CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Introduction:
CYFIRMA Research and Advisory Team has found InterServer Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
InterServer Ransomware
InterServer is a ransomware strain that encrypts files on an infected system and renames them by adding a variant-specific extension, such as .interserver12. The malware also creates an HTML ransom note named RANSOM_NOTE.html. As with other ransomware, the encryption process is intended to prevent access to affected files, and removing the malware stops additional encryption but does not automatically recover files that have already been encrypted.
Screenshot: File encrypted by the ransomware (Source: Surface Web)
The ransom note states that the victim’s corporate network has been compromised and claims that sensitive information was exfiltrated and stored on an attacker-controlled server. It threatens to publish or sell the allegedly stolen data if payment is not made. The operators offer to decrypt a small number of non-critical files as proof of their claimed recovery capability and provide email addresses and a Tor-based communication channel for contact. The note also warns victims against third-party recovery services, instructs them to communicate through specific email providers, and states that the ransom demand may increase if the attackers are not contacted within 72 hours.
Screenshot: The appearance of InterServer’s ransom note (RANSOM_NOTE.html) (Source: Surface Web)
Recovery of files encrypted by InterServer depends on the specific implementation of its encryption mechanism and the availability of a suitable decryptor. In the absence of a reliable decryption method, restoring data from backups created before the infection is the primary recovery approach. Maintaining multiple backup copies, including offline or otherwise isolated storage, reduces the risk of losing all accessible copies if ransomware compromises the primary system and connected backups.
Screenshot: The appearance of InterServer’s Tor Chat window
The following are the TTPs based on the MITRE Attack Framework
| Tactic | Technique ID | Technique Name |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1059 | Command and Scripting Interpreter |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Privilege Escalation | T1055 | Process Injection |
| Discovery | T1012 | Query Registry |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Collection | T1074 | Data Staged |
| Collection | T1560 | Archive Collected Data |
| Impact | T1486 | Data Encrypted for Impact |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1055 | Process Injection |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1564.003 | Hide Artifacts: Hidden Window |
| Stealth | T1574 | Hijack Execution Flow |
Relevancy and Insights:
ETLM Assessment:
InterServer ransomware may evolve through improvements in encryption, evasion, and deployment techniques. Future variants could modify file extensions, ransom note formats, and communication infrastructure while incorporating stronger defenses against security software and forensic analysis. The malware may also become more adaptable to different environments, targeting a wider range of file types, network shares, and enterprise systems. Such changes would make detection and incident response more challenging for security teams.
Future versions could also place greater emphasis on data theft alongside file encryption, increasing pressure on organizations through combined encryption and extortion tactics. Attackers may adopt more automated methods for identifying valuable systems and sensitive information before executing the encryption stage. Ransomware operators could further change their communication channels and operational methods to make infrastructure disruption and attribution more difficult. From a defensive perspective, organizations should expect ransomware threats to become more technically sophisticated and should strengthen prevention, detection, and recovery capabilities accordingly. Effective measures include network segmentation, offline or isolated backups, endpoint monitoring, timely vulnerability remediation, access-control restrictions, and regular incident-response exercises. These controls can reduce the potential impact of future ransomware variants, even as their implementation and delivery methods continue to change.
Sigma rules:
title: Shadow Copies Deletion Using Operating Systems Utilities tags:
– attack.impact
– attack.stealth
– attack.t1070 logsource:
category: process_creation product: windows
detection: selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’ selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’ selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’ selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’ selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’ CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Type: Information Stealer | Objectives: Credential Theft | Target Technology: Windows/ Web Browsers | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week
This week, “BlackSeeStealer” Malware is in focus.
Overview of Operation BlackSeeStealer Malware
The analyzed BlackSeeStealer malware sample demonstrates the characteristics of credential-focused malware designed to quietly collect sensitive user information while avoiding immediate detection. Rather than exhibiting destructive behavior, the malware emphasizes reconnaissance, browser data collection, and communication with external infrastructure, suggesting that its primary objective is to harvest valuable information for later exploitation. Its execution pattern reflects a well-planned attack that prioritizes stealth and persistence over rapid impact.
Behavioral analysis indicates that malware targets a broad range of web browsers and user environments, attempting to access stored credentials, browsing artifacts, and locally available user information. During execution, it performs environmental checks, gathers system details, and establishes outbound network connections to transmit the collected data. These activities are consistent with modern information-stealing malware that seeks to maximize the value of compromised systems while maintaining a low operational profile.
The sample also incorporates several techniques intended to complicate detection and analysis. By leveraging obfuscation, delaying execution, and checking for analysis environments, it attempts to evade automated security solutions and sandbox environments. Such defensive measures increase the likelihood of successful execution on victim systems and demonstrate a level of operational maturity commonly observed in contemporary cybercriminal malware campaigns.
Overall, the observed behavior highlights a persistent threat to enterprise and individual users who rely on web browsers for credential storage and online activities. The malware’s emphasis on covert information theft, combined with its ability to communicate with external servers and evade analysis, reinforces the importance of proactive endpoint monitoring, credential protection, and behavioral detection mechanisms to reduce the risk of compromise.
Attack Method
The malware begins its execution by performing multiple environmental validation checks before activating its primary functionality. It gathers system information, verifies the execution environment, and inspects the host for indicators associated with debugging or virtualized analysis platforms. These preliminary checks, combined with delayed execution and obfuscated code, are intended to reduce the likelihood of automated detection and ensure that the malware operates only in suitable environments. The sample also dynamically resolves required functions at runtime and loads additional components through shared modules, making static analysis significantly more challenging.
After establishing execution, the malware performs extensive reconnaissance of the infected host. It enumerates running processes, queries the Windows registry, identifies installed security products, and collects detailed operating system and hardware information. The malware then searches for installed web browsers, including Chromium-based browsers, Microsoft Edge, Google Chrome, Brave, Firefox, Opera, Vivaldi, Yandex Browser, and other browser variants. It accesses browser-specific files such as cookies, login databases, browsing history, web data, local storage, IndexedDB, and browser preference files, indicating a strong focus on harvesting authentication material and user activity.
To support credential theft, the malware copies browser-related data into temporary working directories, creates intermediate files containing collected information, and attempts to process encrypted browser databases. The sample also generates auxiliary files containing user system information and installed application details before organizing the harvested data for exfiltration. Throughout this process, it leverages process injection and execution flow manipulation techniques to conceal malicious activity while minimizing direct interaction with user-facing processes. The observed file system activity demonstrates systematic collection of browser artifacts across multiple user profiles and applications.
Following data collection, the malware establishes outbound network communication with external infrastructure to facilitate data transfer. It first queries public IP lookup services to determine the victim’s external network location before transmitting the collected information to a remote server using HTTP POST requests. Network traffic analysis further reveals encrypted communications, DNS lookups, and multiple outbound connections that support command-and-control operations. Combined with its anti-analysis capabilities, browser-focused credential harvesting, runtime code loading, and controlled data exfiltration workflow, the malware demonstrates a structured information-stealing attack chain designed to operate stealthily while maximizing the collection of valuable victim data.
The following are the TTPs based on the MITRE ATT&CK Enterprise framework
| Tactic | Technique | Technique Name |
| Execution | T1059 | Command and Scripting Interpreter |
| T1129 | Shared Modules | |
| Stealth | T1027 | Obfuscated Files or Information |
| T1036 | Masquerading | |
| T1202 | Indirect Command Execution | |
| T1218 | System Binary Proxy Execution | |
| T1497 | Virtualization/Sandbox Evasion | |
| T1564 | Hide Artifacts | |
| Credential Access | T1003 | OS Credential Dumping |
| T1539 | Steal Web Session Cookie | |
| T1552 | Unsecured Credentials | |
| T1555 | Credentials from Password Stores | |
| Discovery | T1012 | Query Registry |
| T1033 | System Owner/User Discovery | |
| T1057 | Process Discovery | |
| T1082 | System Information Discovery | |
| T1083 | File and Directory Discovery | |
| T1518 | Software Discovery | |
| Collection | T1005 | Data from Local System |
| T1185 | Browser Session Hijacking | |
| Command and control | T1071 | Application Layer Protocol |
| T1095 | Non-Application Layer Protocol | |
| T1105 | Ingress Tool Transfer | |
| T1573 | Encrypted Channel | |
| Impact | T1485 | Data Destruction |
INSIGHTS
ETLM ASSESSMENT
From an ETLM Perspective, the continued evolution of this information-stealing malware is expected to reinforce a threat landscape where digital identities and browser-stored credentials become increasingly attractive targets for financially motivated threat actors. As organizations continue to embrace cloud-first environments, browser-based business applications, and hybrid work models, compromised employee accounts are likely to become a preferred pathway for unauthorized access to enterprise resources, sensitive business information, and interconnected third-party services.
This shift is expected to increase the role of information-stealing malware as an enabler of identity-based attacks rather than standalone infections. The growing reliance on legitimate user credentials may facilitate account compromise, business fraud, unauthorized access, and data exposure across multiple industry sectors, ultimately expanding the operational and financial risks associated with modern enterprise environments.
IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)
YARA Rules
rule BlackSeaStealer_InfoStealer_2026
{
meta:
description = “Detects BlackSeaStealer based on browser credential theft artifacts, network indicators, and behavioral strings”
author = “CYFIRMA” date = “2026-07-27”
strings:
/* IOC */
$hash = “77be91fc4ee0154ee4b6d0a48c596de2bffca40f1aebbf888b9ee2f3e09c89e9” ascii
/* Network Indicators */
$ipify = “api.ipify.org”
$ipapi = “ip-api.com”
$upload = “/upload”
$ua = “IP Checker/1.0”
/* Browser Credential Artifacts */
$login1 = “Login Data”
$login2 = “Login Data For Account”
$cookie1 = “Cookies”
$cookie2 = “Network\\Cookies”
$webdata = “Web Data”
$history = “History”
$local = “Local State”
$prefs = “Preferences”
/* Firefox */
$ff1 = “key4.db”
$ff2 = “logins.json”
$ff3 = “cookies.sqlite”
$ff4 = “places.sqlite”
/* Output Files */
$out1 = “UserInformation.txt”
$out2 = “browser_decryption.log”
$out3 = “installed_applications.txt”
/* Targeted Browsers */
$chrome = “Google\\Chrome”
$edge = “Microsoft\\Edge”
$brave = “BraveSoftware”
$firefox = “Mozilla\\Firefox”
$opera = “Opera”
$vivaldi = “Vivaldi”
$yandex = “YandexBrowser”
$tor = “Tor Browser”
condition:
uint16(0) == 0x5A4D and (
$hash or
(4 of ($login*,$cookie*,$webdata,$history,$local,$prefs,$ff*)) or (2 of ($ipify,$ipapi,$upload,$ua) and 3 of
($out*,$chrome,$edge,$brave,$firefox,$opera,$vivaldi,$yandex,$tor))
)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Key Intelligence Signals:
o RansomHouse Ransomware– One of the ransomware groups.
o The Gentlemen Ransomware – One of the ransomware groups.
Please refer to the trending malware advisory for details on the following:
Kimsuky Expands Supply Chain Espionage Through Compromised South Korean Groupware Vendors
About the Threat Actor
Kimsuky is a North Korea-linked advanced persistent threat (APT) group that has been active since at least 2012, conducting cyber espionage operations in support of the Democratic People’s Republic of Korea’s (DPRK) strategic intelligence objectives. The threat actor aligns its operations with national security, foreign policy, and sanctions-related intelligence collection priorities, while continuously evolving its malware ecosystem and intrusion capabilities to maintain long-term covert access. Kimsuky has also demonstrated operational collaboration and resource sharing with other DPRK state-sponsored cyber actors, enhancing its ability to conduct sustained intelligence-gathering campaigns.
Details on Exploited Vulnerabilities
TTPs based on the MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1591 | Gather Victim Org Information |
| Reconnaissance | T1589.004 | Gather Victim Identity Information: Employee Names |
| Reconnaissance | T1589.002 | Gather Victim Identity Information: Email Addresses |
| Reconnaissance | T1598 | Phishing for Information |
| Reconnaissance | T1598.003 | Phishing for Information: Spear Phishing Link |
| Reconnaissance | T1682 | Query Public AI Services |
| Reconnaissance | T1596 | Search Open Technical Databases |
| Reconnaissance | T1593.001 | Search Open Websites/Domains: Social Media |
| Reconnaissance | T1593.002 | Search Open Websites/Domains: Search Engines |
| Reconnaissance | T1594 | Search Victim-Owned Websites |
| ResourceDevelopment | T1586.002 | Compromise Accounts: Email Accounts |
| ResourceDevelopment | T1608.001 | Stage Capabilities: Upload Malware |
| ResourceDevelopment | T1587.001 | Develop Capabilities: Malware |
| ResourceDevelopment | T1587 | Develop Capabilities |
| ResourceDevelopment | T1583 | Acquire Infrastructure |
| ResourceDevelopment | T1583.001 | Acquire Infrastructure: Domains |
| ResourceDevelopment | T1583.004 | Acquire Infrastructure: Server |
| ResourceDevelopment | T1583.006 | Acquire Infrastructure: Web Services |
| ResourceDevelopment | T1584.001 | Compromise Infrastructure: Domains |
| ResourceDevelopment | T1585 | Establish Accounts |
| ResourceDevelopment | T1585.001 | Establish Accounts: Social Media Accounts |
| ResourceDevelopment | T1585.002 | Establish Accounts: Email Accounts |
| ResourceDevelopment | T1588.002 | Obtain Capabilities: Tool |
| ResourceDevelopment | T1588.003 | Obtain Capabilities: Code Signing Certificates |
| ResourceDevelopment | T1588.005 | Obtain Capabilities: Exploits |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Initial Access | T1133 | External Remote Services |
| Initial Access | T1078.003 | Valid Accounts: Local Accounts |
| Initial Access | T1566.001 | Phishing: Spear Phishing Attachment |
| Initial Access | T1566.002 | Phishing: Spear Phishing Link |
| Initial Access | T1566 | Phishing |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1059.007 | Command and Scripting Interpreter: JavaScript |
| Execution | T1059.006 | Command and Scripting Interpreter: Python |
| Execution | T1059.005 | Command and Scripting Interpreter: Visual Basic |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Execution | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Execution | T1106 | Native API |
| Execution | T1204.001 | User Execution: Malicious Link |
| Execution | T1204.002 | User Execution: Malicious File |
| Execution | T1204.004 | User Execution: Malicious Copy and Paste |
| Execution | T1559.001 | Inter-Process Communication: Component Object Model |
| Persistence | T1098.007 | Account Manipulation: Additional Local or Domain Groups |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Persistence | T1136.001 | Create Account: Local Account |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Persistence | T1546.001 | Event Triggered Execution: Change Default File Association |
| Persistence | T1133 | External Remote Services |
| Persistence | T1112 | Modify Registry |
| Persistence | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Persistence | T1505.003 | Server Software Component: Web Shell |
| Persistence | T1176.001 | Software Extensions: Browser Extensions |
| Persistence | T1205 | Traffic Signaling |
| Persistence | T1078.003 | Valid Accounts: Local Accounts |
| Privilege Escalation | T1098.007 | Account Manipulation: Additional Local or Domain Groups |
| Privilege Escalation | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1546.001 | Event Triggered Execution: Change Default File Association |
| Privilege Escalation | T1055.001 | Process Injection: Dynamic-link Library Injection |
| Privilege Escalation | T1055.012 | Process Injection: Process Hollowing |
| Privilege Escalation | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Privilege Escalation | T1078.003 | Valid Accounts: Local Accounts |
| Stealth | T1678 | Delay Execution |
| Stealth | T1140 | Deobfuscate/Decode Files or Information |
| Stealth | T1480.002 | Execution Guardrails: Mutual Exclusion |
| Stealth | T1564.002 | Hide Artifacts: Hidden Users |
| Stealth | T1564.003 | Hide Artifacts: Hidden Window |
| Stealth | T1564.011 | Hide Artifacts: Ignore Process Interrupts |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1070.006 | Indicator Removal: Timestomp |
| Stealth | T1036.004 | Masquerading: Masquerade Task or Service |
| Stealth | T1036.005 | Masquerading: Match Legitimate Resource Name or Location |
| Stealth | T1036.007 | Masquerading: Double File Extension |
| Stealth | T1027.001 | Obfuscated Files or Information: Binary Padding |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1027.007 | Obfuscated Files or Information: Dynamic API Resolution |
| Stealth | T1027.010 | Obfuscated Files or Information: Command Obfuscation |
| Stealth | T1027.012 | Obfuscated Files or Information: LNK Icon Smuggling |
| Stealth | T1027.013 | Obfuscated Files or Information: Encrypted/Encoded File |
| Stealth | T1027.015 | Obfuscated Files or Information: Compression |
| Stealth | T1027.016 | Obfuscated Files or Information: Junk Code Insertion |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1055.001 | Process Injection: Dynamic-link Library Injection |
| Stealth | T1055 | Process Injection |
| Stealth | T1055.012 | Process Injection: Process Hollowing |
| Stealth | T1620 | Reflective Code Loading |
| Stealth | T1684.001 | Social Engineering: Impersonation |
| Stealth | T1218.005 | System Binary Proxy Execution: Mshta |
| Stealth | T1218.010 | System Binary Proxy Execution: Regsvr32 |
| Stealth | T1218.011 | System Binary Proxy Execution: Rundll32 |
| Stealth | T1205 | Traffic Signaling |
| Stealth | T1078.003 | Valid Accounts: Local Accounts |
| Stealth | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| DefenseImpairment | T1686 | Disable or Modify System Firewall |
| DefenseImpairment | T1685 | Disable or Modify Tools |
| DefenseImpairment | T1112 | Modify Registry |
| DefenseImpairment | T1553.002 | Subvert Trust Controls: Code Signing |
| Credential Access | T1557 | Adversary-in-the-Middle |
| Credential Access | T1555.003 | Credentials from Password Stores: Credentials from Web Browsers |
| Credential Access | T1056.001 | Input Capture: Keylogging |
| Credential Access | T1056.003 | Input Capture: Web Portal Capture |
| Credential Access | T1111 | Multi-Factor Authentication Interception |
| Credential Access | T1040 | Network Sniffing |
| Credential Access | T1003.001 | OS Credential Dumping: LSASS Memory |
| Credential Access | T1539 | Steal Web Session Cookie |
| Credential Access | T1552.001 | Unsecured Credentials: Credentials In Files |
| Credential Access | T1552.004 | Unsecured Credentials: Private Keys |
| Discovery | T1217 | Browser Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1680 | Local Storage Discovery |
| Discovery | T1040 | Network Sniffing |
| Discovery | T1057 | Process Discovery |
| Discovery | T1012 | Query Registry |
| Discovery | T1518.001 | Software Discovery: Security Software Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1016 | System Network Configuration Discovery |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1007 | System Service Discovery |
| Discovery | T1124 | System Time Discovery |
| Discovery | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| LateralMovement | T1534 | Internal Spear Phishing |
| LateralMovement | T1021.001 | Remote Services: Remote Desktop Protocol |
| LateralMovement | T1550.002 | Use Alternate Authentication Material: Pass the Hash |
| Collection | T1557 | Adversary-in-the-Middle |
| Collection | T1560.001 | Archive Collected Data: Archive via Utility |
| Collection | T1560.003 | Archive Collected Data: Archive via Custom Method |
| Collection | T1185 | Browser Session Hijacking |
| Collection | T1115 | Clipboard Data |
| Collection | T1005 | Data from Local System |
| Collection | T1074.001 | Data Staged: Local Data Staging |
| Collection | T1114.002 | Email Collection: Remote Email Collection |
| Collection | T1114.003 | Email Collection: Email Forwarding Rule |
| Collection | T1056.001 | Input Capture: Keylogging |
| Collection | T1056.003 | Input Capture: Web Portal Capture |
| Collection | T1113 | Screen Capture |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1071.002 | Application Layer Protocol: File Transfer Protocols |
| Command and Control | T1071.003 | Application Layer Protocol: Mail Protocols |
| Command and Control | T1568 | Dynamic Resolution |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1132.002 | Data Encoding: Non-Standard Encoding |
| Command and Control | T1219.002 | Remote Access Tools: Remote Desktop Software |
| Command and Control | T1205 | Traffic Signaling |
| Command and Control | T1102.001 | Web Service: Dead Drop Resolver |
| Command and Control | T1102.002 | Web Service: Bidirectional Communication |
| Exfiltration | T1020 | Automated Exfiltration |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Exfiltration | T1567.002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
| Impact | T1657 | Financial Theft |
| Impact | T1489 | Service Stop |
Latest Developments Observed
The Kimsuky threat actor is observed targeting South Korean groupware vendors and their downstream customers by exploiting internet-facing mail server vulnerabilities and conducting spear-phishing against employees. The campaign deploys Gomir, BirdTroy, and DriveTroy malware, followed by lateral movement into customer environments, credential harvesting through tampered groupware login pages, and the abuse of Google Drive as a command-and-control channel to support long-term cyber espionage and sensitive information theft.
ETLM Insights
Kimsuky continues to operate as a North Korea-aligned cyber espionage group focused on long-term strategic intelligence collection in support of the DPRK’s national security and geopolitical objectives. Recent operations demonstrate an increasingly mature operational model centered on compromising trusted enterprise software providers to enable downstream access, extend intelligence collection opportunities, and strengthen operational persistence across interconnected organizational environments.
The threat actor’s operations reflect:
Looking ahead, Kimsuky is expected to further strengthen its supply-chain intrusion capabilities, expand abuse of trusted enterprise ecosystems, and refine stealth-oriented operational methodologies to support persistent intelligence collection. This continued evolution reinforces the group’s ability to conduct scalable downstream compromise while maintaining long-term access across interconnected enterprise environments, posing a sustained espionage threat to organizations operating within complex digital ecosystems.
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules
rule Kimsuky_Gomir_BirdTroy_DriveTroy_IOCs
{
meta:
author = “CYFIRMA”
description = “Detects Kimsuky campaign artifacts based on observed filenames and infrastructure”
date = “2026-07-28”
actor = “Kimsuky”
malware = “Gomir, BirdTroy, DriveTroy” strings:
/* Malware / File Names */
$f1 = “frpc.exe” ascii nocase
$f2 = “exe\\frpc.exe” ascii nocase
$f3 = “install.bat” ascii nocase
$f4 = “win32.dll” ascii nocase
/* Infrastructure */
$d1 = “load.auraria.org” ascii nocase
$d2 = “file.bigcloud.n-e.kr” ascii nocase
$d3 = “erp.spaceme.p-e.kr” ascii nocase
$d4 = “cms.spaceyou.o-r.kr” ascii nocase
$d5 = “female-disorder-beta-metropolitan.trycloudflare.com” ascii nocase
/* Exploited CVEs */
$cve1 = “CVE-2020-8515” ascii
$cve2 = “CVE-2017-17215” ascii
$cve3 = “CVE-2021-26855” ascii
$cve4 = “CVE-2020-5902” ascii condition:
3 of ($f*) or 2 of ($d*) or
(1 of ($f*) and 1 of ($d*)) or 2 of ($cve*)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Thailand’s Ministry of Finance hacked with an autonomous AI agent
According to researchers, a threat actor recently deployed an autonomous AI agent during an apparent cyberespionage campaign targeting Thailand’s Ministry of Finance after discovering an exposed server operated by the attackers. The logs revealed that the hackers utilized “Hermes,” an open-source AI agent, configured in “YOLO” mode – a setting that automatically executes potentially dangerous commands without asking for human approval. Operating autonomously, Hermes scanned and enumerated ministry hosts, navigated through file systems, and captured diagnostic output from the privilege-escalation tool LinPEAS on adjacent network devices. While the researchers have stopped short of formally attributing the campaign to a specific group, several indicators discovered during the investigation point toward Chinese-speaking attackers.
ETLM Assessment:
China-aligned cyberespionage groups have a long-standing history of targeting Thai government entities and critical infrastructure to gather economic and strategic intelligence. Campaigns by state-backed APTs such as Mustang Panda, RedHotel, and the emergent group CeranaKeeper have repeatedly breached Southeast Asian public sector networks, specifically focusing on Thai ministries, cabinet offices, and state agencies. These operations typically focus on long-term data exfiltration and persistent network access to monitor trade negotiations, financial policy, and regional geopolitical developments, making economic institutions like the Ministry of Finance routine targets for Chinese intelligence gathering.
Russian hackers target unpatched Zimbra servers
US intelligence agencies, alongside their Five Eyes partners and European allies, have issued a joint advisory warning of an ongoing Russian state-sponsored phishing campaign targeting Western government and commercial entities. The operation, attributed to the Russian threat group tracked as “Laundry Bear” or “Void Blizzard,” aims to harvest sensitive email data on behalf of the Russian government by exploiting vulnerable installations of the Zimbra Collaboration Suite (ZCS).
The campaign initially leveraged a critical Zimbra vulnerability (CVE-2025-66376) as a zero-day starting last year. Although Zimbra issued a patch for the flaw in November 2025, Laundry Bear continues to successfully breach organizations that have failed to update their systems. According to researchers, the flaw allows for “half-click” exploitation, meaning the malicious payload executes automatically as soon as a target opens the email.
The investigation revealed that the phishing messages deploy a JavaScript payload into the victim’s browser, which proceeds to exfiltrate email credentials, CSRF tokens, two-factor authentication scratch codes, system environment details, and up to 90 days of the victim’s email and search history.
ETLM Assessment:
Based on intelligence advisories from Western security agencies (including CISA, the NSA, and Five Eyes partners), groups like Laundry Bear / Void Blizzard are driven by political and military espionage rather than financial gains. Their primary target is Western military support & logistics for Ukraine, like tracking schedules, routes, and procurement details for Western military equipment and weapons shipments moving into Ukraine. On top of that, there are defense contractors, aerospace engineering firms, and logistics providers in NATO countries to assess manufacturing capacities and military supply chains.
RansomHouse Ransomware Impacts a Food & Beverage Company from Japan
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by RansomHouse Ransomware. The Compromised company is a premier Japanese holding company that has established itself as a market leader by pioneering the frozen food industry and providing end-to-end temperature-controlled logistics solutions. With a clear mission to deliver true satisfaction, the Group leverages its integrated capabilities across food procurement, processing, and logistics to optimize the supply chain and support the nation’s food culture. As Japan’s number one frozen food producer and the holder of the largest refrigerated warehouse capacity in the country, the company combines advanced R&D with a robust global network to ensure quality and consistency. The company’s business portfolio extends from processed foods and marine products to bioscience and logistics, serving as a critical social infrastructure for food distribution. By adapting to changing social needs and economic environments, it continues to create sustainable value and strengthen its position as a cornerstone of the food industry. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, RansomHouse ransomware predominantly targets large enterprises and high-value organizations through phishing and spear phishing campaigns. The group also employs third-party frameworks such as Vatet Loader, Metasploit, and Cobalt Strike to gain initial access and perform lateral movements within victim networks. RansomHouse typically skips data encryption, focusing instead on exfiltrating sensitive data to extort victims by threatening to publicly release the stolen information. This approach allows the group to maintain stealth and prolong their presence in targeted environments.
The Gentlemen Ransomware Impacts a Construction and Information Technology Company from Japan
Attack Type: Ransomware
Target Industry: Construction and Information Technology
Target Geography: Japan
Ransomware: The Gentlemen Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a Japanese software company based in Itoigawa, Niigata, specializing in construction project management solutions. For over three decades, the company has developed the CDPM series, a widely recognized software for creating and managing complex construction schedules. Recently, the company has been actively driving digital transformation in the construction industry through its advanced CDPM-X64 platform, which introduces innovative features such as native JSON support and comprehensive schedule analysis tools. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in Atlassian Sourcetree
Relevancy & Insights:
The vulnerability exists due to improper access control in Sourcetree for Windows when handling crafted content.
Impact:
A remote attacker can trick the victim into processing crafted content to execute arbitrary code.
User interaction is required for exploitation.
Affected Products:
https[:]//jira[.]atlassian[.]com/browse/SRCTREE-8275
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment
The vulnerability in Atlassian Sourcetree poses a security risk to organizations that rely on the application for managing source code repositories and software development workflows. As Sourcetree is widely used by developers and development teams to interact with Git and Mercurial repositories, exploitation of this improper access control vulnerability could allow unauthorized users to access sensitive information or perform actions beyond their intended privileges. Such unauthorized access may expose source code, development assets, configuration data, and other sensitive project information, potentially impacting the confidentiality and integrity of software development environments. Organizations using Atlassian Sourcetree should promptly apply the latest security updates, enforce strong access control policies, restrict application usage to authorized users, and continuously monitor for suspicious activities to reduce the risk of compromise. Timely remediation is essential to protecting development environments and maintaining the security of enterprise software development operations.
Krybit Ransomware attacked and published the data of a Manufacturing company from India
Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a Manufacturing company from India on its dark web website. The compromised company is a recently incorporated Indian private limited company established on March 27, 2023, headquartered in Bangalore, Karnataka, India. The company is classified under the manufacture of pharmaceuticals, medicinal chemicals, and botanical products sector, as well as paper and paper products manufacturing. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of data compromised is approximately 31.40.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
Unauthorized Reservation Platform Database Advertised on a Leak Site
Summary
The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large database allegedly obtained from a Japanese online reservation and business management platform. According to the forum advertisement, the seller claims to have compromised the organization’s infrastructure and exfiltrated approximately 32 million customer records from its database. The advertisement further states that sample records have been published as proof of possession while the complete dataset is being offered for sale through an escrow-based transaction. This reporting format is consistent with previously documented dark web data leak assessments.
Allegedly Exposed Data
Based on the information presented in the forum advertisement and the visible sample records, the exposed dataset may contain:
The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and accompanying screenshots and has not been independently confirmed.
Source: Underground Forums
Unauthorized Job Portal Database Advertised on a Leak Site
Summary:
The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large database allegedly obtained from a Middle Eastern online recruitment platform. According to the forum advertisement, the seller claims to possess approximately 872,000 records containing user registration details, authentication information, candidate profiles, and associated metadata. The advertisement states that sample information has been shared as proof of possession, while the complete dataset is being offered for sale through an escrow-based transaction. This reporting structure follows the same assessment methodology used for previously documented data leak advertisements.
Allegedly Exposed Data
Based on the information presented in the forum advertisement, the allegedly exposed dataset may contain:
Candidate Personal Information
Candidate Professional Information
Recruitment & System Information
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable entity primarily engaged in data-leak operations, with multiple credible indications linking them to incidents involving unauthorized system access and the dissemination or sale of stolen data on dark web forums. These activities underscore the growing sophistication of cyber threats driven by organized underground networks and highlight the urgent need for organizations to enhance their cybersecurity posture through continuous monitoring, improved threat intelligence, and proactive defensive measures to protect sensitive information and critical infrastructure.
Recommendations: Enhance the cybersecurity posture by:
The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large collection of documents allegedly obtained from a healthcare organization in Qatar. According to the forum advertisement, the seller claims to possess more than 30,000 curriculum vitae (CVs) belonging to healthcare professionals, including doctors, nurses, paramedics, and other medical staff. The advertisement states that sample files have been made available as proof of possession, while the complete dataset is being offered for sale through an escrow-based transaction. This reporting format follows the standard methodology used for assessing dark web data leak advertisements.
Allegedly Exposed Data
Based on the information shared in the forum advertisement, the allegedly exposed dataset may include:
Advertisement Claims
According to the forum post, the seller claims:
The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and accompanying screenshots and has not been independently confirmed.
Source: Underground Forums
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.
