Weekly Intelligence Report – 28 Aug 2026

Published On : 2026-08-28

Ransomware In Focus

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows OS
Targeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, Chile
Targeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation

Introduction:
CYFIRMA Research and Advisory Team has found Betelgeuse Ransomware Group while monitoring various underground forums as part of our Threat Discovery Process.

Betelgeuse Ransomware Group
Betelgeuse is a ransomware variant that encrypts files and appends a .betelgeuse extension with a numeric suffix to affected filenames. The attack typically begins when a malicious payload is written to disk, often following phishing or exploitation of an exposed service. After execution, the ransomware performs large numbers of file-write, rename, and encryption operations. Effective prevention therefore requires controlling unauthorized executable-file creation and monitoring abnormal bulk file modifications. Behavioral controls that restrict untrusted processes from writing executable content and detect rapid, high-volume file changes can stop or contain the attack without depending on a specific malware signature. Systems should also be isolated quickly after detection to prevent lateral spread and further encryption.

Screenshot: File encrypted by ransomware (Source: Surface Web)

The ransom note claims that sensitive data was stolen before encryption and threatens public disclosure or resale if payment is not made. It provides attacker-controlled communication channels, offers decryption of a few files as proof, and uses a 72-hour deadline to create pressure. These claims should not be treated as evidence that the attackers can actually restore the data or that the stolen data will be deleted after payment. Removing the ransomware stops additional encryption but does not decrypt already affected files. Recovery should therefore rely on verified, clean offline or otherwise isolated backups, while incident responders should preserve evidence, determine the initial access method, assess possible data exfiltration, rotate compromised credentials, and patch exposed systems.

Screenshot: The appearance of Betelgeuse’s ransom note (RANSOM_NOTE.html) (Source: Surface Web)

The following are the TTPs based on the MITRE ATT&CK framework

Tactic	Technique ID	Technique Name
Tactic	Technique ID	Technique Name
Execution	T1047	Windows Management Instrumentation
Execution	T1574	Hijack Execution Flow
Privilege Escalation	T1055	Process Injection
Discovery	T1012	Query Registry
Discovery	T1033	System Owner/User Discovery
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1083	File and Directory Discovery
Collection	T1074	Data Staged
Collection	T1560	Archive Collected Data
Command and Control	T1071	Application Layer Protocol
Impact	T1486	Data Encrypted for Impact
Stealth	T1027	Obfuscated Files or Information
Stealth	T1055	Process Injection
Stealth	T1070.004	Indicator Removal: File Deletion
Stealth	T1202	Indirect Command Execution
Stealth	T1564.003	Hide Artifacts: Hidden Window
Stealth	T1574	Hijack Execution Flow

Relevancy and Insights:

The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities.
calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system.
The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.
Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.

ETLM Assessment:
Betelgeuse and similar ransomware are likely to become more adaptive and automation-driven, with future variants focusing less on a fixed file-encryption routine and more on evading behavioral controls. Attackers may increasingly use legitimate system utilities, stolen credentials, remote administration mechanisms, and previously compromised infrastructure to reach additional systems before encryption begins. The encryption stage itself may become more selective, targeting high-value databases, backups, virtual machines, configuration files, and business-critical data rather than indiscriminately encrypting every accessible file. Detection will therefore need to focus on abnormal process behavior, unusual privilege use, mass file modifications, credential misuse, and unexpected network activity rather than relying only on ransomware signatures or filename extensions. A further development is likely to be greater automation of the complete intrusion process, including initial access, credential discovery, lateral movement, data collection, exfiltration, and deployment of the encryption payload. Ransomware operators may use automated decision-making to identify the most valuable systems and adjust their actions according to the victim’s environment. Extortion may also become more targeted, combining encryption with threats based on the type and sensitivity of stolen information. From a defensive perspective, this means future protection will depend increasingly on rapid behavioral detection, strong identity controls, network segmentation, protected backups, application execution restrictions, and automated isolation of compromised systems.

Sigma rule:
title: Shadow Copies Deletion Using Operating Systems Utilities
tags:
– attack.impact
– attack.stealth
– attack.t1070
logsource:
category: process_creation
product: windows
detection:
selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’
selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’
selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’
selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet
selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’
selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’
CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*)
falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)
level: high
(Source: Surface Web)

Indicators of Compromise
Kindly refer to the IOCs section to exercise control of your security systems (Source: Surface Web)

STRATEGIC RECOMMENDATION

Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
Ensure that backups of critical systems are maintained which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATION

A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) If there is a requirement to inform the local authority.
To reduce the risk of credentials being compromised, enable multifactor authentication (MFA) and zero-trust architecture.
Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATION

Ensure that all applications and software are consistently maintained by deploying the most recent releases and applying available security updates and patches in a timely manner.
Incorporate the Sigma rule for threat detection and monitoring, which will assist in identifying and tracking suspicious activity as well as detecting anomalies in log events.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

Active Malware of the Week

Type: Info Stealer
Objectives: Credential Theft/ Data Exfiltration
Target Technology: Windows
Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the week
This week “Aokigahara Stealer” Malware is in focus.

Overview of Operation Aokigahara Stealer Malware

The sample analyzed exhibits a broad range of behaviors that are consistent with a potentially malicious Windows executable. Its activity extends beyond simply launching a program, with evidence of interaction with system components, creation and removal of files, execution of other processes, and changes involving Windows configuration data. These combined behaviors indicate that the sample can make substantial changes within the affected environment.

The analysis also identified signs of activity intended to operate through commonly available Windows tools and components. The sample interacted with PowerShell, command-line utilities, scripting components, and other native Windows processes. Several security-related areas of the system were also accessed, including Windows Defender-related components, suggesting that the activity deserves particular attention from a defensive perspective.

Network activity provides another important indication of the sample’s behavior. During execution, the sample contacted external infrastructure, performed DNS lookups, accessed a service used to determine the system’s public IP address, and exchanged data with a remote domain through several requests. This demonstrates that the sample is not limited to local system activity and may communicate with remote infrastructure as part of its execution.

Overall, the findings present the sample as a multi-stage threat with activity spanning system interaction, process execution, file operations, configuration changes, and external communication. The presence of multiple security detections and behavioral indicators further strengthens the need to treat the sample as suspicious and investigate its associated indicators. The analysis therefore provides useful evidence for detection and incident-response activities while also highlighting the importance of monitoring unusual processes, file, and network behavior together rather than examining each event in isolation.

Attack Method

The malware employs a multi-stage execution and payload-delivery mechanism that combines native Windows functionality with temporary file operations. During execution, it establishes an application environment within user-writable directories and generates supporting components required for subsequent activity. The observed behavior includes interaction with system services, Windows management interfaces, command interpreters, scripting facilities, and dynamic execution mechanisms. This indicates that malware distributes its functionality across multiple execution stages rather than relying on a single standalone operation.

A notable component of the attack method is the use of PowerShell-based execution with encoded instructions and execution-policy modification. The observed command uses a non-interactive PowerShell session together with an encoded command and an execution-policy bypass, allowing instructions to be executed without relying on normal PowerShell policy restrictions. The malware also performs process-state verification through native system utilities, allowing it to determine whether a required execution component is already active. This behavior suggests controlled execution and an attempt to reduce conflicts between multiple instances of malicious activity.

The sample also follows a staged payload extraction and file-management approach. Executable content and supporting resources are written into temporary and application-specific locations, while compressed application data and additional libraries are extracted during execution. The malware subsequently modifies attributes of selected files and removes temporary directories and extracted components. Such activity creates a lifecycle in which payload components can be introduced, executed, and later removed from the filesystem, making the resulting activity more difficult to reconstruct solely from residual files.

The attack additionally incorporates external network communication and remote infrastructure interaction. The sample retrieves executable content from an external HTTP endpoint, determines the host’s public IP address through an external service, and establishes encrypted communication with remote infrastructure. Multiple POST endpoints associated with handshake, data transfer, and completion stages were observed, indicating an organized communication sequence rather than an isolated outbound connection. DNS and TLS observations further confirm communication with external domains. The combined use of staged payload handling, policy-bypass execution, system-level interaction, temporary artifact removal, and structured remote communication demonstrates a coordinated attack methodology designed to execute malicious functionality while limiting straightforward visibility into its complete activity chain.

Following are the TTPs based on the MITRE Attack Framework for Enterprise

Execution	T1047	Windows Management Instrumentation
	T1059.001	Command and Scripting Interpreter: PowerShell
	T1106	Native API
	T1129	Shared Modules
	T1574	Hijack Execution Flow
Persistence	T1112	Modify Registry
Persistence	T1547.009	Boot or Logon Autostart Execution: Shortcut Modification
Privilege Escalation	T1055	Process Injection
Privilege Escalation	T1134	Access Token Manipulation
Stealth	T1027.009	Obfuscated Files or Information: Embedded Payloads
	T1036	Masquerading
	T1140	Deobfuscate/Decode Files or Information
	T1202	Indirect Command Execution
	T1497.001	Virtualization/Sandbox Evasion: System Checks
	T1564.003	Hide Artifacts: Hidden Window
Defense Impairment	T1222	File and Directory Permissions Modification
Credential Access	T1539	Steal Web Session Cookie
Discovery	T1010	Application Window Discovery
	T1012	Query Registry
	T1033	System Owner/User Discovery
	T1057	Process Discovery
	T1082	System Information Discovery
	T1083	File and Directory Discovery
	T1518	Software Discovery
Collection	T1074	Data Staged
Collection	T1115	Clipboard Data
Command and Control	T1071	Application Layer Protocol
	T1105	Ingress Tool Transfer
	T1573	Encrypted Channel
Impact	T1485	Data Destruction
Impact	T1486	Data Encrypted for Impact

INSIGHTS

The analysis shows that malware’s activity is broader than a single malicious action. Its behavior reflects a deliberate sequence in which different system resources are used at different points during execution. What stands out is the combination of ordinary system functionality with unusual activity, allowing the sample to operate within the normal Windows environment rather than behaving as an isolated or obviously disruptive program. This makes the overall activity more difficult to understand when individual events are viewed separately.
Another important insight is the malware’s ability to maintain a changing presence on the system. The analysis records the creation, modification, copying, and removal of numerous artifacts during execution. This suggests that the malware’s observable footprint is not static; some elements appear only temporarily while others remain as part of its operating environment. The presence of both generated and subsequently removed artifacts gives the sample a dynamic character and helps explain why its activity can appear fragmented across different parts of the system.
The analysis also reveals that the malware maintains a relationship between activity on the host and activity outside it. The sample’s execution is accompanied by communication with external infrastructure and interactions that provide information about the affected environment. The different communication events form a recognizable pattern rather than appearing as unrelated connections. This indicates that the malware’s behavior is organized around maintaining interaction between the compromised system and its external environment, giving the overall activity a coordinated and interconnected nature.

ETLM ASSESSMENT

For the ETLM Perspective, organizations may face increasingly stealthy and adaptable threats that can remain undetected while gradually affecting business operations, sensitive information, and employee activities. Attackers are likely to make malicious actions appear more like legitimate software or routine system behavior, increasing the possibility of successful compromise and delayed detection. Employees may consequently face greater exposure to deceptive applications, unexpected system activity, and misuse of trusted business resources. This could lead to longer attack lifecycles, increased operational and financial impact, loss of sensitive information, and reputational damage. Organizations should therefore expect future attacks to focus less on immediate disruption and more on maintaining hidden access and exploiting normal business activity over extended periods.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)

YARA Rule
rule AokigaharaStealer_Malware
{
meta:
description = “Detection rule for the analyzed malware sample”
author = “Threat Research”
strings:
$hash = “73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde”
$s1 = “C:\\Users\\<USER>\\AppData\\Local\\Programs\\installer\\Installer.exe –_uac”
$s2 = “C:\\Users\\<USER>\\AppData\\Local\\Temp\\Updates\\cache\\msqrqcwmdaa6\\payload.exe”
$s3 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding”
$s4 = “C:\\Windows\\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding”
$s5 = “C:\\Users\\<USER>\\AppData\\Local\\Programs\\installer\\Installer.exe”
$s6 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”ps -p 4116 -o comm=,ppid=”
$s7 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”net session”
$s8 = “UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAA”
$s9 = “powershell -exec bypass”
$s10 = “net session”
$s11 = “C:\\Windows\\system32\\net1 session”
$s12 = “C:\\Users\\user\\AppData\\Local\\Programs\\installer\\Installer.exe”
$s13 = “PcaSvc”
$s14 = “wscsvc”
$s15 = “WSearch”
$s16 = “BITS”
$s17 = “GoogleChromeElevationService”
$s18 = “prefetch:3”
$s19 = “factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding”
$s20 = “payload.exe”
$s21 = “v2.4.1.exe”
$s22 = “C:\\Users\\<USER>\\Desktop\\v2.4.1.exe”
$s23 = “Installer.exe”
$s24 = “prefetch:2”
$s25 = “installer.exe”
$s26 = “%LOCALAPPDATA%\\programs\\installer\\installer.exe”
$s27 = “%TEMP%\\updates\\cache\\mt53a8nma615\\payload.exe”
$s28 = “cqpvrxt.exe”
$s29 = “C:\\zyphvvqn\\cqpvrxt.exe”
$s30 = “niqx.exe”
$s31 = “C:\\jwllu\\niqx.exe”
$s32 = “C:\\Users\\user\\Desktop\\v2.4.1.exe”
$s33 = “http://192.162.199.149/uploads/69c7b08d53c448c283d2f9d244d190cc.exe”
$s34 = “192.162.199.149/uploads/69c7b08d53c448c283d2f9d244d190cc.exe”
$s35 = “69c7b08d53c448c283d2f9d244d190cc.exe”
$s36 = “http://nsis.sf.net/NSIS_ErrorError”
$s37 = “nsis.sf.net/NSIS_ErrorError”
$s38 = “https://api.ipify.org/”
$s39 = “api.ipify.org/”
$s40 = “AokigaharaStealer”
condition:
$hash or
3 of ($s*)
}

STRATEGIC RECOMMENDATION

Strengthen the organization’s overall cyber resilience by adopting a proactive approach to emerging malware and threat campaigns.
Establish continuous security awareness programs to improve employees’ ability to recognize suspicious files, applications, and activities.
Prioritize protection of critical business systems and sensitive information based on their potential business impact.
Conduct periodic security assessments and threat-hunting exercises to identify weaknesses before they are exploited.
Maintain an incident response and business continuity strategy to reduce operational and financial impact during a compromise.

MANAGEMENT RECOMMENDATION

Ensure adequate resources and budget are allocated for cybersecurity monitoring, employee awareness, and incident response.
Establish clear responsibilities for reporting and responding to suspicious activity across business and security teams.
Regularly review organizational exposure to malware-related risks and track remediation progress.
Promote security-focused decision-making among employees and management through regular awareness initiatives.
Maintain an up-to-date inventory of critical systems, applications, and sensitive business information.

TACTICAL RECOMMENDATION

Monitor endpoints for unusual application behavior, unexpected process activity, and suspicious system changes.
Review network traffic for unexpected connections to unfamiliar or suspicious external infrastructure.
Ensure endpoint security and detection controls are regularly updated and actively monitored.
Restrict unnecessary application execution and apply appropriate access controls to reduce opportunities for malware execution.
Investigate unusual systems or user activity promptly and isolate potentially compromised systems when required.
Regularly review security logs and alerts for indicators of persistence, unauthorized access, or abnormal system behavior.

CYFIRMA’s Weekly Insights

1. Weekly Attack Types and Trends

Key Intelligence Signals:

Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
Ransomware –Coinbase Cartel, The Gentlemen Ransomware | Malware – AokigaharaStealer
- Coinbase Cartel Ransomware – One of the ransomware groups.
- The Gentlemen Ransomware – One of the ransomware groups.
Please refer to the trending malware advisory for details on the following:
- Malware – AokigaharaStealer
Behaviour –Most of these malware use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

DoNot Team (APT-C-35): Evolving Cyber-Espionage Tradecraft and Targeted Operations

Threat Actor: DoNot aka APT-C-35
Attack Type: Connection Proxy, Credential Dumping, Vulnerabilities and Exploits, Spear-phishing
Objective: Cyber Espionage, Information Theft
Target Technology: Office Suites Software, Operating System, Web Application
Target Geography: India, Pakistan, Bangladesh, Sri Lanka
Target Industries: Defense, Energy, Government, Non-Profit, Military
Business Impact: Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor

VICEROY TIGER aka DoNot Team (APT-C-35) is an India-linked adversary that has historically targeted organizations across multiple sectors and countries. Since 2015, the group appears to have increasingly focused on entities in Pakistan, particularly government and security organizations. VICEROY TIGER (APT-C-35) has consistently employed spear-phishing emails containing malicious Microsoft Office documents, Android-focused malware, and credential-harvesting phishing campaigns. In March 2017, the 360 Chasing Team identified previously undocumented attack activity associated with the group, with evidence tracing the activity back to at least April 2016, and designated the adversary as APT-C-35. In June 2017, the 360 Threat Intelligence Center identified further activity targeting Pakistan and conducted an in-depth analysis of the group’s operations, including its distinctive EHDevel malware framework.

Details on Exploited Vulnerabilities:

CVE ID	Affected Products	CVSS Score	Exploit Links
CVE-2021-4034	polkit’s pkexec utility	7.8	Link1, Link2
CVE-2023-34362	MOVEit Transfer web application	9.8	Link1, Link2
CVE-2021-3156	Sudo before version 1.9.5p2	7.8	Link1, Link2, Link3, Link4, Link5
CVE-2023-44487	HTTP/2 protocol	7.5	–
CVE-2019-16759	vBulletin 5.x through 5.5.4	9.8	Link1, Link2, Link3, Link4, Link5, Link6

TTPs based on MITRE ATT&CK Framework

Tactic	ID	Technique
Reconnaissance	T1598.003	Phishing for Information: Spearphishing Link
Resource Development	T1587.002	Develop Capabilities: Code Signing Certificates
Resource Development	T1588.002	Obtain Capabilities: Tool
Initial Access	T1566.001	Phishing: Spearphishing Attachment
Initial Access	T1189	Drive-by Compromise
Initial Access	T1566.002	Phishing: Spearphishing Link
Execution	T1197	BITS Jobs
Execution	T1203	Exploitation for Client Execution
Execution	T1204.001	User Execution: Malicious Link
Execution	T1059.005	Command and Scripting Interpreter: Visual Basic
Execution	T1204.002	User Execution: Malicious File
Execution	T1059.001	Command and Scripting Interpreter: PowerShell
Execution	T1059.003	Command and Scripting Interpreter: Windows Command Shell
Execution	T1574.001	Hijack Execution Flow: DLL
Execution	T1559.002	Inter-Process Communication: Dynamic Data Exchange
Execution	T1053.005	Scheduled Task/Job: Scheduled Task
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task
Persistence	T1197	BITS Jobs
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Persistence	T1112	Modify Registry
Privilege Escalation	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	T1548.002	Abuse Elevation Control Mechanism: Bypass User Account Control
Privilege Escalation	T1055.012	Process Injection: Process Hollowing
Stealth	T1036.005	Masquerading: Match Legitimate Name or Location
Stealth	T1197	BITS Jobs
Stealth	T1055.012	Process Injection: Process Hollowing
Stealth	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Stealth	T1027.001	Obfuscated Files or Information: Binary Padding
Stealth	T1027.010	Obfuscated Files or Information: Command Obfuscation
Stealth	T1070.004	Indicator Removal: File Deletion
Stealth	T1027.002	Obfuscated Files or Information: Software Packing
Stealth	T1027.005	Obfuscated Files or Information: Indicator Removal from Tools
Defense Impairment	T1112	Modify Registry
Defense Impairment	T1553.002	Subvert Trust Controls: Code Signing
Credential Access	T1555.003	Credentials from Password Stores: Credentials from Web Browsers
Discovery	T1083	File and Directory Discovery
Discovery	T1680	Local Storage Discovery
Discovery	T1518.001	Software Discovery: Security Software Discovery
Discovery	T1082	System Information Discovery
Discovery	T1033	System Owner/User Discovery
Lateral Movement	T1021.001	Remote Services: Remote Desktop Protocol
Collection	T1560	Archive Collected Data
Collection	T1119	Automated Collection
Collection	T1005	Data from Local System
Collection	T1074.001	Data Staged: Local Data Staging
Command and Control	T1132.001	Data Encoding: Standard Encoding
Command and Control	T1105	Ingress Tool Transfer
Command and Control	T1102.001	Web Service: Dead Drop Resolver

Latest Developments Observed

The threat actor DoNot Team (APT-C-35) is suspected of conducting a highly targeted cyber-espionage campaign against Bangladesh’s military and defence personnel using spear-phishing emails with a weaponized RTF document disguised as a biography of a Bangladesh Air Force officer. The campaign leverages remote template injection, geofenced payload delivery, and multi-stage malware to establish persistence, collect system information, and communicate with attacker-controlled infrastructure. The activity appears focused on intelligence collection and maintaining access to high-value defence targets.

ETLM Insights
DoNot Team (APT-C-35), a suspected India-linked cyber-espionage actor, continues to demonstrate an intelligence-driven and highly targeted operational model focused on government, military, defence, and strategic organizations across South Asia. The group’s recent activity against Bangladesh military personnel reflects an evolution toward more selective and resilient intrusion operations, combining tailored social engineering with multi-stage delivery, victim filtering, and modular malware capabilities.

The threat actor’s operations reflect:
Highly targeted social engineering using military-specific themes and personalized spear-phishing lures to improve the likelihood of compromising high-value personnel.

Adaptive delivery and defense evasion through remote template injection, server-side victim filtering, layered obfuscation, anti-hooking techniques, and masquerading to reduce exposure to automated analysis and security controls.

Persistent and modular access through scheduled-task persistence, DLL-based implants, encrypted C2 communications, and conditional retrieval of additional modules based on victim profiling.
Continuous capability refinement demonstrated by the evolution of its Windows framework, expansion into mobile-focused surveillance activity, and continued refinement of phishing and malware delivery techniques.

Looking ahead, DoNot Team is expected to further mature its espionage capabilities by strengthening victim-specific payload delivery, adaptive filtering, modular malware deployment, and cross-platform surveillance. The group is likely to continue refining its ability to profile victims before deploying additional tooling, enabling more selective use of resources against strategically valuable targets. Its continued evolution toward layered delivery mechanisms and evasion-oriented infrastructure may also improve resilience against automated detection and analysis, supporting longer-term intelligence collection while maintaining a low operational footprint.

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

YARA Rules
rule DoNot_APT_C35_Bangladesh_Campaign
{
meta:
description = “Detects artifacts associated with the DoNot (APT-C-35) Bangladesh military cyber-espionage campaign”
author = “CYFIRMA”
date = “2026-08-24”
reference = “BGD e-GOV CIRT – DoNot (APT-C-35) Cyber-Espionage Campaign”
threat_actor = “DoNot / APT-C-35”
severity = “Critical”

strings:
// Campaign infrastructure
$domain1 = “greezupdto.info” ascii wide nocase
$domain2 = “reggyupdated.info” ascii wide nocase
$domain3 = “exessupdate.info” ascii wide nocase
$domain4 = “makerolleds.info” ascii wide nocase
$domain5 = “programgreedz.info” ascii wide nocase
$domain6 = “hillisolutions.info” ascii wide nocase

// C2 parameters
$c2_param1 = “mopd=” ascii wide nocase
$c2_param2 = “malp=” ascii wide nocase
$campaign_id = “MFG” ascii wide

// Persistence / execution artifacts
$task = “OneDrive Reporting Task-S-1-5-21-” ascii wide nocase
$dll_exec = “dn110mploc.dll,a4Strau” ascii wide nocase
$export = “a4Strau” ascii wide
$rundll32 = “rundll32.exe” ascii wide nocase

// Staging artifacts
$stage_dir = “%TEMP%\\BinSat\\” ascii wide nocase
$module1 = “TermdyunkSyubtyqdz.dll” ascii wide nocase
$module2 = “NuGetPackgingdunk.dll” ascii wide nocase

// Payload masquerading
$ico = “.ico” ascii
$mp3 = “.mp3” ascii
$doc = “.doc” ascii

condition:
2 of ($domain*) or
2 of ($c2_param*) or
$campaign_id and (
$task or
$dll_exec or
$export
) or
($stage_dir and $rundll32) or
2 of ($module*) or
3 of ($ico, $mp3, $doc) and $rundll32
}

Recommendations

Strategic Recommendations

Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
Deploy Zero Trust Policy that leverages tools like security information management, advanced security analytics platforms, security user behaviour analytics, and other analytics systems to help the organization’s security personnel observe in real-time what is happening within their networks so they can orient defences more intelligently.
Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more, by identifying such patterns.

Management Recommendations

Regularly reinforce awareness related to different cyberattacks using impersonated domains/spoofed webpages with end-users across the environment and emphasize the human weakness in mandatory information security training sessions.
Look for email security solutions that use ML- and AI-based anti-phishing technology for BEC protection to analyze conversation history to detect anomalies, as well as computer vision to analyze suspect links within emails.

Tactical Recommendations

Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
Set up DMARC (Domain-based Message Authentication Reporting & Conformance) to stop phishers from spoofing your domain (that is, making their emails look like they come from your organization).
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
Add the YARA rules for threat detection and monitoring which will help to detect anomalies in log events, identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

Iran suspected to have disabled a British power plant in a cyber attack

According to a special report by The Telegraph, an Iranian-linked hacking group successfully disabled a British power plant for four days in an unprecedented cyber attack. The incident is believed to be the most significant cyber attack of its kind in the UK and marks the first time hackers tied to the Iranian regime have managed to shut down a British energy facility.
Although British officials declined to identify the specific power plant due to security concerns, it is understood that staff fought for four days to restore operations. The targeted facility was relatively small, and the four-day outage had no broader impact on the UK’s energy generation or national grid supply. The breach occurred alongside a broader series of cyber attacks on US water infrastructure last month, which hit facilities across 12 states and raised serious concerns in the White House.

ETLM Assessment:

The attack has likely been a calculated demonstration of capability, meant to prove that cyber actors affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) can breach UK systems and take critical infrastructure offline. While Israel and Middle Eastern nations remain Tehran’s primary targets, suspected Iranian cyber operations have also been reported across Europe, including in Germany, Poland, Finland, Belgium, and Albania.The intrusion comes amid ongoing warnings from British and American intelligence agencies regarding daily cyber bombardment from state-sponsored hackers in Iran, Russia, China, and North Korea targeting critical national infrastructure and government systems. Previous major cyber incidents in the UK have disrupted NHS operations, school networks, and commercial manufacturing lines while foreign state actors have also exfiltrated sensitive data from retail businesses and the Electoral Commission’s voter registers.

Iranian hackers indicted among targeting of Siemens PLCs

The US Justice Department has unsealed an indictment charging 17 individuals with conducting cyber espionage for the Iranian military. The suspects allegedly operated through the Mabna Institute, a contractor for the Islamic Revolutionary Guard Corps (IRGC). Since at least 2013, the group carried out a widespread hacking campaign targeting 144 US universities, 178 international universities, dozens of private companies, multiple US government agencies, and non-governmental organizations.In a separate warning, US intelligence agencies, the Department of Energy, and the EPA issued a joint cybersecurity advisory regarding an ongoing campaign targeting Siemens S7 Series Programmable Logic Controllers (PLCs). Threat actors are using internet scanning tools to locate exposed PLCs running outdated or unpatched software, then deploying AI-generated exploit scripts disguised as legitimate system monitoring tools.

ETLM Assessment:

These operational technology attacks primarily target critical national infrastructure, including the energy, water and wastewater, chemical, commercial facilities, advanced manufacturing, and agriculture sectors. Authorities strongly urge operators to disconnect PLCs from the public internet, apply pending security updates, and implement rigorous network monitoring.

The targeting of Siemens Programmable Logic Controllers (PLCs) represents a full-circle evolution in offensive industrial cyber operations between Western allies and Iran. Iran’s interest in PLCs – particularly through IRGC-linked groups like CyberAv3ngers – has historically manifested in aggressive operational technology (OT) campaigns aimed at disabling critical national infrastructure (CNI) across North America, Europe, and Israel. While early Iranian attacks relied on basic scanning and default credential exploitation to hijack exposed PLCs in water and energy facilities, recent campaigns have evolved to use automated scanning, custom malware payloads, and AI-generated script development to directly manipulate controller logic and take physical equipment offline.

This tactic mirrors the historical archetype of OT warfare: the Stuxnet operation. Uncovered in 2010, Stuxnet was a joint US-Israeli cyber weapon explicitly designed to target Siemens Step7 software driving Siemens S7-300 PLCs at Iran’s Natanz uranium enrichment facility. The worm covertly intercepted PLC logic to wildly alter the rotational speeds of gas centrifuges – causing over 1,000 of them to physically degrade and tear themselves apart – while spoofing normal telemetry data to operators to mask the ongoing destruction. Ironically, the very controller architecture originally exploited by Western intelligence to sabotage Iran’s nuclear ambitions has now become a primary battlefield weapon deployed back against Western infrastructure by Iranian state-sponsored actors.

4. Rise in Malware/Ransomware and Phishing

Coinbase Cartel Ransomware Impacts a High-Technology Manufacturing Company from Japan

Attack Type: Ransomware
Target Industry: High-Technology Manufacturing
Target Geography: Japan
Ransomware: Coinbase Cartel Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by Coinbase Cartel Ransomware. The compromised company is a Japanese technology company headquartered in Tokyo, Japan. It operates in the high-technology and precision equipment industry, specializing in semiconductor manufacturing equipment, analytical and medical instruments, and industrial systems. The company serves sectors including healthcare, electronics, and scientific research, supplying solutions globally across manufacturing and laboratory environments. The compromised data includes confidential and sensitive information belonging to the organization.

The following screenshot was observed published on the dark web:

Source: Dark Web

Relevancy & Insights:

Coinbase Cartel Ransomware appeared around September 2025 as a cyber extortion collective with its own dedicated leak site on the dark web.
The Coinbase Cartel Ransomware group primarily targets countries such as the United States of America, France, the United Kingdom, Brazil, and Indonesia.
The Coinbase Cartel Ransomware group primarily targets industries such as Information Technology, Healthcare, Manufacturing, Consumer Goods & Services, and Professional Goods & Services.
Based on the Coinbase Cartel Ransomware victims list from 1st Jan 2026 to 25th August 2026, the top 5 Target Countries are as follows:

The Top 10 Industries most affected by the Coinbase Cartel Ransomware group victims list from 1st Jan 2026 to 25th August 2026 are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, Coinbase Cartel ransomware is an emerging financially motivated extortion group that primarily targets organizations through data theft and credential-based access. The group focuses on exfiltrating sensitive information rather than deploying traditional file-encrypting ransomware, allowing it to maintain stealth while creating significant reputational and regulatory pressure on victims. Coinbase Cartel has been observed leveraging exposed credentials, social engineering, Initial Access Brokers, and compromised credentials obtained through infostealer malware to gain access to victim environments. The group subsequently exfiltrates high-value data and threatens to publish the stolen information through dedicated leak sites if ransom demands are not met. This exfiltration-first approach enables Coinbase Cartel to conduct quieter and potentially faster attacks while maintaining substantial leverage over targeted organizations.

The Gentlemen Ransomware Impacts a Construction and Engineering Company from Japan

Attack Type: Ransomware
Target Industry: Construction and Engineering
Target Geography: Japan
Ransomware: The Gentlemen Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:

CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a prominent Japanese general contractor specialising in marine civil engineering, land reclamation, and port infrastructure development. The company focuses on delivering high-quality, economically viable construction projects while prioritizing environmental sustainability and technological innovation. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Italy.
The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 25th August 2026, the top 5 Target Countries are as follows:

The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 25th August 2026 are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploit

Vulnerability in Jira Software Data Center

Attack Type: Vulnerabilities & Exploits
Target Technology: Web Application
Vulnerability: CVE-2026-21582
CVSS Base Score: 8.8 Source
Vulnerability Type: Improper Authentication
Summary: The vulnerability allows a remote attacker to perform actions as another user.

Relevancy & Insights:

The vulnerability exists due to broken authentication and session management in Jira Data Center when handling authentication and session management.

Impact :

A remote attacker can exploit the authentication and session management flaw to perform actions as another user.
User interaction is required.

Affected Products: https[:]//jira[.]atlassian[.]com/browse/JSWSERVER-26938

Recommendations:

Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED PRODUCTS OF THE WEEK

This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment:

The vulnerability in Jira Software Data Center presents a significant security risk to organizations using the application, particularly because successful exploitation can allow an unauthenticated attacker to perform actions as another user. The vulnerability is caused by improper authentication and session management, allowing an unauthenticated attacker to perform unauthorized actions with the privileges of another user. Successful exploitation could allow threat actors to gain unauthorized access, perform actions as another user, access information available to the impersonated account, and potentially compromise the integrity of Jira projects and data. As exploitation does not require authentication, organizations should prioritize protecting Jira interfaces and limiting access to trusted users and networks. Organizations using affected versions of Jira Software Data Center should upgrade to the latest available security update and ensure that authentication and session-management controls are properly configured. In addition, organizations should monitor authentication activity and user actions for anomalous behaviour, particularly unauthorized activity performed under legitimate user accounts. Prompt remediation and continuous monitoring are recommended to reduce the risk of unauthorized access and activity resulting from exploitation of this vulnerability.

6. Latest Cyber-Attacks, Incidents, and Breaches

Krybit Ransomware attacked and published the data of a Manufacturing company from Thailand

Threat Actor: Krybit Ransomware
Attack Type: Ransomware
Objective: Data Leak, Financial Gains
Target Technology: Web Applications
Target Industry: Manufacturing
Target Geography: Thailand
Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:

Recently, we observed that Krybit Ransomware attacked and published the data of a Manufacturing company from Thailand on its dark web website. The compromised company is a Thai family-owned company established in 1988, headquartered in Bang Na, Bangkok, Thailand. The company is Thailand’s leading independent specialist polyethylene extruder, operating from a purpose-built 13,000 sq.m. factory in Bangna, Bangkok. Sunsea Plastics specializes in the manufacture of polyethylene film and plastic bags, particularly: LDPE Shrink Film; LLDPE Film for Lamination; LLDPE Film for Printing; mLLDPE Film for various applications; Polypropylene and Polyethylene Co-extrusion Film; PE Shrink Sleeve and Bag; PE Shrink Hood; PE Printed Shrink Film; and Trash Bags (various sizes up to 1,600mm width). The company supplies film throughout Thailand and to international markets worldwide. It maintains a highly technical R&D team dedicated to providing high-quality products at competitive prices, with manufacturing facilities continuously upgraded to reach various international standards. Core values include business integrity, product quality, customer service, and environmental responsibility. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of the compromised data is approximately 572.88 GB.

Source: Dark Web

Relevancy & Insights:

Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is paid.
The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Government & Civic, Consumer Goods & Services, and Information Technology.

ETLM Assessment:

According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.

7. Data Leaks

Unauthorised Entertainment Database Advertised on a Leak Site

Attack Type: Data Leak
Target Industry: Entertainment
Target Geography: Japan
Objective: Financial Gain
Business Impact: Exposure of Personally Identifiable Information (PII), User Account Data Disclosure, Identity Theft Risks, Credential-Based Attacks, Privacy and Regulatory Compliance Concerns, Financial Loss, Reputational Damage

Summary:

The CYFIRMA research team identified a post on a cybercrime forum advertising the leak of a database allegedly originating from an entertainment organization in Japan. According to the advertisement, the database reportedly contains user information for approximately 50,000 individuals.
The forum post includes sample database records as evidence of possession. Based on the information visible in the advertised sample, the allegedly exposed dataset may contain:

User identification records
Account creation and update timestamps
Keycloak user IDs
Keycloak usernames
Usernames
Email addresses
Email verification status
Gender information
Dates of birth
Profile/icon URLs
Display names
Account status
Account ban flags
Ban reasons
Ban timestamps
Information regarding the administrator responsible for account actions
Registration completion status
Registration workflow/step information
Synchronization timestamps
Additional user-account metadata

The authenticity and full scope of the alleged dataset remain unverified at the time of reporting. This assessment is based solely on the information visible in the cybercrime-forum advertisement and the provided sample and has not been independently confirmed.

Source: Underground Forums

Unauthorized Automotive Marketplace Database Advertised on a Leak Site

Attack Type: Data Leak
Target Industry: Automotive / E-commerce
Target Geography: Saudi Arabia
Objective: Financial Gain
Business Impact: Exposure of Personally Identifiable Information (PII), Customer Data Disclosure, Account Takeover Risks, Credential-Based Attacks, Privacy and Regulatory Compliance Concerns, Financial Loss, Reputational Damage

Summary:

The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of a large database allegedly originating from an online automotive marketplace in Saudi Arabia. According to the advertisement visible in the provided image, the seller claims to possess approximately 11 GB of data covering around 1 million users, distributed across 83 database tables.
The post provides a users.csv sample and displays database field names as evidence of possession. Based on the information visible in the sample, the allegedly exposed dataset may include:

User IDs
Names
Email addresses
Email verification status
Marketing and notification preferences
Phone numbers
Mobile numbers
Customer mobile numbers
Password-related information and password-change metadata
Account lock and password expiration information
Usernames
User registration and update timestamps
User status information
User roles and administrative information
Gender information
Socket and application identifiers
Address information
City and country information
Customer and business profile information
Payment and financial transaction-related fields
Total paid and profit-related information
Order and catalogue information
Coupon and discount-related information
Customer ratings
Referral and promotional information
Account restoration and deletion information
One-time account restoration tokens
Car-service branch information
Additional customer and account metadata

The authenticity and full scope of the alleged dataset remain unverified at the time of reporting. This assessment is based solely on information visible in the provided cybercrime-forum advertisement and the accompanying sample data and has not been independently confirmed.

Source: Underground Forums

Relevancy & Insights:

Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:

The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure

Recommendations:
Enhance the cybersecurity posture by

Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
Ensure proper database configuration to mitigate the risk of database-related attacks.
Establish robust password management policies, incorporating multi-factor authentication and role-based access, to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of data allegedly originating from a digital real estate marketplace operating in the United Arab Emirates. According to the advertisement, the dataset reportedly contains customer contact, order, and affiliate commission information and is described as a fresh export.
The forum post provides a sample of the allegedly compromised dataset and lists multiple database fields. Based on the information visible in the advertisement, the allegedly exposed data may include:

Lead IDs
Property reference numbers
Property titles
Property types
Number of bedrooms and bathrooms
Property size in square meters
Property locations
Property prices in AED
Lead/customer names
Phone numbers
Email addresses
Lead status
Last contact dates
Next follow-up dates
Lead sources
Internal notes
Assigned agent information
Order-related information
Affiliate commission information
Additional customer and property-related records

The advertised dataset could provide a detailed view of customer leads, property interests, contact information and sales-related activities. The combination of customer contact information with property details and lead-management records may increase the risk of targeted social-engineering and real-estate-related fraud.

Potential Impact
If verified, exposure of this information could significantly affect customers, property agents and business operations. Cybercriminals may exploit the allegedly leaked information to conduct:

Targeted phishing and spear-phishing campaigns
Real-estate-themed scams
Customer impersonation
Identity theft
Social engineering attacks
Business Email Compromise (BEC)
Credential harvesting
Fraudulent property offers and transactions
Targeted spam and malicious communications
Customer profiling
Unauthorized contact with prospective property buyers
Competitive intelligence gathering

Exposure of property locations, prices, lead information, customer contact details and assigned-agent information could allow malicious actors to create highly convincing fraudulent communications targeting prospective buyers, sellers and property professionals.

The authenticity and full scope of the alleged dataset remain unverified at the time of reporting. This assessment is based solely on information visible in the cybercrime-forum advertisement and its accompanying sample and has not been independently confirmed.

Source: Underground forums

STRATEGIC RECOMMENDATION

Attack Surface Management should be adopted by organizations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, active network monitoring, through next generation security solutions and ready to go incident response plan.
Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATION

Take advantage of global Cyber Intelligence providing valuable insights on threat actor activity, detection, and mitigation techniques.
Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied and the proper implementation of security technologies, followed by corrective actions remediations, and lessons learned.
Move beyond the traditional model of security awareness towards improved simulation and training exercises that mimic real attack scenarios, account for behaviours that lead to a compromised, and, are measured against real attacks the organization receives.
Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcoming of EDR and SIEM solutions.
Detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies and continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATION

Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthen defences based on tactical intelligence provided
Deploy detection technologies that are behavioural anomaly-based to detect ransomware attacks and help to take appropriate measures.
Implement a combination of security control such as reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.