CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Introduction:
CYFIRMA Research and Advisory Team has found Orexin Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
Orexin Ransomware
Orexin is a ransomware strain that encrypts files on an infected system and renames them by appending a victim-specific identifier, an attacker-controlled email address, and the .orexin extension. For example, a file such as 1.jpg may be renamed to 1.jpg-[id][email].orexin. Following encryption, the malware creates a ransom note named HOW_TO_RECOVER.txt and modifies the desktop wallpaper to display recovery instructions and warnings against attempting independent decryption.
Screenshot: File encrypted by the ransomware (Source: Surface Web)
The ransom note states that the victim’s files have been encrypted and claims that recovery is only possible by obtaining a unique private decryption key from the attackers. It warns that renaming files or using third-party recovery software could permanently damage the encrypted data. The note instructs victims to contact the attackers through an email address or Telegram handle and offers to decrypt one non-valuable file for free as proof that the attackers possess a working decryptor.
Screenshot: The appearance of GINES’s Ransom Note (Source: Surface Web)
From a recovery and response perspective, removing the ransomware can prevent further file encryption but does not restore files that have already been encrypted. Successful recovery generally depends on the availability of clean backups created before the infection, as ransomware encryption may not be practically reversible without the corresponding decryption key. Paying the ransom is not recommended because attackers may fail to provide a functional decryptor even after payment. Maintaining offline or otherwise isolated backups in multiple locations is therefore an important mitigation against data loss from ransomware incidents.
Screenshot: The appearance of Orexin’s wallpaper
The following are the TTPs based on the MITRE Attack Framework
| Tactic | Technique ID | Technique Name |
| Initial Access | T1091 | Replication Through Removable Media |
| Execution | T1059 | Command and Scripting Interpreter |
| Execution | T1569.002 | System Services: Service Execution |
| Persistence | T1112 | Modify Registry |
| Persistence | T1543.003 |
Create or Modify System Process: Windows Service |
| Persistence | T1547.001 |
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1543.003 |
Create or Modify System Process: Windows Service |
| Privilege Escalation | T1547.001 |
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1548 | Abuse Elevation Control Mechanism |
| Credential Access | T1003 | OS Credential Dumping |
| Credential Access | T1552.001 |
Unsecured Credentials: Credentials In Files |
| Discovery | T1012 | Query Registry |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1120 | Peripheral Device Discovery |
| Discovery | T1497 | Virtualization/Sandbox Evasion |
| Lateral Movement | T1091 | Replication Through Removable Media |
| Collection | T1005 | Data from Local System |
| Collection | T1074 | Data Staged |
| Collection | T1114 | Email Collection |
| Collection | T1560 | Archive Collected Data |
| Command and Control | T1071 | Application Layer Protocol |
| Impact | T1485 | Data Destruction |
| Impact | T1486 | Data Encrypted for Impact |
| Impact | T1490 | Inhibit System Recovery |
| Stealth | T1027.002 |
Obfuscated Files or Information: Software Packing |
| Stealth | T1036 | Masquerading |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1497 | Virtualization/Sandbox Evasion |
| Defense Impairment | T1112 | Modify Registry |
Relevancy and Insights:
ETLM Assessment:
Orexin will likely evolve from straightforward, file-locking payloads into modular, AI-assisted threat engines designed to bypass modern Endpoint Detection and Response (EDR) platforms. Rather than relying on basic file extension renames (.orexin) and static desktop wallpaper modifications, future variants will prioritize early-stage stealth through living-off-the-land techniques using legitimate administrative tools and stolen credentials to blend into normal network traffic before triggering encryption. Furthermore, as organizations increasingly adopt immutable backups to neutralize standard file-encryptors, Orexin’s operators will shift toward targeting backup architecture directly, using time-delayed payloads and cloud-snapshot manipulation to ensure restore points are silently corrupted long before any ransom note appears.
Beyond technical upgrades to the payload, Orexin’s operational model will almost certainly pivot toward multi-extortion and data-exfiltration schemes. Operators will focus heavily on exfiltrating sensitive internal data to dedicated dark web leak sites prior to encrypting local systems, shifting the primary pressure point from system recovery to the threat of public data exposure and regulatory penalties. Coupled with the growth of the Ransomware-as-a-Service (RaaS) ecosystem, future iterations will likely leverage automated zero-day discovery tools and credential-harvesting networks to execute rapid, multi-stage attacks across entire software supply chains and remote access infrastructure.
Sigma rules:
title: New RUN Key Pointing to Suspicious Folder tags:
– attack.privilege-escalation
– attack.persistence
– attack.t1547.001 logsource:
category: registry_set product: windows
detection: selection_target:
TargetObject|contains:
– ‘\Software\Microsoft\Windows\CurrentVersion\Run’
– ‘\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run’
– ‘\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run’ selection_suspicious_paths_1:
Details|contains:
– ‘:\Perflogs’
– :\ProgramData’
– ‘:\Windows\Temp’
– ‘:\Temp’
– ‘\AppData\Local\Temp’
– ‘\AppData\Roaming’
– ‘:\$Recycle.bin’
– ‘:\Users\Default’
– ‘:\Users\public’
– ‘%temp%’
– ‘%tmp%’
– ‘%Public%’
– ‘%AppData%’ selection_suspicious_paths_user_1:
Details|contains: ‘:\Users\’ selection_suspicious_paths_user_2:
Details|contains:
– ‘\Favorites’
– ‘\Favourites’
– ‘\Contacts’
– ‘\Music’
– ‘\Pictures’
– ‘\Documents’
– ‘\Photos’
filter_main_windows_update:
TargetObject|contains: ‘\Microsoft\Windows\CurrentVersion\RunOnce\’ Image|startswith: ‘C:\Windows\SoftwareDistribution\Download\’ Details|contains|all:
– ‘rundll32.exe ‘
– ‘C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32’ Details|contains:
– ‘\AppData\Local\Temp\’
– ‘C:\Windows\Temp\’ filter_optional_spotify:
Image|endswith:
– ‘C:\Program Files\Spotify\Spotify.exe’
– ‘C:\Program Files (x86)\Spotify\Spotify.exe’
– ‘\AppData\Roaming\Spotify\Spotify.exe’ TargetObject|endswith:
‘SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify’
Details|endswith: ‘Spotify.exe –autostart –minimized’
condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
– Software using weird folders for updates level: high
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Type: Information Stealer |Objectives: Credential Theft/ Data Exfiltration | Target Technology: Windows| Target Geography: Global
CYFIRMA collects data from various forums, based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
This week, “VeilStealer” Malware is in focus.
Overview of Operation VeilStealer Malware
VeilStealer is a credential-focused information stealer that prioritizes the silent collection of sensitive user data while maintaining a low operational profile on compromised Windows systems. Instead of disrupting the victim’s environment, the malware is designed to quietly gather valuable information that can be exploited for financial fraud, account takeover, or unauthorized access to enterprise resources. Its emphasis on stealth enables attackers to prolong the compromise and maximize the usefulness of harvested data before the infection is discovered. The analysed sample also demonstrates mechanisms for persistence and data staging, highlighting its intent to continue operating beyond the initial execution.
The malware exhibits a structured workflow that combines reconnaissance, data collection, and exfiltration into a coordinated operation. It targets information stored across multiple user applications and local resources, reflecting a broad objective of acquiring credentials, personal documents, browser artifacts, and other sensitive assets from a single infected endpoint. Rather than relying on destructive payloads, it is designed to extract as much intelligence as possible from the victim’s digital environment, allowing threat actors to leverage the stolen information for subsequent malicious activities.
A distinguishing characteristic of this stealer is its effort to blend malicious activity with legitimate system behavior. By utilizing native Windows components and maintaining a relatively discreet execution flow, the malware minimizes obvious indicators that could alert users during the infection process. This operational approach demonstrates an increasing preference among modern cybercriminals for covert data theft campaigns that emphasize persistence, efficiency, and reduced visibility rather than immediate impact.
Overall, stealers reflect the continued evolution of information-stealing malware into a comprehensive intelligence-gathering tool capable of compromising both personal and organizational data. Its ability to collect a wide range of information from a single endpoint increases the potential consequences of a successful infection, making it a significant threat not only to individual users but also to enterprises where stolen credentials and sensitive documents can facilitate broader security incidents.
Attack Method
The infection chain begins with the execution of multiple PowerShell commands configured to bypass standard execution policy restrictions, allowing the payload to be deployed without requiring additional user interaction. The malware copies its primary executable to a concealed location within the user profile and establishes persistence by creating an autorun entry in the Windows Run registry key. To reduce the likelihood of detection, it incorporates several anti-analysis techniques, including debugger detection, virtual machine awareness, execution delays, and obfuscated code, enabling the malware to evade automated sandbox environments and security monitoring solutions during the initial stages of compromise.
Once execution is established, the malware conducts extensive reconnaissance to profile the compromised environment. It enumerates operating system details, user information, installed software, running processes, network configurations, and security-related settings while querying multiple Windows registry locations for additional host-specific information. This reconnaissance phase provides the attacker with a comprehensive understanding of the victim’s environment and enables subsequent data collection activities to be tailored to the available resources and applications.
Following reconnaissance, the malware systematically collects sensitive information from a broad range of applications and local storage locations. It extracts browser credentials, cookies, browsing history, autofill records, and encryption key material from Chromium-based browsers, Microsoft Edge, and Mozilla Firefox. In addition, it captures desktop screenshots, gathers detailed system information, and searches for locally stored documents that may contain financial records, business information, cryptocurrency-related assets, or other sensitive user data. The harvested information is consolidated into temporary staging directories before being prepared for transmission to the attacker’s infrastructure.
After completing the collection phase, the malware establishes encrypted communication with attacker-controlled servers to exfiltrate the aggregated data. It subsequently removes selected temporary files and intermediate artifacts to minimize forensic evidence while maintaining its persistence mechanism for future execution. The coordinated use of persistence, host reconnaissance, anti-analysis capabilities, encrypted communications, staged data aggregation, and artifact cleanup demonstrates a mature and well-structured information-stealing framework designed to maximize data collection while maintaining a low operational profile on compromised Windows systems.
The following are the TTPs based on the MITRE ATT&CK Framework for Enterprises
| Tactic | Technique | Technique Name |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1204.002 | User Execution: Malicious File |
| Persistence | T1547.001 | Boot or Logon AutoStart Execution: Registry Run Keys / Startup Folder |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1497 | Virtualization/Sandbox Evasion |
| Stealth | T1070.004 | Indicator Removal on Host: File Deletion |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1012 | Query Registry |
| Discovery | T1016 | System Network Configuration Discovery |
| Collection | T1005 | Data from Local System |
| Collection | T1213 | Data from Information Repositories |
| Credential Access | T1555.003 | Credentials from Password Stores: Credentials from Web Browsers |
| Credential Access | T1555 | Credentials from Password Stores |
| Credential Access | T1539 | Steal Web Session Cookie |
| Credential Access | T1552.001 | Unsecured Credentials: Credentials in Files |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1573 | Encrypted Channel |
INSIGHTS
ETLM ASSESSMENT
From an ETLM Perspective, the continued advancement of information-stealing malware such as VeilStealer is expected to reinforce a threat landscape where digital identities become the primary target for financially motivated threat actors. As organizations increasingly adopt cloud-based platforms, remote work models, and interconnected business ecosystems, compromised employee credentials are likely to become a preferred entry point for broader intrusion campaigns. This evolving trend may result in a growing number of attacks that leverage stolen identities to access enterprise resources, third-party services, and sensitive business information. Consequently, information stealers are anticipated to play an increasingly significant role as enabling tools for credential abuse, account compromise, business fraud, and subsequent cyber operations, amplifying the overall risk exposure for organizations across multiple industry sectors.
IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)
YARA Rules
rule MAL_VeilStealer_Win32
{
meta:
description = “Detects VeilStealer information stealer” author = “CYFIRMA”
date = “2026-07-17”
strings:
/* PowerShell Execution */
$ps1 = “powershell.exe” ascii nocase
$ps2 = “-ExecutionPolicy Bypass” ascii nocase
$ps3 = “-NoProfile” ascii nocase
$ps4 = “-WindowStyle Hidden” ascii nocase
/* Persistence */
$reg1 = “Software\\Microsoft\\Windows\\CurrentVersion\\Run” ascii wide
$reg2 = “CurrentVersion\\Run” ascii wide
/* Browser Targets */
$b1 = “Login Data” ascii wide
$b2 = “Local State” ascii wide
$b3 = “Cookies” ascii wide
$b4 = “Web Data” ascii wide
$b5 = “History” ascii wide
$b6 = “Mozilla\\Firefox” ascii wide
$b7 = “Microsoft\\Edge” ascii wide
$b8 = “Google\\Chrome” ascii wide
/* Anti-analysis */
$a1 = “IsDebuggerPresent” ascii
$a2 = “CheckRemoteDebuggerPresent” ascii
$a3 = “Sleep” ascii
/* Network */
$n1 = “WinHttpOpen” ascii
$n2 = “WinHttpSendRequest” ascii
$n3 = “WinHttpReceiveResponse” ascii
/* Sample Hashes */
$hash1 = “ff99e0fbf4bffe07738630833155fccb0775deb29cf8e0d02a5019362072a9f5”
$hash2 = “7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f”
$hash3 = “cf07f33f8727b3dc4b1d956b2a5e24a487470a8d74d2558c37249eca53976ba5”
$hash4 = “42dd676a77e7fdcf2da653c4150ed2b339ce062fb91e5ff7e7a1f2b1c5e32f44”
$hash5 = “4b660a310fc1125a079f8154a86edd0d43501edbbc4bc759dd55f1d4fd0c6d40”
$hash6 = “d93d3701b17598fdf244e0eec2a87a13902baadde7c2c9253d60566215ef6df2”
$hash7 = “37f9de776d211aead04a1e54f2a5d8b453a1a51d1e906f3f4306868ac31501e1”
$hash8 = “d302ba5778fac5bb12d82810958c2136d2b86c0267499075e4d947c97b4940a0”
condition:
uint16(0) == 0x5A4D and (
any of ($hash*) or (
3 of ($b*) and
1 of ($reg*) and 1 of ($ps*) and 1 of ($a*) and
1 of ($n*)
)
)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Key Intelligence Signals:
Sandworm Adopts ClickFix Social Engineering to Enhance Cyber Espionage Operations
About the Threat Actor
Sandworm (also tracked as TeleBots, SandStorm, and Electrum) is a Russia-linked state-sponsored threat actor assessed to be directly affiliated with Russia’s GRU (General Staff Main Intelligence Directorate), specifically the Main Center for Special Technologies (GTsST), Military Unit 74455. The group is widely assessed to have been responsible for the NotPetya ransomware attack (also known as ExPetr and PetrWrap). Its activities were first publicly observed in December 2016, when it targeted Ukrainian financial institutions and critical infrastructure. Sandworm is also believed to maintain close operational ties with the BlackEnergy group, which was linked to the disruptive cyberattacks that caused power outages in Ukraine in 2015.
Details on Exploited Vulnerabilities
| CVE ID | Affected Products |
CVSS Score |
ExploitLinks |
| CVE-2024-7344 | Howyar UEFI Application | 8.2 | – |
| CVE-2023-34362 | MOVEit Transfer | 9.8 | Link1, Link2 |
| CVE-2022-30190 | MSDT | 7.8 | Link1 |
| CVE-2021-26855 | Microsoft Exchange Server | 9.8 | Link1, Link2, Link3, Link4 |
| CVE-2025-0282 | Ivanti Connect Secure | 9.0 | – |
| CVE-2021-26858 | Microsoft Exchange Server | 7.8 | – |
TTPs based on the MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1592.002 | Gather Victim Host Information: Software |
| Reconnaissance | T1595.002 | Active Scanning: Vulnerability Scanning |
| Reconnaissance | T1589.002 | Gather Victim Identity Information: Email Addresses |
| Reconnaissance | T1589.003 | Gather Victim Identity Information: Employee Names |
| Reconnaissance | T1590.001 | Gather Victim Network Information: Domain Properties |
| Reconnaissance | T1591.002 | Gather Victim Org Information: Business Relationships |
| Reconnaissance | T1598.003 | Phishing for Information: Spear Phishing Link |
| Reconnaissance | T1593 | Search Open Websites/Domains |
| Reconnaissance | T1594 | Search Victim-Owned Websites |
| ResourceDevelopment | T1583 | Acquire Infrastructure |
| ResourceDevelopment | T1583.001 | Acquire Infrastructure: Domains |
| ResourceDevelopment | T1583.004 | Acquire Infrastructure: Server |
| ResourceDevelopment | T1586.001 | Compromise Accounts: Social Media Accounts |
| ResourceDevelopment | T1584.004 | Compromise Infrastructure: Server |
| ResourceDevelopment | T1584.005 | Compromise Infrastructure: Botnet |
| ResourceDevelopment | T1587.001 | Develop Capabilities: Malware |
| ResourceDevelopment | T1585.001 | Establish Accounts: Social Media Accounts |
| ResourceDevelopment | T1585.002 | Establish Accounts: Email Accounts |
| ResourceDevelopment | T1588.002 | Obtain Capabilities: Tool |
| ResourceDevelopment | T1588.006 | Obtain Capabilities: Vulnerabilities |
| ResourceDevelopment | T1608.001 | Stage Capabilities: Upload Malware |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Initial Access | T1133 | External Remote Services |
| Initial Access | T1195 | Supply Chain Compromise |
| Initial Access | T1195.002 | Supply Chain Compromise: Compromise Software Supply Chain |
| Initial Access | T1199 | Trusted Relationship |
| Initial Access | T1078 | Valid Accounts |
| Initial Access | T1078.002 | Valid Accounts: Domain Accounts |
| Initial Access | T1566.001 | Phishing: Spear Phishing Attachment |
| Initial Access | T1566.002 | Phishing: Spear Phishing Link |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Execution | T1059.005 | Command and Scripting Interpreter: Visual Basic |
| Execution | T1106 | Native API |
| Execution | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Execution | T1072 | Software Deployment Tools |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1204.001 | User Execution: Malicious Link |
| Execution | T1203 | Exploitation for Client Execution |
| Execution | T1204.002 | User Execution: Malicious File |
| Persistence | T1098 | Account Manipulation |
| Persistence | T1554 | Compromise Host Software Binary |
| Persistence | T1136 | Create Account |
| Persistence | T1136.002 | Create Account: Domain Account |
| Persistence | T1543.002 | Create or Modify System Process: Systemd Service |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Persistence | T1133 | External Remote Services |
| Persistence | T1112 | Modify Registry |
| Persistence | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Persistence | T1505.003 | Server Software Component: Web Shell |
| Persistence | T1505.001 | Server Software Component: SQL Stored Procedures |
| Persistence | T1078 | Valid Accounts |
| Persistence | T1078.002 | Valid Accounts: Domain Accounts |
| Privilege Escalation | T1098 | Account Manipulation |
| Privilege Escalation | T1543.002 | Create or Modify System Process: Systemd Service |
| Privilege Escalation | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1055 | Process Injection |
| Privilege Escalation | T1484.001 | Domain or Tenant Policy Modification: Group Policy Modification |
| Privilege Escalation | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Privilege Escalation | T1078 | Valid Accounts |
| Privilege Escalation | T1078.002 | Valid Accounts: Domain Accounts |
| Stealth | T1078 | Valid Accounts |
| Stealth | T1078.002 | Valid Accounts: Domain Accounts |
| Stealth | T1140 | Deobfuscate/Decode Files or Information |
| Stealth | T1218.011 | System Binary Proxy Execution: Rundll32 |
| Stealth | T1055 | Process Injection |
| Stealth | T1036.010 | Masquerading: Masquerade Account Name |
| Stealth | T1027.010 | Obfuscated Files or Information: Command Obfuscation |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1036 | Masquerading |
| Stealth | T1036.004 | Masquerading: Masquerade Task or Service |
| Stealth | T1036.005 | Masquerading: Match Legitimate Resource Name or Location |
| Stealth | T1036.008 | Masquerading: Masquerade File Type |
| DefenseImpairment | T1112 | Modify Registry |
| DefenseImpairment | T1685 | Disable or Modify Tools |
| DefenseImpairment | T1685.001 | Disable or Modify Tools: Disable or Modify Windows Event Log |
| DefenseImpairment | T1484.001 | Domain or Tenant Policy Modification: Group Policy Modification |
| CredentialAccess | T1555.003 | Credentials from Password Stores: Credentials from Web Browsers |
| CredentialAccess | T1539 | Steal Web Session Cookie |
| CredentialAccess | T1110 | Brute Force |
| CredentialAccess | T1056.001 | Input Capture: Keylogging |
| Credential Access | T1040 | Network Sniffing |
| Credential Access | T1003.003 | OS Credential Dumping: NTDS |
| Credential Access | T1003.001 | OS Credential Dumping: LSASS Memory |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1087.002 | Account Discovery: Domain Account |
| Discovery | T1087.003 | Account Discovery: Email Account |
| Discovery | T1040 | Network Sniffing |
| Discovery | T1018 | Remote System Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1049 | System Network Connections Discovery |
| Discovery | T1033 | System Owner/User Discovery |
| LateralMovement | T1072 | Software Deployment Tools |
| LateralMovement | T1570 | Lateral Tool Transfer |
| LateralMovement | T1021.002 | Remote Services: SMB/Windows Admin Shares |
| Collection | T1213.006 | Data from Information Repositories: Databases |
| Collection | T1005 | Data from Local System |
| Collection | T1056.001 | Input Capture: Keylogging |
| Command and Control | T1132.001 | Data Encoding: Standard Encoding |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1095 | Non-Application Layer Protocol |
| Command and Control | T1571 | Non-Standard Port |
| Command and Control | T1572 | Protocol Tunneling |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1090 | Proxy |
| Command and Control | T1219 | Remote Access Tools |
| Command and Control | T1102.002 | Web Service: Bidirectional Communication |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Impact | T1485 | Data Destruction |
| Impact | T1486 | Data Encrypted for Impact |
| Impact | T1491.002 | Defacement: External Defacement |
| Impact | T1561.002 | Disk Wipe: Disk Structure Wipe |
| Impact | T1499 | Endpoint Denial of Service |
| Impact | T1490 | Inhibit System Recovery |
| Impact | T1489 | Service Stop |
Latest Developments Observed
The threat actor is suspected of targeting government organizations, military personnel, and critical entities in Ukraine through a recent campaign leveraging ClickFix social engineering, compromised websites, and counterfeit security software as initial access vectors. The campaign deploys GHETTOVIBE, SCOUTCURL, FLUIDLEECH, LOADLOOP, FREAKYPOLL, SMARTAXE, and COWARDDUCK to establish persistent access, conduct reconnaissance, and exfiltrate sensitive information from Windows and Android devices.
ETLM Insights
Sandworm (also tracked as UAC-0002, UAC-0145, APT44, and Seashell Blizzard) is a Russia-linked state-sponsored threat actor assessed to operate in alignment with Russian strategic military and geopolitical objectives. The group is primarily engaged in cyber operations intended to support strategic intelligence collection, maintain operational access to high-value environments, and enable disruptive activities aligned with broader Russian interests.
Operationally, the threat actor demonstrates a structured intrusion methodology centered on social engineering, trusted software abuse, and compromised web resources to establish initial access. Its tradecraft reflects a strong reliance on reconnaissance-driven intrusion activity, modular malware deployment, and abuse of legitimate administrative utilities to sustain operational persistence while limiting defensive visibility.
The threat actor’s operations reflect a deliberate approach:
Based on the observed activity and operational trends, the threat actor is likely to continue refining its social engineering methodologies, trusted access techniques, and modular intrusion capabilities while strengthening its operational resilience against evolving defensive measures. This evolving operational model positions Sandworm as a persistent state-sponsored cyber threat capable of sustaining long-term intelligence collection and strategically aligned disruptive operations.
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems.
YARA Rules
rule IOC_Malware_Domain_File_Artifacts
{
meta:
description = “Detects malware samples containing observed IOC domains and file artifacts”
author = “CYFIRMA” date = “2026-07-20”
version = “1.0”
reference = “Based on extracted IOC indicators”
strings:
/* Domains */
$domain1 = “mariamchurch.com” ascii nocase
$domain2 = “multi-user.target” ascii nocase
$domain3 = “techzenspace.com” ascii nocase
$domain4 = “dattolocal.net” ascii nocase
$domain5 = “find-help.info” ascii nocase
/* File names */
$file1 = “hrrm3jvh9vc.dll” ascii nocase
$file2 = “abuse-ransomware.csv” ascii nocase
$file3 = “ransomware.csv” ascii nocase
/* File type indicators */
$type1 = “win32 exe” ascii nocase
$type2 = “mach-o” ascii nocase condition:
2 of ($domain*) or 2 of ($file*) or
(1 of ($domain*) and 1 of ($file*)) or (1 of ($domain*) and 1 of ($type*))
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Taiwan to hold internet disruption simulations in preparations for conflict with Beijing
Taiwan will simulate widespread mobile internet disruptions next month as part of expanding urban resilience drills designed to prepare for natural disasters and potential military conflict with China. National security officials confirmed that the test will temporarily throttle mobile data speeds in central Taiwan on August 10 and across northern regions, including Taipei, on August 13. While high-bandwidth activities like video streaming will be restricted during the 30-minute afternoon windows, voice calls, text messaging, and fixed-line broadband will remain fully operational.
The first-of-its-kind exercise aims to teach the public how to navigate communications outages and build emergency contact plans for reaching loved ones and locating shelters. As Beijing ramps up near-daily military pressure and refuses to rule out force against the island, Taiwanese officials are pushing to make civil defense exercises increasingly realistic. Officials noted that future drills may expand to simulate broader telecommunication blackouts alongside current efforts, which also focus on mass evacuations, expanding emergency medical capacity, and deploying drones for medical and supply deliveries.
ETLM Assessment:
Taiwan is a hot spot for increased Sino-American rivalry. China wants to reunite with Taiwan because it sees it as a colony gone wild. These days, there is some degree of relationship between the two regions, and they also depend on each other economically. However, Beijing regularly threatens Taipei with heightened military drills in the Taiwan Strait in recent years and also increasingly with cyber-attacks.
South Korean Diplomatic Database Breached
South Korea’s foreign ministry is investigating a major data leak following a breach at a government-run training academy that may impact all of the country’s current and former diplomats. The foreign ministry spokesperson confirmed that an unidentified hacker compromised an online education system containing roughly 10,000 records. While the Ministry acknowledged that a significant amount of data was exposed, local media reports indicate that highly sensitive personal information – such as home addresses, phone numbers, and national identification numbers – does not appear to have been compromised.
The foreign ministry immediately shut down the affected network after receiving an alert about suspicious activity, and the system remains offline while authorities investigate. Officials have not ruled out foreign state-sponsored hacking groups as potential culprits.
ETLM Assessment:
The incident adds to a troubling sequence of high-profile cyber breaches in South Korea, coming on the heels of a massive e-commerce leak last year and ongoing digital threats from North Korean cyber actors. North Korean hackers have carried out a series of high-profile cyberattacks in recent years, including the largest digital heist in the history of cryptocurrency last year.
INC Ransomware Impacts a Manufacturing Company from Japan
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by INC Ransomware. The Compromised company is a leading manufacturer specializing in special-purpose vehicles such as dump trucks, tankers, and garbage collection vehicles. The company serves various sectors, including construction, logistics, and environmental services, providing innovative solutions to meet diverse client needs. With a strong presence in both domestic and international markets, it aims to support sustainable infrastructure development. The company is committed to enhancing operational efficiency and environmental sustainability through its advanced technologies and services. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
Based on recent assessments by CYFIRMA, INC Ransomware represents a significant threat within the evolving landscape of ransomware attacks. Its use of strong encryption methods and double extortion tactics highlights the increasing sophistication of cybercriminal operations. Organizations are advised to enhance their cybersecurity measures by implementing robust defenses against phishing attacks, maintaining updated security protocols, and monitoring for unusual network activity to mitigate risks associated with this and other ransomware variants. Continuous vigilance is essential to protect against the threats posed by emerging ransomware groups like INC Ransomware.
The Gentlemen Ransomware Impacts a Manufacturing Company from Japan
Summary: CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is an Osaka-based Japanese company specializing in the development, design, and sale of wastewater treatment systems specifically for cardboard manufacturing plants. Originally founded as a cardboard printing ink manufacturer, the company leveraged its industry knowledge to transform into a dedicated water treatment equipment specialist in 2021. Today, their eco-friendly systems are installed and operational in over 430 factories across Japan, helping to clean industrial wastewater to safe environmental levels. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in SAP Commerce Cloud
Relevancy & Insights:
The vulnerability exists due to the use of insecure sample credentials in SAP Commerce Cloud when exposed services are deployed with default credentials.
Impact:
A remote attacker can authenticate with sample credentials to gain unauthorized access to sensitive information and modify data.
Affected Products:
https[:]//support[.]sap[.]com/en/my-support/knowledge-base/security-notes-news/july-2026[.]html
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment
A vulnerability in SAP Commerce Cloud introduces significant risks to organizations that rely on enterprise digital commerce platforms to manage online storefronts, customer interactions, product catalogs, order processing, and business transactions. As SAP Commerce Cloud is widely deployed by enterprises to support mission-critical e-commerce operations and integrate with broader ERP, CRM, and supply chain environments, exploitation of this vulnerability could enable attackers to gain unauthorized access through hard-coded credentials and compromise sensitive business systems. A successful attack may expose customer information, business-critical data, transaction records, and administrative functions while providing a foothold for lateral movement across interconnected enterprise environments. Organizations leveraging SAP Commerce Cloud should ensure timely application of vendor security updates, eliminate hard-coded credentials where applicable, continuously monitor authentication activities, and implement robust identity and access management controls to reduce the risk of unauthorized access. Addressing this vulnerability is essential to maintaining the confidentiality, integrity, and availability of enterprise commerce platforms and protecting critical business operations from compromise.
DragonForce Ransomware attacked and published the data of a Maritime & Shipbuilding company from Thailand
Summary:
Recently, we observed that DragonForce Ransomware attacked and published the data of a Maritime & Shipbuilding company from Thailand on its dark web website. The compromised company is a leading shipyard in Thailand with over 35 years of experience in the shipbuilding and repair industry. The company specializes in ship repair, ship building, steel fabrication, and engineering services for marine, offshore, and onshore sectors. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of the compromised data is approximately 64.12 GB.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, DragonForce represents a significant threat in the ransomware landscape due to its advanced operational methods and extensive use of modified ransomware tools. As it continues to target high-profile organizations globally, ongoing vigilance and proactive cybersecurity strategies will be essential for mitigating risks associated with this formidable threat actor. Organizations should remain alert to the evolving tactics employed by groups like DragonForce to protect their sensitive data and maintain operational integrity.
Unauthorized Website Database Advertised on a Leak Site
Summary
The CYFIRMA research team identified a post on a dark web forum advertising the alleged sale of a database associated with a Vietnamese manufacturing organisation specialising in automated access solutions. The forum post includes screenshots that appear to show portions of a website database containing user account information and references to administrative records. The advertisement claims that the complete dataset is available for download or private sale, while sample records have been published as proof of possession.
Based on the information shared in the forum post and the accompanying screenshots, the allegedly exposed dataset may include:
According to the advertisement, screenshots of database tables have been published to demonstrate possession of the data. The exposed information appears to resemble a website user database containing account-related fields commonly associated with content management systems. The complete dataset is allegedly being offered for download or private acquisition through underground channels.
If verified, exposure of this information could present significant cybersecurity risks to the affected organization and its users. Threat actors could leverage the disclosed credentials and account information to conduct credential stuffing attacks, targeted phishing campaigns, account takeover attempts, business email compromise (BEC), social engineering, and unauthorized access to internal systems. Administrative account exposure could further increase the risk of website compromise, malicious content injection, data manipulation, and follow-on attacks against connected infrastructure.
The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the underground forum advertisement and the accompanying screenshots and has not been independently confirmed.
Source: Underground Forums
Unauthorized Source Code Leak Advertised on a Leak Site
Summary:
The CYFIRMA research team identified a post on a dark web forum advertising the alleged leak of proprietary source code belonging to a technology organization specializing in contact center, telecommunications, and customer experience (CX) solutions. The forum post claims that the organization’s source code was compromised during a recent security incident and has been made available for download. Screenshots accompanying the advertisement include references to a source code repository and a sample directory tree intended to demonstrate possession of the data.
Based on the information shared in the forum advertisement, the allegedly compromised data may include:
According to the advertisement, a sample project tree has been published as proof of possession, while the complete source code repository is allegedly being offered for download through an underground forum. The claims suggest that the exposed data originates from the organization’s software development environment.
If verified, exposure of proprietary source code could significantly increase cybersecurity risks for the affected organization and its customers. Adversaries could analyze the source code to identify security weaknesses, discover hardcoded credentials or API keys, develop exploit techniques, bypass security controls, create counterfeit software, or launch supply chain attacks against customers using the affected products. Intellectual property theft may also result in competitive disadvantages, regulatory challenges, financial losses, and long-term reputational damage.
The authenticity of the alleged source code leak remains unverified at the time of reporting. This assessment is based solely on information published in the underground forum advertisement and the accompanying screenshots and has not been independently confirmed.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable entity primarily engaged in data-leak operations, with multiple credible indications linking them to incidents involving unauthorized system access and the dissemination or sale of stolen data on dark web forums. These activities underscore the growing sophistication of cyber threats driven by organized underground networks and highlight the urgent need for organizations to enhance their cybersecurity posture through continuous monitoring, improved threat intelligence, and proactive defensive measures to protect sensitive information and critical infrastructure.
Recommendations: Enhance the cybersecurity posture by:
The CYFIRMA research team identified a post on a dark web forum advertising the alleged leak of proprietary source code belonging to a South Korean robotics and industrial automation manufacturer. According to the forum advertisement, a collection of source code repositories was allegedly exfiltrated during a recent security incident and subsequently released for download. The post includes a screenshot referencing the affected organization’s branding and claims that the compromised data consists of software source code used in the development of robotics and automation technologies.
Based on the information shared in the forum advertisement, the allegedly compromised dataset may include:
According to the advertisement, the source code collection has been published for download through an underground forum. The post claims that the leaked data originated from the organization’s software development environment and includes a sample intended to demonstrate possession of the repository contents.
If verified, exposure of proprietary source code could significantly impact the affected organization by enabling adversaries to analyze software architecture, identify exploitable vulnerabilities, discover hardcoded credentials or cryptographic material, reverse engineer proprietary technologies, and develop exploits targeting deployed robotic and industrial automation systems. The incident may also increase the risk of intellectual property theft, counterfeit product development, software tampering, supply chain attacks, and future cyber intrusions against customers and business partners.
The authenticity of the alleged source code leak remains unverified at the time of reporting. This assessment is based solely on information published in the underground forum advertisement and the accompanying screenshots and has not been independently confirmed.
Source: Underground Forums
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.
