. Removing the ransomware can prevent further encryption but does not decrypt previously affected files; recovery therefore depends on a valid, uncompromised backup or a decryptable encryption implementation.
Screenshot: The appearance of Regulus’s ransom note (RANSOM_NOTE.html) (Source: Surface Web)
The following are the TTPs based on the MITRE ATT&CK framework
| Tactic | Technique ID | Technique Name |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1059 | Command and Scripting Interpreter |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Privilege Escalation | T1055 | Process Injection |
| Privilege Escalation | T1134 | Access Token Manipulation |
| Discovery | T1012 | Query Registry |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1135 | Network Share Discovery |
| Collection | T1074 | Data Staged |
| Collection | T1560 | Archive Collected Data |
| Command and Control | T1071 |
Application Layer Protocol |
| Impact | T1486 | Data Encrypted for Impact |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1055 | Process Injection |
| Stealth | T1134 | Access Token Manipulation |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1564.003 | Hide Artifacts: Hidden Window |
| Stealth | T1574 | Hijack Execution Flow |
Relevancy and Insights:
ETLM Assessment:
Regulus ransomware could evolve by adopting more advanced encryption, evasion, and deployment techniques to increase its effectiveness against targeted environments. Future variants may improve their ability to identify and prioritize valuable files, including documents, databases, backups, network shares, and other business-critical data, while optimizing encryption to reduce execution time and system visibility. The malware could also incorporate stronger anti-analysis capabilities, such as detecting virtualized or monitored environments, terminating security-related processes, and modifying its behavior to make forensic analysis more difficult. Changes to file-extension patterns, ransom-note generation, encryption routines, and system-level persistence or execution mechanisms could further distinguish new variants from earlier samples.
Regulus ransomware may also expand its double-extortion operations by placing greater emphasis on data theft alongside file encryption. Future campaigns could automate additional stages of an intrusion, including credential discovery, internal reconnaissance, lateral movement, data collection, and deployment across multiple systems within an affected network. Attackers could target centralized storage, backup infrastructure, and shared resources to reduce recovery options and increase operational disruption. Communication infrastructure may also be changed periodically through new email addresses, hidden services, or other channels to maintain contact with victims. Ransom demands and deadlines could become more customized according to the perceived value of the compromised environment, while threats involving publication or sale of stolen information may remain an important component of the extortion process.
Sigma rules:
title: Shadow Copies Deletion Using Operating Systems Utilities tags:
– attack.impact
– attack.stealth logsource:
category: process_creation product: windows
detection: selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’ selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’ selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’ selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’ selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’ CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Type: Info Stealer | Objectives: Credential Theft and Data Exfiltration | Target Technology: Windows | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week
This week, BTWStealer Malware is in focus.
Overview of Operation BTWStealer Malware
The analyzed sample, identified as “BTWStealer,” is a malicious program designed to compromise a system and access information that should remain protected. Its activity is inconsistent with legitimate software, as it focuses on obtaining sensitive information from the affected device while maintaining access to the compromised environment. The overall behavior indicates that the malware is intended to support unauthorized access and data collection rather than perform a legitimate user-facing function.
Once present on a system, the malware shows particular interest in information that may contain account details and other valuable data. It examines information stored locally, including data associated with web browsers and system settings. This behavior increases the potential impact of an infection, as information collected from a single device could provide an attacker with access to additional accounts, services, or organizational resources.
The malware also demonstrates efforts to remain unnoticed during its activity. It can conceal parts of its operation and remove traces that could otherwise help identify what occurred on the affected system. By combining information gathering with measures intended to maintain its presence, the threat can remain active without immediately attracting the attention of the user or security personnel.
Overall, BTWStealer represents a purposeful information-stealing threat rather than a harmless or accidental program. Its ability to collect valuable information and communicate with external infrastructure creates a pathway for continued attacker activity after the initial compromise. For organizations, infection therefore represents a broader security concern because compromised systems may become a source of sensitive information and a foothold for further unauthorized activity.
Attack Method
The execution chain begins with the malware establishing an exclusive runtime state on the infected Windows system. It creates mutex objects associated with system performance-related identifiers, using them as a mechanism to prevent multiple copies of the payload from operating simultaneously. The sample then performs host reconnaissance through native Windows commands, including process enumeration with tasklist, to identify the active user context, running applications, network configuration, and installed software. Its execution also incorporates reflective and memory-resident techniques, reducing reliance on conventional files on disk. In addition, thread and memory manipulation consistent with process injections allows malicious code to execute within a legitimate process context, potentially reducing the effectiveness of application-control mechanisms that rely on trusted process identities.
Following initial execution, the malware establishes mechanisms intended to maintain control while limiting visibility. It invokes PowerShell with parameters designed to suppress visible execution and bypass normal script restrictions, using it to obtain additional content such as SourceMap.js. Payload components are handled through memory-based execution techniques rather than being exposed through a straightforward disk-based execution chain. The sample also attempts to remove or suppress evidence of its activity, including clearing selected artifacts and event records. Together, these behaviors provide the malware with a combination of execution flexibility, defense evasion, and reduced forensic visibility.
The primary objective of the implant is information collection. It interacts with Windows credential-related storage to obtain authentication material and targets browser databases containing saved credentials and session-related information. Browser cookies are also of interest because they may contain active authentication tokens that can allow access to web services without requiring the original password. Beyond credential theft, the malware systematically examines locally stored files and configuration data, creating opportunities to collect documents and other information available to the compromised account. At the same time, it performs additional discovery of running processes, system characteristics, and security-related software, enabling the malware to identify the environment and determine what information or security controls are present.
The collected information is subsequently prepared for transfer to external infrastructure controlled or utilized by the malware operator. Analysis identified communication with numerous external endpoints, including services such as api.gofile.io, indicating that the malware can use web-accessible infrastructure as part of its data-transfer activity. The combination of credential harvesting, browser-session theft, local file collection, host discovery, and outbound communication gives the sample capabilities extending beyond simple information gathering. Its execution strategy is therefore structured around establishing a covert runtime presence, profiling the host, obtaining valuable data, and maintaining a communication path through which collected information can be moved outside the compromised environment.
The Following are the TTPs based on the MITRE ATT&CK Framework for Enterprises
| Tactic | Technique | Technique Name |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| T1106 | Native API | |
| T1129 | Shared Modules | |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| T1070 | Indicator Removal | |
| T1202 | Indirect Command Execution | |
| T1564.003 | Hide Artifacts: Hidden Window | |
| Credential Access | T1003 | OS Credential Dumping |
| T1552.001 | Unsecured Credentials: Credentials In Files | |
| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | |
| Discovery | T1016 | System Network Configuration Discovery |
| T1033 | System Owner/User Discovery | |
| T1057 | Process Discovery | |
| T1082 | System Information Discovery | |
| T1083 | File and Directory Discovery | |
| T1518.001 | Software Discovery: Security Software Discovery | |
| Collection | T1005 | Data from Local System |
| Command and control | T1071 T1573 |
Application Layer Protocol Encrypted Channel |
INSIGHTS
The behavior of BTWStealer indicates that the value of a compromised device extends beyond the information stored directly on it. Access to accounts and authentication-related information can provide opportunities to take advantage of existing digital relationships, making the compromised user identity an important asset in the overall operation. This shifts the significance of the infection from simple data theft toward the potential misuse of trusted access associated with the victim.
Another notable aspect is the apparent prioritization of information that can have value across different online services. Rather than being dependent on one victim’s data, the malware operates in a way that can expose several forms of information from the same environment. This suggests that the underlying objective is centered on obtaining useful digital assets, with the actual value determined by what can be recovered from each individual system.
The broader picture also reflects an operation built around maintaining control and extracting value quietly. The malware’s activity is structured to reduce attention while continuing its intended collection process, indicating that successful compromise depends on remaining inconspicuous rather than causing visible disruption. This makes the threat notable not because of destructive behavior, but because of the way a seemingly routine user environment can become a source of information for unauthorized activity.
ETLM ASSESSMENT
From an ETLM perspective, BTWStealer-like threats are expected to contribute to a broader shift in which compromised employee identities become increasingly valuable to cybercriminal operations. In the future, organizations may face incidents where the initial theft of an individual’s information develops into unauthorized access to business services, financial activity, or sensitive corporate resources. Employees are likely to remain an important exposure point as everyday digital interactions continue to generate valuable identity and access data. This could increase the business impact of seemingly isolated compromises, with organizations potentially facing greater financial losses, operational disruption, and reputational consequences as stolen identities are reused across multiple stages of an attack.
IOCs:
Kindly refer to the IOCs below to exercise controls on your security systems.
(Source: Open Surface)
YARA Rules
rule BTWStealer_Malware
{
meta:
description = “Detection rule for the analyzed malware sample” author = “CYFIRMA Research”
strings:
$hash1 = “b377fb7c454dea093ba4c63040f6177dd6a1ef7cf623497c043a9ce631e5d0b4”
$hash2= “70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b”
$s1 = “C:\\Windows\\system32\\cmd.exe /c \”ver”
$s2 = “powershell -window hidden -exec bypass”
$s3 = “powershell -exec bypass”
$s4 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”tasklist /FO CSV /NH”
$s5 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”taskkill /IM Exodus.exe /F”
$s6 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”taskkill /IM Telegram.exe
/F”
$s7 = “cscript //nologo //B
\”C:\\Users\\<USER>\\AppData\\Local\\Temp\\system_check_1785488770263.v bs”
$s8 = “WSearch”
$s9 = “python.exe -m pip install –no-cache-dir –no-warn-script-location –disable-pip-version-check -q pycryptodome”
$s10 = “python.exe -m pip install –no-cache-dir –no-warn-script-location –disable-pip-version-check -q pywin32”
$s11 = “python.exe -m pip install –no-cache-dir –no-warn-script-location –disable-pip-version-check -q PythonForWindows”
$s12 = “tvrth310.exe”
$s13 = “C:\\Users\\<USER>\\Desktop\\tvrth310.exe”
$s14 = “system_check_1785488770263.vbs”
$s15 = “fwdqbf.exe”
$s16 = “C:\\qwdjs\\fwdqbf.exe”
condition:
any of ($hash*) or 2 of ($s*)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Key Intelligence Signals:
APT31 (JungleBamboo): Evolving Browser Exploitation and Espionage Operations
About the Threat Actor
APT31 is a China-linked threat actor known for conducting cyber operations focused on the theft of intellectual property and sensitive information. Researchers characterize APT31 as specializing in obtaining data and projects that provide organizations with a competitive advantage within their respective industries. The group is suspected of conducting network operations at the direction of, or in support of, the Chinese Government, aligning its activities with broader strategic intelligence objectives.
Details on Exploited Vulnerabilities
| CVE ID | Affected Products |
CVSS Score |
Exploit Links |
| CVE-2024-4584 | Faraday GM8181 and GM828x | 5.3 | – |
| CVE-2025- 53770 | Microsoft SharePoint Server | 9.8 | – |
| CVE-2025- 53771 | Microsoft Office SharePoint | 6.5 | – |
| CVE-2025- 49704 | Microsoft Office SharePoint | 8.8 | – |
| CVE-2025- 49706 | Microsoft Office SharePoint | 6.5 | – |
TTPs based on the MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1598 | Phishing for Information |
| Reconnaissance | T1598.003 | Phishing for Information: Spear phishing Link |
| ResourceDevelopment | T1583.001 | Acquire Infrastructure: Domains |
| ResourceDevelopment | T1584.008 | Compromise Infrastructure: Network Devices |
| ResourceDevelopment | T1583.006 | Acquire Infrastructure: Web Services |
| Initial Access | T1566.002 | Phishing: Spear phishing Link |
| Execution | T1204.001 | User Execution: Malicious Link |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Execution | T1059.006 | Command and Scripting Interpreter: Python |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1068 | Exploitation for Privilege Escalation |
| Stealth | T1218.007 | System Binary Proxy Execution: Msiexec |
| Stealth | T1036.004 | Masquerading: Masquerade Task or Service |
| Stealth | T1036 | Masquerading |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1140 | Deobfuscate/Decode Files or Information |
| Credential Access | T1555.003 | Credentials from Password Stores: Credentials from Web Browsers |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1012 | Query Registry |
| Discovery | T1016 | System Network Configuration Discovery |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1124 | System Time Discovery |
| Command and Control | T1102.002 | Web Service: Bidirectional Communication |
| Command and Control | T1573.001 | EncryptedChannel:SymmetricCryptography |
| Command and Control | T1090.003 | Proxy: Multi-hop Proxy |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1665 | Hide Infrastructure |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Exfiltration | T1567.002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
Latest Developments Observed
APT31 (JungleBamboo) is suspected of exploiting a Chrome zero-day vulnerability chain involving CVE-2026-85046 to target organizations through spear-phishing emails. The campaign leveraged a reflected XSS vulnerability on a legitimate university website to redirect victims to threat-actor-controlled infrastructure, ultimately deploying the SUPERSTOMP loader and LONGTALE Chrome extension to steal browser credentials, cookies, session data, keystrokes, and other sensitive information. The activity appears focused on credential theft and surveillance, with APT31 using the Chrome patch-gap window to conduct exploitation against vulnerable users.
ETLM Insights
APT31 (JungleBamboo) continues to demonstrate an adaptive and exploitation-focused operational model centered on leveraging browser vulnerabilities and targeted social engineering to establish access and conduct credential theft and surveillance. The use of a multi-stage Chrome exploit chain, combined with a browser-based information-stealing payload, reflects an ability to adapt its post-exploitation approach while taking advantage of short-lived patch gaps.
The threat actor’s operations reflect:
Looking ahead, APT31 (JungleBamboo) is expected to further refine its browser-focused intrusion capabilities by exploiting vulnerability disclosure and patch-release gaps to establish access against targeted users. The group is likely to continue developing or adopting stealthier browser-based payloads for credential and session theft, enabling sustained surveillance while reducing reliance on conventional executable malware. Its continued use of tailored phishing and legitimate web infrastructure may also improve the effectiveness and resilience of future campaigns.
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules
import “hash”
rule APT31_JungleBamboo_IOCs
{
meta:
description = “Detects artifacts and IOCs associated with APT31 (JungleBamboo)” author = “CYFIRMA”
date = “2026-09-15”
strings:
// File names
$file1 = “msvcr100.bin” ascii wide nocase
$file2 = “e1999a3e5a611312e16bb65bb5a880dfedbab8d4d2c0a5d3ed1ed926a3f63e94.elf” ascii wide nocase
$file3 = “002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8.bin” ascii wide nocase
// IP addresses
$ip1 = “88.247.129.12” ascii
$ip2 = “195.91.239.226” ascii
$ip3 = “89.31.228.228” ascii
$ip4 = “184.75.129.113” ascii
$ip5 = “50.71.100.164” ascii
// Domains
$domain1 = “hdpopcorn.live” ascii nocase
$domain2 = “gitloucache.com” ascii nocase
$domain3 = “edgecloudc.com” ascii nocase
$domain4 = “ramblercloud.com” ascii nocase
$domain5 = “yandexpro.net” ascii nocase
condition:
// Exact SHA-256 matches hash.sha256(0, filesize) ==
“e1999a3e5a611312e16bb65bb5a880dfedbab8d4d2c0a5d3ed1ed926a3f63e94” or
hash.sha256(0, filesize) == “002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8”
// IOC-based detection or 1 of ($file*)
or 1 of ($ip*)
or 1 of ($domain*)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
AI Cyber Threat This Week: Slowdowns, Security, and Chinese Distillation
Anthropic CEO Dario Amodei has published an essay calling for a slowdown in AI development. “Over the last few months, I have become convinced that fully addressing the risks requires even more prudence — not just investing in risk prevention, but pacing the rate of capabilities advancement so that risk prevention has time to keep up,” he wrote. As a concrete example, he cited a recent incident in which a swarm of AI agents conducted unauthorized attacks against a real-world target, and warned that within 6–12 months such a swarm could be capable of taking over the entire internet via a persistent botnet, causing hundreds of billions of dollars in damage. Amodei’s call was backed by OpenAI CEO Sam Altman and Elon Musk. Critics, however, warn that dramatic warnings from established players may also serve to deter new competitors through regulation. President Trump rejected the idea outright, arguing that an American slowdown would hand the AI race to China.
China’s Ministry of State Security issued its first public warning about AI risks, flagging the abuse of generative AI — deepfake video, AI-generated text, and “intelligent troll armies” — to spread political disinformation and inflame social divisions. Separately, Chinese security officials were alarmed by a proof-of-concept tool developed by a team of California researchers that could launch a worm attack against millions of WeChat users simply by calling compromised accounts’ contacts. WeChat has 1.4 billion monthly users and is deeply embedded in Chinese government services and payments. According to The New York Times, the discovery is expected to feature in upcoming talks between Trump and Xi Jinping, where AI security is on the agenda.
The NSA, FBI, and CISA issued a joint statement accusing leading Chinese AI companies of systematically extracting proprietary knowledge from American models. Named explicitly were DeepSeek, Moonshot AI (maker of Kimi), Alibaba, MiniMax, StepFun, and Z.AI. The agencies say these firms have been accessing US AI models “at an industrial scale” since at least 2024, routing requests through multiple pathways to evade terms-of-use restrictions — likely with the knowledge of the Chinese government. Distillation is a legitimate technique in which a more powerful model trains a smaller one, but conducting it without the model owner’s consent is treated as intellectual property theft. The alert comes weeks before Trump’s scheduled summit with Xi. China’s Ministry of Commerce rejected the accusations as baseless, called distillation a “common practice,” and threatened countermeasures if the US uses the issue to suppress Chinese AI companies.
ETLM Assessment:
China’s approach to AI competition increasingly follows a two-track strategy: state-linked actors use AI to supercharge cyber operations against Western targets, while Chinese AI companies quietly distillate from American frontier models — effectively letting US firms absorb the enormous R&D costs of pushing the frontier forward, then extracting the results at a fraction of the price.
Iran, Russia and Other Threat Actors Using Claude for Weapons Research and Cyber Operations Automation
Frontier artificial intelligence developer Anthropic disclosed that its flagship model, Claude, has been repeatedly targeted by state-aligned actors, cybercriminals, and covert researchers seeking to build military-grade weaponry, surveillance tools, and automated cyber-weapons. According to a detailed report from the company’s threat intelligence team, high-risk misuse originated from actors operating out of Russia, China, Iran, Mali, and Houthi-controlled Yemen.
The threat landscape spans conventional weapons development, biological research, and intrusive state surveillance. In Russia, non-state threat actors attempted to leverage Claude to write software for autonomous, FPV kamikaze drone swarms trained on Ukrainian combat footage. In Houthi-controlled northern Yemen, operatives used the AI to build guidance software for multiple missile types, returning to the model to troubleshoot flight telemetry after a failed test-fire of a guided rocket. Elsewhere, China-linked actors utilized Claude to track and recruit Uyghurs in the Syrian Army, while an intelligence consultant in Mali deployed a Claude-backed system capable of generating warrantless intelligence dossiers on 25 million mobile phones—a platform that remains operational locally despite account termination. Anthropic also flagged ambiguous cases involving potential dual-use biological research, including a grant application for enhancing the debilitating chikungunya virus at an unnamed foreign military institute.
ETLM Assessment:
While Anthropic emphasized that the incidents did not involve its most advanced models, Fable and Mythos, the findings highlight an intensifying struggle to keep civilian AI systems from becoming force multipliers for adversary capabilities.
Concurrently, sophisticated cyber-espionage groups have integrated Claude directly into their offensive toolchains. Russia’s SVR-linked intelligence unit – tracked as Midnight Blizzard, APT29, or Cozy Bear – deployed customized, AI-driven workflows to automate nearly every stage of their operations against US, European, and Ukrainian military, diplomatic, and defense targets. By automating infrastructure acquisition, malware development, phishing generation, and data exfiltration, the group dramatically accelerated its operational cadence. Similarly, the ShinyHunters cyber-extortion gang used Claude to scan for leaked credentials to execute rapid data thefts.
Qilin Ransomware Impacts a Business Services Company from Japan
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by Qilin ransomware. The compromised company is a Japanese trading and manufacturing company. The businesses involve synthetic-resin materials, plastic-product manufacturing, SMC/FRP materials, textiles, apparel, and related trading activities. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and a focus on speed and evasion, make it a particularly dangerous actor.
The Gentlemen Ransomware Impacts an Engineering and Architectural Consulting Company from Saudi Arabia
Summary: CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Saudi Arabia was compromised by The Gentlemen Ransomware. The compromised company is a Saudi Arabian multidisciplinary engineering and architectural consulting firm. The company states that it was established in 1965 as the first Saudi engineering consulting firm and has more than six decades of experience supporting major projects. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in ConnectWise ScreenConnect
Relevancy & Insights:
The vulnerability exists due to improper privilege management during guest file transfer in the ScreenConnect client.
Impact: A remote user can transfer and execute files through an active remote session without authorization or Host confirmation
Affected Products:
https[:]//www[.]connectwise[.]com/company/trust/advisories#September+3%2 C+2026%3A+ScreenConnect%26reg%3B+Remote+Access%3A+Guest+File+Tran sfer+Advisory
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment:
The vulnerability in ConnectWise ScreenConnect presents a significant security risk to organizations using affected versions of the remote access software. The vulnerability is caused by missing authorization and improper privilege management in the ScreenConnect client, potentially allowing an attacker with access to an active remote session to bypass expected authorization controls for file-transfer and file-execution operations. Successful exploitation could allow unauthorized files to be transferred and executed on the affected endpoint, potentially resulting in arbitrary code execution and further compromise of the system. Although exploitation requires additional access and an active remote session, the vulnerability carries a CVSS v3.1 score of 9.9 and has been assigned Priority 1 – High by ConnectWise due to the risk of being targeted by exploits in the wild. Organizations using affected ScreenConnect versions should prioritize upgrading to version 26.6.5 or later. Security teams should also review ScreenConnect roles and permissions, particularly the Transfer Files permission, and monitor endpoints for suspicious file-transfer activity, unauthorized binary modifications, and unexpected process execution originating from ScreenConnect sessions. Prompt remediation, access-control review, and continuous monitoring are recommended to reduce the risk of unauthorized code execution and potential compromise of affected systems.
Krybit Ransomware attacked and published the data of a Healthcare company from Thailand
Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a healthcare company from Thailand on its dark web website. The compromised company is a Thai trusted distributor and one-stop service provider of medical products, pharmaceuticals, medical equipment, dietary supplements, cosmetics, and health products, headquartered in Nonthaburi, Thailand. Originally founded as an importer of X-ray films from European countries, it expanded into a comprehensive healthcare distribution company serving Thailand’s health authorities and other ASEAN countries. The company operates a modern warehouse with advanced operating systems and innovative machinery, with carefully allocated space for efficient inventory management. It is trusted by manufacturers and distributors of pharmaceuticals, medical equipment, dietary supplements, and health products worldwide. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of the compromised data is approximately 194.49 GB.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
Unauthorized Corporate Data Exposure Advertised on a Leak Site
Summary
The CYFIRMA research team identified a post on a cybercrime forum advertising the alleged possession and sale of approximately 4 TB of data reportedly obtained from a Japanese pharmaceutical and consumer healthcare organization. According to the forum advertisement, the allegedly compromised information was collected from multiple enterprise platforms and repositories, including cloud storage, customer relationship management systems, voice recordings, and corporate documents. The post also claims that the organization had previously issued an official statement concerning a cyberattack.
Based on the information displayed in the advertisement, the allegedly compromised data may include:
The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information presented in the cybercrime forum advertisement and has not been independently confirmed.
Source: Underground Forums
Alleged Database Access Advertised on a Leak Site
Summary: The CYFIRMA research team identified a post on a cybercrime forum advertising alleged database access associated with a major Saudi-based organization operating in the dairy and food & beverage sector. The advertisement provides organizational information and claims access to the organization’s database environment.
According to the forum post, the targeted organization is a Saudi multinational enterprise involved in dairy and beverage manufacturing and distribution, with its headquarters located in Riyadh, Saudi Arabia. The post also displays corporate and organizational details as part of the advertisement.
Based on the information visible in the forum advertisement, the alleged compromise may involve:
The authenticity of the alleged database access remains unverified at the time of reporting. This assessment is based solely on information visible in the provided cybercrime-forum advertisement and has not been independently confirmed.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure.
Recommendations: Enhance the cybersecurity posture by:
The CYFIRMA research team identified a post on a cybercrime forum claiming that data associated with an Australian organization operating in the supply chain and retail logistics sector had been compromised. The forum post states that the alleged breach resulted in the theft of the organization’s source code, which has subsequently been uploaded and made available for download.
According to the advertisement, the compromised information primarily consists of source-code repositories. The post also includes a sample described as a tree file, apparently intended to demonstrate possession of the allegedly stolen material.
Potentially Compromised Information
Based on the information visible in the advertisement, the allegedly exposed data may include:
The available advertisement does not provide sufficient evidence to establish whether credentials, API keys, databases, customer information, employee records, or other sensitive datasets were also compromised.
Potential Impact
If the source-code exposure is authentic, the incident could create significant security and operational risks. Threat actors or other unauthorized parties could potentially analyze the exposed code to:
For an organization operating within the supply chain and retail logistics sector, source-code exposure could have additional implications if the affected applications support logistics management, inventory, transportation, warehouse operations, retail services, or integrations with external partners.
The authenticity and completeness of the alleged source-code leak remain unverified at the time of reporting. This assessment is based solely on information visible in the provided cybercrime-forum advertisement and has not been independently confirmed.
Source: Underground Forums
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
