CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Introduction:
CYFIRMA Research and Advisory Team has found PicMo Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
PicMo Group Ransomware
PicMo is a ransomware strain that encrypts files on compromised systems and alters their original filenames by replacing them with randomly generated strings. The encrypted files are assigned a common randomly generated extension, making the original file names and extensions difficult to identify. The malware also creates a ransom note named “How to Restore Your Files.txt” after encryption. Its behavior indicates a double-extortion model, in which data is reportedly exfiltrated before local files are encrypted, with the threat of public disclosure used to pressure victims into paying.
Screenshot: File encrypted by the ransomware (Source: Surface Web)
The ransom note provides a unique victim identifier and states that sensitive data has been stolen. It demands payment in cryptocurrency and warns that the stolen information may be published through an anonymous network if the attackers’ demands are not met. The note also provides communication instructions and attempts to discourage victims from contacting authorities or modifying encrypted files. It claims that altering the encrypted data could interfere with decryption and presents payment as the means of obtaining recovery assistance.
Screenshot: The appearance of PICMO’s ransom note (How to Restore Your Files.txt) (Source: Surface Web)
PicMo represents a data-encrypting ransomware threat with characteristics consistent with a double-extortion operation. Its impact includes both loss of access to local files through encryption and potential exposure of exfiltrated data. The use of randomized filenames and a shared randomized extension can complicate file identification and recovery during incident response. The ransom note further applies pressure through data-leak threats, payment instructions, and warnings against modifying affected files. From a defensive perspective, the observed behavior warrants investigation of the initial compromise vector, lateral movement, data-exfiltration activity, persistence mechanisms, and affected systems, followed by containment and recovery using known-good backups.
The following are the TTPs based on the MITRE ATT&CK framework
| Tactic | Technique ID | Technique Name |
| Initial Access | T1091 | Replication Through Removable Media |
| Execution | T1059 | Command and Scripting Interpreter |
| Execution | T1129 | Shared Modules |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1548 | Abuse Elevation Control Mechanism |
| Credential Access | T1003 | OS Credential Dumping |
| Credential Access | T1552.001 | Unsecured Credentials: Credentials In Files |
| Discovery | T1007 | System Service Discovery |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1120 | Peripheral Device Discovery |
| Discovery | T1135 | Network Share Discovery |
| Discovery | T1518 | Software Discovery |
| LateralMovement | T1091 | Replication Through Removable Media |
| Collection | T1005 | Data from Local System |
| Collection | T1074 | Data Staged |
| Collection | T1114 | Email Collection |
| Command and Control | T1071 | Application Layer Protocol |
| Impact | T1486 | Data Encrypted for Impact |
| Impact | T1489 | Service Stop |
| Impact | T1490 | Inhibit System Recovery |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1036 | Masquerading |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1564.003 | Hide Artifacts: Hidden Window |
| Defense Impairment | T1222 | File and Directory Permissions Modification |
Relevancy and Insights:
ETLM Assessment:
PicMo is likely to evolve from its current file-encryption and data-exfiltration behavior toward a more mature, multi-stage ransomware operation. Future variants may improve their ability to identify high-value systems and files before initiating encryption, while introducing stronger defense-evasion capabilities to remain undetected for longer periods. The ransomware may also become more selective in its encryption process, prioritizing business-critical documents, databases, backups, and shared network resources to maximize operational disruption. Additional mechanisms for disabling security controls, terminating recovery-related processes, and removing accessible backup copies could further increase the impact of successful compromises.
The observed combination of file encryption, randomized filenames, and threats to publish stolen information suggests that future versions could place greater emphasis on the exfiltration stage of the attack. Operators may expand the types of information targeted, including sensitive business documents, credentials, configuration data, and other information that can increase extortion pressure. PicMo could also develop capabilities for broader network propagation, allowing attackers to move from an initially compromised endpoint to additional systems before encryption begins. Such development would shift the threat from an endpoint-focused ransomware infection toward a coordinated network-level intrusion in which reconnaissance, privilege escalation, lateral movement, data theft, and encryption are performed as interconnected stages.
From an operational perspective, future PicMo activity may involve more adaptive extortion techniques and increasingly resilient communication infrastructure. Ransom demands could be adjusted according to the victim’s perceived ability to pay or the sensitivity of the stolen information, while anonymous communication channels may be changed or rotated to reduce disruption and attribution. The operators may also refine their pre-encryption reconnaissance to determine whether an environment contains security controls, recovery infrastructure, or valuable assets that should be targeted first. If these capabilities are developed successfully, PicMo could become a more disruptive ransomware threat characterized by prolonged intrusion activity followed by large-scale encryption and data-leak pressure, making early detection, network segmentation, centralized monitoring, and protected offline backups increasingly important defensive measures.
Sigma rules:
title: Potential PicMo Activity tags:
– attack.privilege-escalation
– attack.stealth
– attack.discovery
– attack.t1135
– attack.t1033
– detection.emerging-threats logsource:
category: process_creation product: windows
detection: selection_svchost:
Image|endswith: ‘\svchost.exe’ CommandLine|contains|all:
– ‘C:\Users\’
– ‘\Desktop\’ filter_svchost:
ParentImage|startswith: ‘C:\Windows\System32\’ selection_regsvr:
ParentImage|endswith: ‘\excel.exe’ Image|endswith: ‘\regsvr32.exe’ CommandLine|contains:
– ‘ -s ‘
– ‘\AppData\Local\Temp\’ filter_regsvr:
CommandLine|contains: ‘.dll’ selection_anomaly_parent:
ParentImage|endswith: ‘\svchost.exe’ selection_anomaly_child_1:
Image|endswith: ‘\whoami.exe’ CommandLine|contains: ‘ /all’
selection_anomaly_child_2: Image|endswith:
– ‘\net.exe’
– ‘\net1.exe’ CommandLine|contains: ‘ view’
condition: (selection_svchost and not filter_svchost) or (selection_regsvr and not filter_regsvr) or (selection_anomaly_parent and 1 of selection_anomaly_child_*) falsepositives:
– Unlikely level: critical
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Type: Information Stealer |Objectives: Credential and Wallet Theft | Target Technology: Windows | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week
This week, “Umbral Stealer” Malware is in focus.
Overview of Operation Umbral Stealer Malware
The analyzed malware sample identified as Umbral Stealer is a Windows-based information-stealing threat designed to collect valuable information from compromised systems. The analysis indicates that its primary focus is the theft of credentials and cryptocurrency-related information, making infections particularly concerning for users and organizations that handle online accounts, digital assets, or sensitive authentication data. The sample was assessed as highly malicious by the sandbox environment, with multiple detection mechanisms identifying characteristics associated with credential-stealing malware.
Rather than attempting to damage the infected computer directly, the malware appears to prioritize the collection of information that can provide financial or operational value to an attacker. The analysis found functionality associated with targeting cryptocurrency wallets, including Electrum, Exodus, and Jaxx, alongside broader credential-theft capabilities. This behavior suggests that the malware is intended to turn a compromised endpoint into a source of account and digital-asset information that can potentially be abused after the initial infection.
The malware also demonstrates an awareness of its execution environment. Before proceeding with its activities, it performs checks that can help determine whether it is operating on a genuine user system or within an environment commonly used for malware analysis. It gathers information about the device and checks whether the system is associated with a hosting or data-center environment. These behaviors can make automated analysis more difficult and may allow the malware to behave differently when it suspects that it is being examined.
Overall, the sample analyzed represents a significant information-theft risk because its objectives extend beyond ordinary system reconnaissance and are centered on obtaining credentials and cryptocurrency-related data. Its combination of information collection, environmental awareness, and external communication indicates a threat designed to operate quietly while extracting information of direct value to an attacker. Organizations should therefore treat similar samples as a high-priority threat and consider endpoint monitoring, credential protection, and cryptocurrency-wallet security as important defensive measures.
Attack Method
The attack begins when the malicious Windows executable is launched on the victim system. The analyzed malware is identified as Umbral Stealer and operates as a .NET-based payload with elevated privileges observed during execution. After execution, it initiates system reconnaissance by invoking the legitimate Windows Management Instrumentation Command-line utility (WMIC.exe) with the csproduct get uuid query. This allows the malware to retrieve the system UUID and establish a hardware-linked fingerprint of the host. The observed process chain shows the stealer initiating WMIC activity, followed by conhost.exe handling the associated console operations.
Malware also incorporates environment awareness mechanisms designed to identify systems that may not represent genuine victims. It sends an HTTP request to ip-api.com and queries about the hosting field to determine whether the system is associated with a hosting provider or data-center environment. This behavior can assist the malware in identifying virtualized, automated, or security-analysis infrastructure and potentially avoiding further activity on such systems. In addition, the sandbox identified string decryption behavior, indicating that relevant configuration data and embedded information are protected from straightforward inspection during static analysis.
Once the environment is assessed, the malware is positioned to pursue sensitive information stored on the compromised endpoint. The analysis identified references to Electrum, Exodus, and Jaxx cryptocurrency wallets, demonstrating a specific interest in cryptocurrency-related information. The sample was also detected by YARA rules associated with credential-stealing behavior, Umbral Stealer, and Blank Grabber. This combination indicates that the malware’s collection activity is centered on information that can provide direct financial or account-access value, rather than merely gathering basic system information.
The information collected can be associated with external communication infrastructure controlled or configured by malware. The analysis identified a Discord webhook within the malware configuration and observed network communication with ip-api.com during execution. Suricata classified the observed network activity as common stealer behavior related to hosting-provider checks. A mutex value was also identified, indicating the presence of an execution-control mechanism within the malware. Overall, the observed attack chain combines host fingerprinting, environment detection, configuration obfuscation, credential and cryptocurrency-wallet targeting, and external communication to support information theft from compromised Windows systems.
The following are the TTPs based on the MITRE ATT&CK Framework for Enterprises
| Tactic | Technique | Technique Name |
| Execution | T1047 | Windows Management Instrumentation |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1140 | Deobfuscate/Decode Files or Information |
| Stealth | T1497 | Virtualization/Sandbox Evasion |
| Discovery | T1012 | Query Registry |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1087 | Account Discovery |
| Discovery | T1518 | Software Discovery |
| Discovery | T1614 | System Location Discovery |
| Collection | T1005 | Data from Local System |
| Collection | T1074 | Data Staged |
| Command and control | T1071 | Application Layer Protocol |
INSIGHTS
ETLM ASSESSMENT
From an ETLM perspective, the behaviors exhibited by Umbral Stealer suggest that future threat campaigns are likely to place greater emphasis on exploiting the information stored within employee endpoints as a means of generating financial and account-related value. As stealer malware continues to target a broader range of digital assets and user information, organizations may face increasing exposure through employees who access financial services, business platforms, and sensitive accounts from their workstations. Employees are also likely to remain an attractive target because information obtained from a single user environment can potentially provide access to multiple digital services and assets. Collectively, these trends indicate that future information-stealing campaigns may become increasingly selective in identifying valuable victim environments, enabling threat actors to extract greater value from individual compromises while keeping their activity relatively unobtrusive.
IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)
YARA Rules
rule UmbralStealer_v1_3
{
meta:
description = “Detects Umbral Stealer v1.3 based on identified sample characteristics”
author = “CYFIRMA” date = “2026-08-11”
strings:
$hash = “90d78c79fed001f3568b4d4bc7618bd91258c0a8425c9d2d278f7ffa4c9a557a”
$family = “Umbral Stealer”
$version = “v1.3”
$payload = “Payload for Umbral Stealer”
$wallet1 = “Electrum”
$wallet2 = “Exodus”
$wallet3 = “Jaxx”
$wmi = “csproduct get uuid”
$hosting = “ip-api.com/line/?fields=hosting”
$discord = “discord.com/api/webhooks/”
$mutex = “wE5p43lYJeQTllHUajMk”
condition:
uint16(0) == 0x5A4D and (
$hash or (
2 of ($family, $version, $payload) and 2 of ($wallet*) and
2 of ($wmi, $hosting, $discord, $mutex)
)
)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Key Intelligence Signals:
Mustang Panda aka Twill Typhoon Leverages Supply-Chain Attacks to Expand Target Reach
About the Threat Actor
Mustang Panda is a Chinese state-associated espionage group active since at least 2012, known for conducting structured, geopolitically motivated intelligence operations with a strong focus on adaptability and long-term persistence. Its campaigns often start with targeted spear-phishing emails—typically using politically themed lures delivered via ZIP, RAR, LNK, or malicious URLs—followed by multi-stage payload deployment, where initial loaders introduce backdoors, reverse shells, and tools for lateral movement.
The group frequently uses malware families, such as PlugX, Poison Ivy, ToneShell, StarProxy, Claimloader, and SplatCloak, relying heavily on techniques like DLL sideloading and encrypted command-and-control channels to remain undetected and maintain access. In some cases, it has also leveraged infected USB drives for propagation. Overall, Mustang Panda demonstrates a high level of capability, combining precise targeting with modular malware frameworks to sustain prolonged access to sensitive networks.
Details on Exploited Vulnerabilities
| CVE ID | Affected Products | CVSS Score | ExploitLinks |
| CVE-2021-1675 | Microsoft Windows | 7.8 | link1, link2, link3 |
| CVE-2021-40444 | Microsoft Windows | 7.8 | link1, link2, link3 |
TTPs based on MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1598.003 | Phishing for Information: Spear phishing Link |
| ResourceDevelopment | T1585.002 | Establish Accounts: Email Accounts |
| ResourceDevelopment | T1608 | Stage Capabilities |
| ResourceDevelopment | T1608.001 | Stage Capabilities: Upload Malware |
| ResourceDevelopment | T1588.004 | Obtain Capabilities: Digital Certificates |
| ResourceDevelopment | T1583.002 | Acquire Infrastructure: Domains |
| Initial Access | T1091 | Replication Through Removable Media |
| Initial Access | T1566.001 | Phishing: Spear phishing Attachment |
| Initial Access | T1566.002 | Phishing: Spear phishing Link |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Execution | T1059.005 | Command and Scripting Interpreter: Visual Basic |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1203 | Exploitation for Client Execution |
| Execution | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Execution | T1204.001 | User Execution: Malicious Link |
| Execution | T1204.002 | User Execution: Malicious File |
| Execution | T1047 | Windows Management Instrumentation |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Persistence | T1546.003 | Event Triggered Execution: Windows Management Instrumentation Event Subscription |
| Persistence | T1574.001 | Hijack Execution Flow: DLL |
| Persistence | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Privilege Escalation | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1546.003 | Event Triggered Execution: Windows Management Instrumentation Event Subscription |
| Privilege Escalation | T1574.001 | Hijack Execution Flow: DLL |
| Privilege Escalation | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Stealth | T1480 | Execution Guardrails |
| Stealth | T1564.001 | Hide Artifacts: Hidden Files and Directories |
| Stealth | T1574.001 | Hijack Execution Flow: DLL |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1036.005 | Masquerading: Match Legitimate Resource Name or Location |
| Stealth | T1036.007 | Masquerading: Double File Extension |
| Stealth | T1036.004 | Masquerading: Masquerade Task or Service |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1027.013 | Obfuscated Files or Information: Encrypted/Encoded File |
| Stealth | T1027.016 | Obfuscated Files or Information: Junk Code Insertion |
| Stealth | T1218.004 | System Binary Proxy Execution: InstallUtil |
| Stealth | T1218.005 | System Binary Proxy Execution: Mshta |
| Stealth | T1218.014 | System Binary Proxy Execution: MMC |
| Stealth | T1218.007 | System Binary Proxy Execution: Msiexec |
| DefenseImpairment | T1553.002 | Subvert Trust Controls: Code Signing |
| Credential Access | T1003.003 | OS Credential Dumping: NTDS |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1518 | Software Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1016 | System Network Configuration Discovery |
| Discovery | T1049 | System Network Connections Discovery |
| LateralMovement | T1091 | Replication Through Removable Media |
| Collection | T1557.004 | Adversary-in-the-Middle: Evil Twin |
| Collection | T1560.001 | Archive Collected Data: Archive via Utility |
| Collection | T1119 | Automated Collection |
| Collection | T1560.003 | Archive Collected Data: Archive via Custom Method |
| Collection | T1074.001 | Data Staged: Local Data Staging |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1219.002 | Remote Access Tools: Remote Desktop Software |
| Command and Control | T1573.001 | Encrypted Channel: Symmetric Cryptography |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1102 | Web Service |
| Command and Control | T1090 | Proxy |
| Command and Control | T1095 | Non-Application Layer Protocol |
| Exfiltration | T1052.001 | Exfiltration Over Physical Medium: Exfiltration over USB |
Latest Developments Observed
The threat actor is suspected of conducting a targeted supply-chain campaign leveraging the long-standing compromise of the QuickFox application, with observed activity focused on Windows-based installations of QuickFox VPN. The campaign appears to be oriented toward the covert collection and exfiltration of sensitive information, potentially enabling broader intelligence gathering and follow-on exploitation of affected users or organizations.
ETLM Insights
Mustang Panda’s continued evolution reflects a sustained and adaptive cyber-espionage capability, characterized by the integration of customized malware, trusted cloud platforms, and targeted social-engineering techniques. The actor’s evolving tradecraft indicates a deliberate focus on maintaining operational access, improving resilience against defensive controls, and minimizing opportunities for detection and attribution.
Key Emerging TTP Trends:
Strategic Implication:
The evolution of Mustang Panda’s TTPs highlights the need for organizations to move beyond traditional IOC-based detection and adopt a behavioral and intelligence-led security approach. Monitoring trusted-service abuse, emerging malware infrastructure, spear phishing ecosystems, and changes in targeting patterns can provide opportunities to identify and pre-empt potential intrusion activity before it progresses into sustained compromise or intelligence collection.
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules
rule CYFIRMA_MustangPanda_PlugX_Hodur_Starter
{
meta:
description = “Starter hunting rule for suspected Mustang Panda PlugX/Hodur-style payloads”
author = “CYFIRMA” threat_actor = “Mustang Panda” malware_family = “PlugX/Hodur” confidence = “Medium”
purpose = “Threat hunting / triage”
reference = “MITRE ATT&CK: Mustang Panda” strings:
$s1 = “LoadLibraryA” ascii
$s2 = “GetProcAddress” ascii
$s3 = “VirtualAlloc” ascii
$s4 = “CreateProcessA” ascii
$s5 = “CreateProcessW” ascii
$plugx1 = “PlugX” ascii nocase
$hodur1 = “Hodur” ascii nocase
$mutex1 = “Global\\” ascii
$config1 = “Server” ascii
$config2 = “Password” ascii condition:
uint16(0) == 0x5A4D and (
4 of ($s*) and
1 of ($plugx1, $hodur1)
)
or (
5 of ($s*) and 2 of ($config*)
)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
North Carolina Ports operations disrupted by a cyber attack
North Carolina Ports is working to fully recover following a cyberattack that disrupted operations across its three primary facilities in Wilmington, Morehead City, and Charlotte. Although the breach forced staff to temporarily revert to manual processing, port officials confirmed the incident has been contained, and normal operating schedules have resumed. However, terminal operators warn that shipping companies should still anticipate delays while manual operations remain in effect. Both the U.S. Coast Guard and state law enforcement agencies are actively investigating the breach.
ETLM Assessment:
No specific group or country has been identified or publicly suspected in this attack; port officials and investigating authorities have only stated that the IT system was hacked by an “outside actor or group.” No hacking group has claimed responsibility for the incident, and investigators have not disclosed a suspected threat actor, motivation, or technical attribution.
One possible explanation would be an attack by Iran-aligned groups in what CYFIRMA dubbed permanent attrition in a recent report. The compromise of critical networks or the targeting of civilian supply chains are not precursors to a future war – they are the permanent backdrop to any politically contested relationship. The lesson of the ongoing Hormuz crisis is clear: conventional weapons may occasionally fall silent, but the wires remain hot indefinitely. The war with Iran accelerated ushering in an era of permanent digital and maritime attrition where the battlefield is everywhere, and the conflict never truly ends even during periods of ceasefire.
Backdoor found in Chinese-made routers
Cybersecurity researchers have uncovered a previously undocumented backdoor embedded in over 20 router models manufactured by Zbtlink and sold globally under the Zbtlink and Wiflyer brands. According to media reports, the covert flaw regularly reaches out to a Chinese-registered domain every 35 seconds, potentially granting external actors remote access to the routers and any connected network devices. VulnCheck bypassed traditional vendor notification before releasing its findings, noting that coordinated disclosure is meant for unintentional vulnerabilities – which they argue does not apply to this intentional design.
ETLM Assessment:
Researchers concluded that the backdoor was deliberately embedded into the firmware rather than being an accidental coding flaw. Zbtlink rejected the label of a malicious “backdoor,” claiming the functionality was intended solely as an “after-sales technical support tool.” Despite denying malicious intent, Zbtlink admitted to security vulnerabilities, suspended sales of affected models, pulled the firmware from its website, and began developing patches
While neither Western intelligence agencies nor VulnCheck have explicitly named the Chinese government as the direct perpetrator behind the “Endlessdoors” implant, the incident has amplified longstanding Western national security concerns regarding Chinese state influence over domestic tech manufacturers. The hardcoded command-and-control destinations that the routers ping every 35 seconds are hosted on Alibaba Cloud servers in mainland China and tied to Chinese-registered domains. Western cybersecurity agencies (including the FBI and CISA) have repeatedly warned about Chinese state-sponsored threat groups – such as Volt Typhoon and Flax Typhoon – hijacking small office/home office (SOHO) routers globally to build covert botnets (“covert proxy networks”) used for espionage against critical infrastructure.
Under Chinese legal frameworks such as the National Intelligence Law, domestic companies operating in China can be compelled by Beijing to assist state intelligence work, feed state actors backdoors, or hand over administrative access to remote infrastructure. The fact that the implant was compiled directly into standard factory firmware across more than 20 product lines over a two-year period – and disguised as a legitimate Linux kernel process running with full root privileges – leads researchers to view it as an intentional supply-chain mechanism rather than a casual coding oversight.
RansomHouse Ransomware Impacts a Healthcare Company from Thailand
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Thailand was compromised by RansomHouse Ransomware. The compromised company is a Thai-based holding entity operating as a premier importer and distributor of diagnostic instruments, reagents, and consumables for medical and research laboratories. The company manages a comprehensive portfolio of products across hematology, chemistry, immunology, and laboratory automation systems, representing globally. With over 100 employees, the organization serves a broad client base of hospitals and government sectors throughout the Thai domestic market. Established in 1995 and converted to a public company in 2023, the firm delivers end-to-end service support to the public health sector. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, RansomHouse ransomware predominantly targets large enterprises and high-value organizations through phishing and spear phishing campaigns. The group also employs third-party frameworks such as Vatet Loader, Metasploit, and Cobalt Strike to gain initial access and perform lateral movements within victim networks. RansomHouse typically skips data encryption, focusing instead on exfiltrating sensitive data to extort victims by threatening to publicly release the stolen information. This approach allows the group to maintain stealth and prolong their presence in targeted environments.
The Gentlemen Ransomware Impacts an Information Technology Service Company from Singapore
Summary: CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Singapore was compromised by The Gentlemen Ransomware. The compromised company is a dynamic, Singapore-based IT services company specializing in IT as a Service (ITaaS) and hybrid cloud architecture solutions. They build and operate mission-grade, secure digital services for government and enterprise clients, strictly aligned with local compliance standards like GCC and IM8. The company provides comprehensive solutions including Business Process Management (BPM), Data as a Service (DaaS), and enterprise mobility to help organizations optimize their IT infrastructure. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in freo2
Relevancy & Insights:
The vulnerability exists due to insufficient validation of the file during file upload.
Impact:
A remote administrator can upload a malicious file and execute it on the server.
Affected Products:
https[:]//jvn[.]jp/en/jp/JVN52865575/index[.]html
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment
The vulnerability in freo2 presents a significant security risk to organizations using the application, particularly because successful exploitation can result in arbitrary operating system command execution. The vulnerability is caused by insufficient validation of uploaded files, allowing a remote administrator with the highest-level privileges to upload a malicious executable file to the vulnerable system. Successful exploitation could allow threat actors to compromise the underlying host, execute unauthorized commands, modify or access application data, and potentially disrupt the availability of the affected system. As exploitation requires high-level administrative privileges, organizations should prioritize protecting administrative interfaces and limiting access to trusted users and networks. Organizations using affected versions of freo2 should upgrade to the latest available security update and ensure that file-upload functionality enforces strict validation of permitted file types. In addition, organizations should monitor administrative activity and file-upload events for anomalous behavior, particularly attempts to upload executable files. Prompt remediation and continuous monitoring are recommended to reduce the risk of system compromise resulting from exploitation of this vulnerability.
SafePay Ransomware attacked and published the data of a Financial Services company from Japan
Summary:
Recently, we observed that SafePay Ransomware attacked and published the data of a Financial Services company from Japan on its dark web website. The compromised company is a leading Japanese financial and asset consulting firm headquartered in Minato-ku, Tokyo. Established in 1991, the company provides comprehensive wealth management, asset succession, business succession, real estate advisory, and family office services to high-net-worth individuals, entrepreneurs, and corporate owners. Listed on the Tokyo Stock Exchange Standard Market, the company has established an integrated consulting platform focused on the long-term preservation, management, and intergenerational transfer of family and corporate assets. Its multidisciplinary services combine expertise in taxation, finance, law, accounting, architecture, and real estate to develop customized asset-management and succession strategies. Key services include inheritance and tax planning, corporate succession, real estate investment and management, trust arrangements, portfolio optimization, and family governance consulting. The company employs more than 360 professionals and operates through multiple subsidiaries involved in financial services, real estate, investment management, and family office support. It also collaborates with banks, tax advisors, legal professionals, and institutional partners to deliver integrated financial and asset-management solutions. Through its emphasis on long-term client relationships, specialized expertise, and tailored financial planning, the company plays a significant role in Japan’s wealth management and financial consulting sector. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, SafePay represents a sophisticated, fast-moving ransomware threat capitalizing on VPN weaknesses and credential theft, employing effective double extortion tactics to maximize ransom payments. Organizations, especially in highly targeted sectors and regions, must prioritize layered defenses and active hunting for early detection.
Unauthorized Customer Database Advertised on a Leak Site
Summary
The CYFIRMA research team identified a cybercrime forum post advertising the sale of a customer database allegedly belonging to an Indonesian internet and Wi-Fi service provider. According to the screenshot, the database reportedly contains approximately 352,543 customer records, with the seller listing the dataset for sale at a price denominated in cryptocurrency.
The forum post includes a database sample and displays numerous customer-related fields, indicating that the allegedly exposed dataset may contain:
The authenticity of the alleged database and the full extent of the claimed exposure remain unverified based solely on the available screenshot. The assessment is therefore based on information displayed in the cybercrime-forum advertisement and the database sample visible in the image. Similar leak-site assessments should treat advertised datasets as unconfirmed until independently validated.
Source: Underground Forums
Philippine SMS Sending Provider Database Advertised on a Leak Site
Summary:
The CYFIRMA research team identified a post on a cybercrime forum that claims to offer access to a large database allegedly originating from a major Philippine SMS messaging service provider. According to the advertisement, the database contains information associated with more than 2,000 users and approximately 160 million SMS messages, including recipient phone numbers and message content. The advertised dataset reportedly covers customers operating across several sectors, including gambling, cryptocurrency, finance, and government.
The forum post includes sample database records as evidence of possession and indicates that interested parties can access or test the data. The authenticity and complete scope of the advertised dataset could not be independently verified at the time of reporting.
Allegedly Exposed Information
Based on the sample displayed in the advertisement, the database may contain:
The alleged exposure represents a potentially significant privacy and cybersecurity risk, particularly because the advertised dataset reportedly combines phone numbers, message content and delivery metadata at a very large scale. The presence of authentication and verification messages could increase the risk of targeted fraud, phishing, social engineering and account compromise.
The authenticity of the complete dataset remains unverified. This assessment is based on the information and sample records displayed in the forum advertisement and should not be interpreted as independent confirmation of the alleged breach.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable entity primarily engaged in data-leak operations, with multiple credible indications linking them to incidents involving unauthorized system access and the dissemination or sale of stolen data on dark web forums. These activities underscore the growing sophistication of cyber threats driven by organized underground networks and highlight the urgent need for organizations to enhance their cybersecurity posture through continuous monitoring, improved threat intelligence, and proactive defensive measures to protect sensitive information and critical infrastructure.
Recommendations: Enhance the cybersecurity posture by:
The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of data allegedly obtained from a technology provider serving online proprietary trading firms. According to the forum post, the alleged breach contains trader-related information associated with approximately 130 proprietary trading firms.
The seller claims that the dataset contains approximately 392,000 unique records, with a significant portion reportedly containing Personally Identifiable Information (PII). A sample of the alleged data was also referenced in the forum post as evidence of possession.
Based on the information visible in the post, the allegedly exposed dataset may include:
The alleged exposure is significant because proprietary trading platforms manage information relating to traders and their accounts. If authentic, the data could be used to identify and target individuals participating in online trading programs.
The authenticity of the alleged breach, the complete dataset, and the precise source of the records remain unverified based solely on the available forum post. The assessment is based on the information displayed in the advertisement and its accompanying claims. As with other cybercrime-forum data-sale claims, independent validation is required before confirming the compromise.
Source: Underground Forums
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.
