CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Targeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, Chile
Targeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation
Introduction:
CYFIRMA Research and Advisory Team has found Majin Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
Majin Ransomware
MAJIN ransomware is a malicious program designed to compromise systems, encrypt files, and exfiltrate sensitive information for financial extortion. Once executed, it encrypts files and appends the .majin extension to their filenames, rendering them inaccessible without the appropriate decryption key. Following encryption, it creates a ransom note named README.txt containing instructions for contacting the attackers. The malware employs a double-extortion strategy, combining file encryption with data theft to increase pressure on affected organizations. This approach allows the attackers to threaten the public disclosure of confidential information even if the victim restores its systems from backups. The combination of data encryption and exfiltration increases the potential impact of the attack by affecting both data availability and confidentiality.
Screenshot: File encrypted by the ransomware (Source: Surface Web)
The ransom note claims that the victim’s infrastructure has been compromised, servers have been encrypted, and sensitive data has been transferred outside the organization’s network. It imposes a seven-day deadline for initiating contact and threatens to publish the stolen information alongside the victim’s identity on a Tor-based data leak site (DLS) if negotiations are not initiated. Such sites operate through the Tor network, helping attackers conceal their server locations while publicly exposing information about targeted organizations to intensify extortion pressure. The note provides a unique victim identifier and directs the recipient to communicate through an encrypted peer-to-peer messaging protocol. It does not specify a ransom amount, instead emphasizing the consequences of data disclosure and the difficulty of recovering encrypted files. These statements reflect the attackers’ claims and threats; the actual extent of data exfiltration cannot be established from the ransom note alone.
Screenshot: The appearance of Majin’s ransom note (README.txt) (Source: Surface Web)
Screenshot: The appearance of Majin’s Tor-based DLS Site (Source: Surface Web)
The following are the TTPs based on the MITRE ATT&CK framework
| Tactic | Technique ID | Technique Name |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Persistence | T1542.003 | Pre-OS Boot: Bootkit |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1543.003 | Create or Modify System Process: Windows Service |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1614.001 | System Location Discovery: System Language Discovery |
| Command and Control | T1071 | Application Layer Protocol |
| Command and Control | T1090 | Proxy |
| Impact | T1486 | Data Encrypted for Impact |
| Stealth | T1027.005 | Obfuscated Files or Information: Indicator Removal from Tools |
| Stealth | T1036 | Masquerading |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1542.003 | Pre-OS Boot: Bootkit |
| Stealth | T1574 | Hijack Execution Flow |
| Defense Impairment | T1553.002 | Subvert Trust Controls: Code Signing |
Relevancy and Insights:
ETLM Assessment:
MAJIN ransomware may evolve by adopting more sophisticated techniques to improve its ability to infiltrate networks, evade security controls, and disrupt organizational operations. Future variants could incorporate enhanced obfuscation, polymorphic code, and anti-analysis mechanisms to make detection and reverse engineering more difficult. The malware may also expand its use of stolen credentials, remote administration utilities, and legitimate system processes to move laterally across compromised environments and identify high-value data before encryption. In addition, its operators could refine data exfiltration methods and automate the identification of sensitive files, enabling more targeted attacks against enterprise networks. These developments are potential trends based on broader ransomware activity and should not be interpreted as confirmed capabilities of existing MAJIN variants.
The ransomware’s extortion strategy may also become more aggressive through expanded use of double or multiple extortion techniques. In future campaigns, attackers could place greater emphasis on threatening to publish confidential information through Tor-based data leak sites (DLS), using public leak announcements and reputational pressure to encourage victims to pay. They may also introduce shorter negotiation deadlines, more targeted communications, or threats involving customers, business partners, and regulatory consequences. Additionally, future versions could exploit vulnerabilities in backup infrastructure and virtualization platforms to hinder recovery and increase operational disruption. However, the actual evolution of MAJIN will depend on the activities of its operators, changes in defensive technologies, and the effectiveness of law enforcement efforts; these possibilities represent informed projections rather than verified developments.
Sigma rules:
title: Fsutil Suspicious Invocation tags:
category: process_creation product: windows
detection: selection_img:
CommandLine|contains:
size
condition: all of selection_* falsepositives:
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_fsutil_usage/info.y ml
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Type: Backdoor / RAT | Objectives: Remote Control, Persistence and Data Exfiltration | Target Technology: Windows | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week
This week, RuRAT Malware is in focus.
Overview of Operation RuRAT Malware
The sample analyzed, referred to here as “RuRAT”, is not a benign program. Once it gains a foothold on a machine, it begins to carry out a defined set of actions, and the way it behaves reveals a clear purpose that goes beyond anything an ordinary application would do. It is built to maintain interactive, ongoing control of the machine under the direction of a remote operator, also harvest stored credentials and other sensitive data as a payoff, and maintain a standing channel back to the infrastructure the operator controls. The result is sustained remote control rather than a one-off theft, with the machine kept quietly available to whoever placed the implant.
Observed activity supports the capacity to carry out further actions under a remote operator’s direction, an eye for usable credentials, so access can be turned into data too, and a standing channel back to the operator that keeps control current. For a manager, the key point is that this is not a one-off data grab; it is a remote-control tool whose real value is continued access, with the collection of sensitive information sitting alongside, instead of that ability to act on the machine.
To ensure persistence, the sample arranges to start again on a routine or scheduled basis, making use of scheduled tasks that set it to run again on a fixed timetable, letting the operating system start it automatically at every log-on and registers as a service that the operating system treats as a normal background program, while it also goes to some lengths to avoid being noticed, including efforts to hide what its deeper routines are doing. The value of these measures is that the compromise endures quietly, so the operator keeps a usable foothold without repeated effort.
Looking at the wider picture, this sample is not built for one isolated action alone: it keeps in contact with outside infrastructure the operator controls, which gives whoever placed it a channel back to the machine and to whatever it collects. From a business perspective, this means its presence should be treated as a genuine security concern, since it reveals an actor with a clear interest in the affected systems and the information they hold.
Attack Method
When executed on a Windows host, the sample first registers the mutex madExceptSettingsMtx$133c and _MSIExecute to guarantee only one instance runs at a time, dropping out of any attempt to start a second copy. Only basic environment details are gathered at this stage, enough for the component to orient itself but not enough to betray a heavy information-gathering routine of its own. These structures (reflective, memory-based execution) degrade static inspection and push defenders toward live behavioral observation. Memory- and thread-level manipulation consistent with code injection is also present, letting the implant run inside the context of a trusted process and slide past application-whitelisting controls. Taken together, this opening phase secures a working run on the machine, confirms the environment is suitable, and sets up the persistence and data-handling routines that follow.
A core functional objective is to survive reboots and log-ons. The implant achieves this through three main mechanisms: scheduled-task creation to re-launch the payload at defined intervals or system start-up, autostart persistence via a Windows registry to ensure execution at user log-on; and registration of a Windows service (notably Agent and RManService) for system-level/restart survival. To keep that hold, it conceals payload structures (reflective, memory-based execution), letting the sample continue while remaining difficult for the user and signature controls to notice.
A defining functional characteristic of this sample is remote control rather than one-way theft: it reads stored credential material for later use, and it can run further commands or code on request. This is not a one-shot stealer: whatever it gathers is a by-product of the access it keeps, not the objective. Over this same channel, the operator reaches back in to drive the host, and the external endpoint maintains contact and carries both instructions and any data routed out.
The following are the TTPs based on the MITRE ATT&CK Framework for Enterprise
INSIGHTS
ETLM ASSESSMENT
Looking ahead under the ETLM lens, the kind of activity RuRAT demonstrates sits squarely in a trend toward more automated and more persistent intrusions, and its future impact on organizations and employees should not be underestimated: interactive remote access is trending toward a standing foothold that operators will hold for extended periods, so future incidents are likely to unfold lazily across weeks, with access quietly maintained long after the initial infection moment is forgotten. As these tools and their successors evolve, the incidents organizations face will push further into everyday operations, and employees will remain the main point of human exposure, their routine actions quietly sustaining the economy these implanted programs feed. The cumulative consequence may therefore be felt most in how organizations absorb exposure over time: as intrusions of this class become more common, the overall effect could reach well beyond any single machine into broader operational disruption that is difficult to isolate and even harder to unwind.
IOCs:
Kindly refer to the IOCs below to exercise controls on your security systems. (Source: Open Surface)
YARA Rules
rule RuRAT_Malware
{
meta:
description = “Detection rule for the analyzed malware sample” author = “Threat Research”
strings:
$hash1 = “becef815900330a003675673d1b0bdc907d8c2ab3d6779079a3ad246ad6125c2”
$hash2 = “ff49a673aac7c53a31e5aec7c6ea3f6aac010b05”
$hash3 = “d1ae811c82f2ecc7d3ca7cb7fbbcd13b”
$s1 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\common\\srvinst.exe\” uninstall”
$s2 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\common\\srvinst.exe uninstall”
$s3 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\x64\\setupdrv.exe\” uninstall”
$s4 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\x64\\setupdrv.exe uninstall”
$s5 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding”
$s6 = “C:\\Windows\\system32\\msiexec.exe /V”
$s7 = “C:\\Windows\\System32\\svchost.exe -k netsvcs -p”
$s8 = “C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\” /svc”
$s9 = “C:\\Windows\\System32\\svchost.exe -k NetworkService -p”
$s10 = “C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup”
$s11 = “C:\\Windows\\system32\\sppsvc.exe”
$s12 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc”
$s13 = “C:\\Windows\\system32\\lsass.exe”
$s14 = “C:\\Windows\\system32\\svchost.exe -k LocalService -s W32Time”
$s15 = “C:\\Windows\\syswow64\\MsiExec.exe -Embedding
07A0B8A102D781B0459FF77892C69F91”
$s16 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rfusclient.exe\” -msi_copy
\”C:\\Users\\<USER>\\Desktop\\database.msi”
$s17 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rutserv.exe\” /silentinstall”
$s18 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rutserv.exe\” -firewall”
$s19 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rutserv.exe\” /printerinstall”
$s20 = “madExceptSettingsMtx$133c”
$s21 = “_MSIExecute”
$s22 = “madExceptSettingsMtx$534”
$s23 = “madExceptSettingsMtx$a20”
$s24 = “RuRAT”
condition:
any of ($hash*) or 2 of ($s*)
}
Recommendations
Strategic Recommendations
Management Recommendations
Key Intelligence Signals:
ShinyHunters: Evolving Tactics for Enterprise Data Theft and Extortion
About the Threat Actor
ShinyHunters is a financially motivated cybercriminal group linked to multiple high-profile data breaches involving the theft and unauthorized exposure of sensitive information. The group is known for monetizing stolen data through underground cybercriminal marketplaces and dark web forums.
ShinyHunters members have operated jointly with Scattered Spider and LAPSUS$ members under the “Scattered LAPSUS$ Hunters” persona since August 2025, and all three are associated with the cybercriminal network known as The Com (high confidence). The degree of coordination between individual intrusion clusters using the brand is unclear; Mandiant tracks them separately.
Details on Exploited Vulnerabilities
| CVE ID | Affected Products | CVSS Score | Exploit Links |
| CVE-2025-10725 | Red Hat OpenShift AI | 9.9 | – |
| CVE-2025-23297 | NVIDIA Installer for NvAPP for Windows | 7.8 | – |
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) | 9.8 | – |
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) | 9.8 | – |
TTPs based on the MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1595.002 | Active Scanning: Vulnerability Scanning |
| Reconnaissance | T1589.001 | Gather Victim Identity Information: Credentials |
| Reconnaissance | T1598 | Phishing for Information |
| Reconnaissance | T1598.003 | Phishing for Information: Spear phishing Link |
| Reconnaissance | T1593.003 | Search Open Websites/Domains: Code Repositories |
| Resource Development | T1583.001 | Acquire Infrastructure: Domains |
| Resource Development | T1583.004 | Acquire Infrastructure: Server |
| Resource Development | T1587.004 | Develop Capabilities: Exploits |
| Resource Development | T1585.002 | Establish Accounts: Email Accounts |
| Resource Development | T1588.007 | Obtain Capabilities: Artificial Intelligence |
| Resource Development | T1588.002 | Obtain Capabilities: Tool |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Initial Access | T1195.001 | Supply Chain Compromise: Compromise Software Dependencies and Development Tools |
| Initial Access | T1078 | Valid Accounts |
| Initial Access | T1078.004 | Valid Accounts: Cloud Accounts |
| Initial Access | T1078.002 | Valid Accounts: Domain Accounts |
| Execution | T1059.009 | Command and Scripting Interpreter: Cloud API |
| Execution | T1059.007 | Command and Scripting Interpreter: JavaScript |
| Execution | T1203 | Exploitation for Client Execution |
| Execution | T1072 | Software Deployment Tools |
| Persistence | T1098.001 | Account Manipulation: Additional Cloud Credentials |
| Persistence | T1078 | Valid Accounts |
| Persistence | T1078.004 | Valid Accounts: Cloud Accounts |
| Persistence | T1078.002 | Valid Accounts: Domain Accounts |
| Privilege Escalation | T1078 | Valid Accounts |
| Privilege Escalation | T1078.004 | Valid Accounts: Cloud Accounts |
| Privilege Escalation | T1078.002 | Valid Accounts: Domain Accounts |
| Stealth | T1078 | Valid Accounts |
| Stealth | T1078.004 | Valid Accounts: Cloud Accounts |
| Stealth | T1078.002 | Valid Accounts: Domain Accounts |
| Stealth | T1036.005 | Masquerading: Match Legitimate Resource Name or Location |
| Stealth | T1684 | Social Engineering |
| Credential Access | T1528 | Steal Application Access Token |
| Credential Access | T1552.001 | Unsecured Credentials: Credentials In Files |
| Credential Access | T1110 | Brute Force |
| Discovery | T1580 | Cloud Infrastructure Discovery |
| Discovery | T1619 | Cloud Storage Object Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1069.003 | Permission Groups Discovery: Cloud Groups |
| Discovery | T1018 | Remote System Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1016 | System Network Configuration Discovery |
| Lateral Movement | T1550.001 | Use Alternate Authentication Material: Application Access Token |
| Lateral Movement | T1210 | Exploitation of Remote Services |
| Lateral Movement | T1072 | Software Deployment Tools |
| Collection | T1213.003 | Data from Information Repositories: Code Repositories |
| Collection | T1530 | Data from Cloud Storage |
| Collection | T1560.002 | Archive Collected Data: Archive via Library |
| Collection | T1213.006 | Data from Information Repositories: Databases |
| Command and Control | T1573.002 | Encrypted Channel: Asymmetric Cryptography |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1090.003 | Proxy: Multi-hop Proxy |
| Command and Control | T1219 | Remote Access Tools |
| Exfiltration | T1567 | Exfiltration Over Web Service |
| Impact | T1485 | Data Destruction |
| Impact | T1491.001 | Defacement: Internal Defacement |
| Impact | T1657 | Financial Theft |
Latest Developments Observed
ShinyHunters, a financially motivated data theft and extortion group, continued its operations despite recent arrests, with its leak site reportedly listing new claimed victims on October 1, 2026. Dutch police arrested a 24-year-old Amsterdam man on September
15 on suspicion of involvement in the group, while a second suspect was reportedly detained in Jordan on September 29. The FBI announced a further arrest of a suspected co-conspirator on October 9 and alleged that the group and its co-conspirators had breached more than 140 organizations and obtained at least $70 million in extortion payments. The group’s recent operations have involved help desk voice phishing, credential theft, unauthorized MFA registration, SaaS data exfiltration, and exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273. However, no public charges had been announced for the 2026 arrests, and the FBI had not publicly tied any arrest to the group’s claimed FBI breach, although the New York Times reported that the October 9 arrest was of a suspected co-conspirator in that intrusion.
ETLM Insights
ShinyHunters continues to demonstrate an adaptive, financially motivated operational model centered on identity compromise, large-scale data theft, and extortion. Its recent activity highlights a strong reliance on help desk impersonation, voice phishing, and abuse of SSO and SaaS authentication workflows, alongside the exploitation of vulnerable internet-facing systems. The continued use of the ShinyHunters brand despite arrests indicates the potential for its operations to persist beyond individual disruptions.
The threat actor’s activities demonstrate:
Looking ahead, ShinyHunters is likely to further refine social engineering and identity-based intrusion techniques while continuing to target enterprise authentication workflows and SaaS environments. The combination of data theft, extortion, and a persistent group brand may enable ShinyHunters-associated operations to continue despite disruptions to individual members.
YARA Rules
import “hash”
rule WEBSHELL_JSP_UNC6240_PeopleSoft_UJSP_Stager
{
meta:
description = “Detects the u.jsp chunked upload and execution stager used to build Ple64.exe after CVE-2026-35273 exploitation (UNC6240 / ShinyHunters)”
note = “May also match the u2.jsp offset-based variant; its code was not published, so this is untested”
author = “CYFIRMA” date = “2026-10-13”
reference = “https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft”
hash =
“2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7”
strings:
$jsp = “<%@ page import=” ascii
$w = “out.print(\”W:\” + b.length)” ascii
$s1 = “out.print(\”X:\” + e)” ascii
$s2 = “out.print(\”E:\” + e)” ascii
$s3 = “java.util.Base64.getDecoder().decode(a)” ascii
$s4 = “new java.io.FileOutputStream(n, true)” ascii
$s5 = “request.getParameter(\”x\”)” ascii
condition:
filesize < 20KB and $jsp and $w and 2 of ($s*)
}
rule WEBSHELL_JSP_UNC6240_PeopleSoft_XJSP
{
meta:
description = “Detects the x.jsp command web shell dropped under PSEMHUB.war after exploitation of Oracle PeopleSoft CVE-2026-35273 (UNC6240 / ShinyHunters)”
author = “CYFIRMA” date = “2026-10-13”
reference = “https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft”
hash =
“48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494” note = “Published hash varies with line endings; strings below survive that”
scan_path =
“<PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/ and PORTAL.war/”
strings:
$jsp = “<%@ page import=” ascii
$s1 = “new char[]{47,98,105,110,47,115,104}” ascii // “/bin/sh” built from char codes
$s2 = /Integer\.parseInt\(h\.substring\(i,\s*i\s*\+\s*2\),\s*16\)/ // hex-decodes the command in parameter c
$s3 = “out.print(\”R:\” + sb.toString())” ascii
$s4 = “request.getParameter(\”c\”)” ascii
condition:
filesize < 20KB and $jsp and $s1 and 2 of ($s2, $s3, $s4)
}
Recommendations
Strategic Recommendations
Management Recommendations
Tactical Recommendations
US Disrupts China-linked Hacking Tools
The U.S. Department of Justice and the FBI announced the seizure of domains operated by China-aligned threat group Flax Typhoon to run two malicious hacking tools, “Microscan” and “FishHub.” Authorities linked the state-sponsored actor to Beijing-based cybersecurity firm Integrity Technology Group, a known contractor for the Chinese government.
Microscan, a vulnerability scanner distributed through a Mirai botnet variant, targeted critical infrastructure and organizations globally, including a U.S. power company, a multinational NGO, airports in Japan and Poland, and energy entities in Taiwan. Meanwhile, the FishHub spear-phishing platform facilitated network breaches across roughly 20 Taiwanese universities.
ETLM Assessment:
Flax Typhoon (also tracked as Ethereal Panda or Storm-0919) is a state-sponsored Chinese cyber espionage cluster active since at least 2021, primarily focused on establishing long-term, covert persistence within critical infrastructure, government agencies, and education sectors across Taiwan and allied nations. Unlike threat actors that deploy noisy custom malware, Flax Typhoon relies heavily on “living-off-the-land” (LotL) techniques – exploiting known vulnerabilities in public-facing servers to deploy web shells, leveraging built-in Windows administration tools, and installing legitimate VPN software to maintain stealthy remote access. Tied directly to Beijing-based contractor Integrity Technology Group, the group’s infrastructure has been the target of major U.S. law enforcement takedowns, including a September 2024 operation that dismantled its 250,000-device Mirai-based botnet. The recent domain seizures of its “Microscan” vulnerability scanner and “FishHub” spear-phishing platforms sever critical command-and-control capabilities for a group whose primary mission remains pre-positioning and intelligence gathering against Western and Taiwanese targets.
Wave of Cyberattacks Targeting Japan
A recent wave of cyberattacks has struck Japanese organizations, prompting the government to urge widespread security reviews as artificial intelligence lowers the threshold for sophisticated hacking. Researchers’ data revealed a sharp spike in breaches through September – including a single-day peak of 13 incidents – hitting prominent entities such as SoftBank unit IDC Frontier, Daiwa Securities, and the Japan Atomic Energy Agency. The fallout has been substantial, with car-rental operator Times exposing 6.6 million member records and cloud provider Rakuten Drive suffering unauthorized access to 15,000 accounts. In response, the Finance Ministry and the Financial Services Agency directed financial institutions to audit third-party risks and bolster identity verification protocols.
ETLM Assessment:
The escalating threats coincide with the rapid proliferation and commodification of AI-driven cybercrime tools. Security experts highlight that accessible open-weight models and low-cost tools enable even inexperienced actors to execute complex operations, using automated AI agents to handle tedious tasks like managing attack tools and probing for system vulnerabilities. Analysts warning of future trajectory note that while recent intrusions primarily focused on data theft, ransomware, and supply-chain disruption, foreign threat actors may be actively probing the boundaries of Japan’s active cyber defense capabilities – laying the groundwork for far more destructive future campaigns.
Qilin Ransomware Impacts a Construction Company from Japan
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by Qilin Ransomware. The compromised company is a Japanese construction-materials and logistics group based in Saitama, Japan. The ransomware attack has resulted in the exposure or compromise of sensitive corporate information, including internal business documents, operational records, financial data, employee information, customer and supplier details, and confidential project-related files.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and a focus on speed and evasion, make it a particularly dangerous actor.
The Gentlemen Ransomware Impacts a Manufacturing Company from Taiwan
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Taiwan was compromised by The Gentlemen Ransomware. The compromised company is a Taiwan-based ODM/OEM manufacturer founded in 1965, headquartered in New Taipei City, and one of the world’s leading producers of digital imaging and optical camera products. The company designs and manufactures camera modules, action cameras, Edge AI webcams, automotive cameras, and security/surveillance systems for global brands, with factories in Taiwan, China (Dongguan), and Vietnam. Roughly half of its workforce is in R&D, and the company holds 42 patents from the last three years, focusing on AI vision, 3D ToF, and robotics. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in Openfind SecuShare Pro
Relevancy & Insights:
The flaw affects the SecuShare Pro server, where an unauthenticated attacker may execute operating system commands remotely. Internet-accessible deployments could face elevated exposure.
Impact:
Successful exploitation could allow an unauthenticated attacker to execute commands on the server, potentially resulting in data exposure, unauthorized system changes, or disruption of file-sharing services.
Affected Products:
Recommendations:
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment:
The vulnerability in Openfind SecuShare Pro v4 presents a critical security risk to organizations using the affected enterprise file-sharing platform. The OS command injection flaw allows a network-reachable unauthenticated attacker to execute arbitrary commands on the server, potentially compromising sensitive information, altering system configuration, or disrupting services. Although the reviewed advisory does not confirm active exploitation, the lack of authentication requirements increases the risk to exposed deployments. Organizations using affected versions should prioritize applying the appropriate vendor-provided security updates, restrict unnecessary external access to vulnerable services, and monitor server and application logs for suspicious activity. Prompt remediation and continuous monitoring are recommended to reduce the risk of unauthorized command execution, data compromise, and disruption of business operations.
Krybit Ransomware attacked and published the data of a Manufacturing company from India
Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a Manufacturing company from India on its dark web website. The compromised company is a leading Indian public limited company incorporated on May 9, 1988, headquartered in Ahmedabad, Gujarat, India, specializing in the manufacturing and export of high-quality stainless steel and nickel alloy wires, bright bars, TIG/MIG welding wires, reinforcement bars, and profiles. With over 30 years of experience and an annual production capacity exceeding 42,000 tonnes, it exports 75% of its production to more than 60 countries worldwide, with a global presence across the USA, Canada, Italy, Germany, the UK, Indonesia, South Korea, and China. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of the compromised data is approximately 203.54 GB.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
Alleged Corporate Data Advertised on a Leak Site
Summary
The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of a large volume of data allegedly associated with a major corporate group based in Saudi Arabia. According to the forum advertisement, the seller claims to possess approximately 310 GB of data comprising more than 320,000 files, reportedly covering multiple business activities and internal organizational records.
Based on the information presented in the advertisement, the allegedly exposed dataset may contain the following information:
The claims regarding the dataset size, contents, and availability are based on the information presented in the cybercrime forum advertisement. The authenticity of the data, the validity of the reported records, and the extent of any compromise have not been independently verified.
Source: Underground Forums
Alleged 75 GB Corporate Data Advertised on a Leak Site
Summary:
The CYFIRMA research team identified a post on a cybercrime forum advertising an alleged data leak involving an Indian automotive manufacturing organization. According to the forum post, approximately 75 GB of data has reportedly been leaked. The advertisement includes a reference to the automotive manufacturing sector and claims an association with the organization’s corporate domain. However, the post does not disclose the specific categories of compromised data, the number of affected records, or the method through which the data was allegedly obtained.
Based on the available information, the following observations can be made:
The reported 75 GB data leak is based on the visible cybercrime forum advertisement. The authenticity of the dataset, the nature of the allegedly compromised information, and the extent of any security incident have not been independently verified. The specific data categories and attack methods remain undetermined based on the available evidence.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure.
Recommendations:
Enhance the cybersecurity posture by:
The CYFIRMA research team identified a post on a cybercrime forum advertising a large dataset allegedly containing sensitive financial, personal, and corporate information associated with organizations and individuals in the United Arab Emirates (UAE). The seller claims to possess approximately 65 GB of data, while the post title references 64 GB. According to the advertisement, the dataset reportedly includes banking credentials, government portal accounts, identity documents, employee information, financial records, and corporate administrative documents.
Based on the information presented in the forum post, the allegedly exposed data may include:
The forum post claims possession of the data and references sample material as evidence. However, the available screenshot does not independently establish the authenticity, completeness, or precise origin of the advertised dataset.
Potential Business Impact
This assessment is based on the information visible in the cybercrime forum advertisement. The reported dataset size, listed information categories, and claims of exposed credentials have not been independently verified. The actual number of affected individuals and organizations, the validity of the credentials, and the extent of any compromise remain undetermined.
Source: Underground Forums
RECOMMENDATIONS
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.
