CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware
Target Technologies: Windows OS
Introduction:
CYFIRMA Research and Advisory Team has found KansasGroup Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
KansasGroup Ransomware
KansasGroup is a ransomware variant that encrypts files and appends the .kansas4life extension to the affected filenames once executed on a compromised system. For example, a file such as report.docx may be renamed to report.docx.kansas4life following encryption. The malware targets various types of data, including documents, images, videos, and databases, making the affected files inaccessible to the victim. After completing the encryption process, it creates a ransom note named KANSASGROUP.txt to provide instructions to the victim.
Screenshot: File encrypted by the ransomware (Source: Surface Web)
The ransom note informs victims that their data has been encrypted and claims that recovery requires a private decryption key and corresponding software controlled by the attackers. It also warns against attempting manual recovery methods, stating that such actions could result in additional damage to the encrypted data. The note provides instructions for contacting the ransomware operators through a peer-to-peer communication platform and asks the victim to provide information about the affected organization. A unique recovery identifier is also assigned to the victim and is required during communication with the attackers. The analyzed note does not specify a fixed ransom demand or payment deadline.
Screenshot: The appearance of GINES’s Ransom Note (Source: Surface Web)
Based on the observed behavior, files encrypted by this ransomware cannot be reliably recovered through standard file restoration methods unless a compatible decryption solution becomes available. Removing the malicious software may prevent additional encryption but will not restore files that have already been affected. The most practical recovery option is to restore the original data from clean, unaffected backups. Maintaining backups separately from production systems, particularly on offline or isolated storage, can help reduce the risk of backup data being encrypted during a ransomware incident.
The following are the TTPs based on the MITRE Attack Framework
| Tactic | Technique ID | Technique Name |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1129 | Shared Modules |
| Execution | T1574 | Hijack Execution Flow |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1055 | Process Injection |
| Privilege Escalation | T1134 | Access Token Manipulation |
| Privilege Escalation | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1548 | Abuse Elevation Control Mechanism |
| Discovery | T1012 | Query Registry |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1497 | Virtualization/Sandbox Evasion |
| Discovery | T1518 | Software Discovery |
| Collection | T1560 | Archive Collected Data |
| Command and Control | T1071 | Application Layer Protocol |
| Impact | T1485 | Data Destruction |
| Impact | T1486 | Data Encrypted for Impact |
| Impact | T1490 | Inhibit System Recovery |
| Impact | T1499 | Endpoint Denial of Service |
| Stealth | T1027 | Obfuscated Files or Information |
| Stealth | T1055 | Process Injection |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1134 | Access Token Manipulation |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1497 | Virtualization/Sandbox Evasion |
| Stealth | T1564.003 | Hide Artifacts: Hidden Window |
| Stealth | T1574 | Hijack Execution Flow |
Relevancy and Insights:
ETLM Assessment:
KansasGroup may evolve toward more sophisticated ransomware capabilities as its development progresses. Future variants could strengthen defense-evasion mechanisms by improving detection of sandboxes, virtualized environments, and debugging tools, allowing the malware to remain inactive or alter its execution when analysis conditions are detected. The existing use of execution delays and hidden PowerShell activity suggests that future versions may further refine techniques designed to reduce visibility and complicate automated behavioral analysis.
The ransomware may also expand its impact on recovery mechanisms by targeting additional backup solutions, recovery configurations, and security-related services. Beyond deleting shadow copies and disabling recovery features, future versions could potentially attempt to interfere with backup infrastructure, terminate security software, or disable monitoring services before initiating encryption. Such developments would increase the likelihood of successful encryption and make recovery more difficult for affected organizations.
Future iterations could also introduce stronger persistence and lateral-movement capabilities, enabling the ransomware to maintain access to compromised systems and potentially spread across connected environments. The observed use of native Windows utilities and system management components could provide a foundation for broader abuse of legitimate operating-system functionality. However, these developments are speculative and are not confirmed by the current sample. The most likely evolution is continued refinement of existing capabilities, particularly defense evasion, recovery inhibition, execution concealment, and broader disruption of enterprise environments.
Sigma rules:
title: Uncommon Svchost Command Line Parameter tags:
– attack.privilege-escalation
-attack.stealth
-attack.t1055
logsource:
category: process_creation product: windows
detection: selection:
# Example of command to simulate: “C:\Windows\System32\svchost.exe” calc.exe
Image|endswith: ‘\svchost.exe’
filter_main_flags:
CommandLine|re: ‘-k\s\w{1,64}(?:\s?(?:-p|-s))?’
filter_main_empty:
CommandLine: ”
filter_main_null:
CommandLine: null
filter_optional_defender:
ParentImage|endswith: ‘\MsMpEng.exe’
CommandLine|contains: ‘svchost.exe’
filter_optional_mrt:
ParentImage|endswith: ‘\MRT.exe’
CommandLine: ‘svchost.exe’
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives:
-Unlikely
level: high
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Type: Backdoor |Objectives: Persistence | Target Technology: Windows | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week
This week, “BlackSeeStealer” Malware is in focus.
Overview of Operation CNBackdoor Malware
CNBackdoor is a sophisticated Windows-based family designed to establish long-term unauthorized access while minimizing the likelihood of detection. The analyzed sample demonstrates a carefully orchestrated multi-stage infection process that prioritizes stealth, persistence, and operational resilience over immediate malicious activity. Rather than executing a single payload, the malware deploys multiple components that work together to maintain execution, evade security controls, and prepare the compromised system for subsequent attacker operations.
Malware employs several defense evasion techniques before activating its primary functionality. It attempts to weaken endpoint protection by modifying Microsoft Defender settings, deploys additional executable and script components into user-accessible directories, and creates scheduled tasks to ensure automatic re-execution after system restarts or user logins. These actions indicate that the malware is intended to survive remediation attempts and remain active on infected hosts for extended periods.
Behavior observed during analysis also suggests that the malware is designed to operate selectively within its target environment. It performs checks for virtualization platforms, debugging tools, and system characteristics before continuing execution, reducing the likelihood of exposure in automated malware analysis environments. The use of obfuscated code, indirect system interactions, and multiple execution stages further reflects an emphasis on remaining concealed while establishing a reliable foothold on victim systems.
Overall, the sample analyzed represents a capable backdoor that combines persistence, security bypass, and staged payload execution into a coordinated infection chain. Although the initial execution focuses primarily on preparing the environment rather than delivering destructive actions, the established access provides attackers with a platform for future malicious activities, including remote command execution, deployment of additional malware, credential theft, or broader compromise of the affected environment. Organizations should treat detections associated with this malware as indicators of a potentially serious intrusion requiring immediate investigation and containment.
Attack Method
The analyzed CNBackdoor sample follows a structured, multi-stage execution chain that begins with the execution of a seemingly legitimate installer (Installer_v3500_x64.exe). Immediately after launch, the malware creates multiple hidden PowerShell processes that operate in parallel to prepare the victim environment for compromise. One PowerShell instance modifies Microsoft Defender by adding exclusions for specific files, directories, and processes, effectively reducing the likelihood that the malware components will be scanned or quarantined. Simultaneously, another PowerShell process launches a secondary executable from the user’s roaming profile, transitioning the infection into its next operational stage.
Following deployment, the malware installs additional components within the%AppData%\Roaming\ExtendedMonitor\ directory, including the executables InterPartHKIAsync.exe and ioextender.exe, along with a VBScript (PathMarker.vbs). Persistence is achieved through the creation of a scheduled task named “Extended API 0136301”, configured to execute the VBScript every 20 minutes with the highest available privileges. VBScript silently launches the primary payload, allowing the malware to restore execution even if one of its processes is terminated. Temporary batch scripts are also generated to coordinate execution timing and remove selected files, indicating efforts to manage the malware lifecycle and reduce forensic evidence. Malware incorporates multiple defense evasion techniques before enabling its core functionality. During execution, it checks for virtualization artifacts and registry entries associated with virtual machine environments, while also searching for window classes linked to common debugging and process monitoring utilities. The malware further attempts to conceal its execution by hiding threads from debuggers, employing runtime unpacking techniques, and utilizing indirect system calls that can bypass user-mode security monitoring. Memory analysis additionally identified characteristics consistent with .NET code injection and GenericBot behavior, suggesting that significant portions of the malicious functionality are unpacked and executed dynamically in memory rather than remaining visible within the original executable.
Once persistence is established, the malware performs reconnaissance of the compromised environment and prepares for external communication. It queries Windows regional settings, including country-specific registry values, indicating support for geographically aware execution logic. The malware also retrieves the victim’s public IP address through external web services before communicating with remote infrastructure, potentially to profile infected systems or register new victims. This staged execution model, combined with strong persistence, security bypass techniques, and controlled network communication, demonstrates that CNBackdoor is designed to provide attackers with a resilient foothold that can support follow-on activities such as remote command execution, additional payload deployment, and long-term access to compromised Windows systems.
The following are the TTPs based on the MITRE ATT&CK Enterprise framework
| Tactic | Technique | Technique Name |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| T1059.005 | Command and Scripting Interpreter: Visual Basic | |
| T1204 | User Execution | |
| Persistence | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Stealth | T1027 | Obfuscated Files or Information |
| T1497 | Virtualization/Sandbox Evasion | |
| T1622 | Debugger Evasion | |
| T1218 | System Binary Proxy Execution | |
| Discovery | T1614 | System Location Discovery |
| T1016 | System Network Configuration Discovery | |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| T1105 | Ingress Tool Transfer |
INSIGHTS
ETLM ASSESSMENT
From an ETLM perspective, the behaviors exhibited by CNBackdoor suggest that future threat campaigns are likely to place greater emphasis on maintaining persistent, low-profile access within enterprise environments rather than pursuing immediate disruptive outcomes. As malware continues to incorporate layered execution, selective activation, and stealth-oriented operational models, organizations may experience longer attacker dwell times, making early detection increasingly challenging. Employees are also expected to remain a primary entry point through trusted software and installer-based delivery methods, increasing the likelihood of compromise through seemingly legitimate applications. Collectively, these trends indicate that future intrusion campaigns will become more patient, adaptive, and difficult to distinguish from routine system activity, allowing attackers to sustain access and expand their operational objectives over extended periods.
IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)
YARA Rules
rule CNBackdoor_Installer_v3500_x64
{meta: description = “Detects CNBackdoor based on observed artifacts and network communication” author = “CYFIRMA” date = “2026-08-03”
strings:
/* SHA-256 IOC */
$sha256 = “1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48”
/* C2 / Network Communication */
$domain1 = “tommysbakescodes.ws”
$url1 = “https://tommysbakescodes.ws/mnlinmwv/insris.php”
$url2 = “https://tommysbakescodes.ws/mnlinmwv/insirs.php”
$ipcheck1 = “api.ipify.org”
$ipcheck2 = “ipv4.icanhazip.com”
$ipcheck3 = “v4.ident.me”
/* Dropped Files */
$file1 = “InterPartHKIAsync.exe”
$file2 = “ioextender.exe”
$file3 = “PathMarker.vbs”
$file4 = “ExtendedMonitor”
/* Persistence */
$task = “Extended API 0136301”
$vbs = “CreateObject(\”WScript.Shell\”)”
$run = “ioextender.exe”
/* Defender Evasion */
$ps1 = “Add-MpPreference”
$ps2 = “WindowStyle Hidden”
$ps3 = “powershell.exe”
condition:
uint16(0) == 0x5A4D and
$sha256 and (
2 of ($domain*, $url*, $ipcheck*) or 4 of ($file*, $task, $vbs, $run, $ps*)
)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Key Intelligence Signals:
Please refer to the trending malware advisory for details on the following:
Lazarus Group: Evolution of Software Supply Chain Tradecraft
About the Threat Actor
Lazarus Group is a highly sophisticated North Korea-linked threat actor that has been active since at least 2009 and is widely assessed to operate in support of the DPRK’s strategic and intelligence objectives. Also tracked by the U.S. government as Hidden Cobra, the group is associated with Lab 110, an entity linked to North Korean military intelligence. Lazarus maintains advanced malware development capabilities, enabling it to rapidly evolve its toolsets, adapt existing exploits, and develop new offensive capabilities to evade detection.
The group has conducted a wide range of cyber espionage, disruptive, and financially motivated operations, with recent campaigns increasingly focusing on cryptocurrency organizations to generate revenue and support state objectives. Historically, Lazarus has been linked to high-profile operations including the Sony Pictures attack, Bangladesh Bank SWIFT heist, WannaCry ransomware, Operation Troy, DarkSeoul, and several long-running espionage campaigns. The group is believed to comprise multiple operational subgroups, including Andariel, which primarily targets South Korean interests, and Bluenoroff, which specializes in financially motivated operations and global espionage. Additionally, UNC1069 has been assessed to share infrastructure overlaps with Bluenoroff, indicating operational coordination within the broader Lazarus ecosystem.
Details on Exploited Vulnerabilities
TTPs based on the MITRE ATT&CK Framework
| Tactic | ID | Technique |
| Reconnaissance | T1591 | Gather Victim Org Information |
| Reconnaissance | T1591.004 | Gather Victim Org Information: Identify Roles |
| Reconnaissance | T1589.002 | Gather Victim Identity Information: Email Addresses |
| Reconnaissance | T1593.001 | Search Open Websites/Domains: Social Media |
| ResourceDevelopment | T1587.001 | Develop Capabilities: Malware |
| ResourceDevelopment | T1587.002 | Develop Capabilities: Code Signing Certificates |
| ResourceDevelopment | T1583.001 | Acquire Infrastructure: Domains |
| ResourceDevelopment | T1583.004 | Acquire Infrastructure: Server |
| ResourceDevelopment | T1583.006 | Acquire Infrastructure: Web Services |
| ResourceDevelopment | T1584.001 | Compromise Infrastructure: Domains |
| ResourceDevelopment | T1584.004 | Compromise Infrastructure: Server |
| ResourceDevelopment | T1585.001 | Establish Accounts: Social Media Accounts |
| ResourceDevelopment | T1585.002 | Establish Accounts: Email Accounts |
| ResourceDevelopment | T1588.002 | Obtain Capabilities: Tool |
| ResourceDevelopment | T1588.003 | Obtain Capabilities: Code Signing Certificates |
| ResourceDevelopment | T1588.004 | Obtain Capabilities: Digital Certificates |
| Initial Access | T1189 | Drive-by Compromise |
| Initial Access | T1566.001 | Phishing: Spear phishing Attachment |
| Initial Access | T1566.002 | Phishing: Spear phishing Link |
| Initial Access | T1078 | Valid Accounts |
| Initial Access | T0865 | Spear phishing Attachment |
| Initial Access | T1566.003 | Phishing: Spear phishing via Service |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell |
| Execution | T1053.005 | Scheduled Task/Job: Scheduled Task |
| Execution | T1106 | Native API |
| Execution | T1204.001 | User Execution: Malicious Link |
| Execution | T1204.002 | User Execution: Malicious File |
| Execution | T1203 | Exploitation for Client Execution |
| Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell |
| Execution | T1047 | Windows Management Instrumentation |
| Execution | T1059.005 | Command and Scripting Interpreter: Visual Basic |
| Execution | T1574.001 | Hijack Execution Flow: DLL |
| Execution | T1574.013 | Hijack Execution Flow: KernelCallbackTable |
| Persistence | T1505.004 | Server Software Component: IIS Components |
| Persistence | T1542.003 | Pre-OS Boot: Bootkit |
| Persistence | T1543.003 | Create or Modify System Process: Windows Service |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Persistence | T1078 | Valid Accounts |
| Persistence | T1098 | Account Manipulation |
| Persistence | T1547.009 | Boot or Logon Autostart Execution: Shortcut Modification |
| Privilege Escalation | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Privilege Escalation | T1098 | Account Manipulation |
| Privilege Escalation | T1547.009 | Boot or Logon Autostart Execution: Shortcut Modification |
| Privilege Escalation | T1543.003 | Create or Modify System Process: Windows Service |
| Privilege Escalation | T1055.001 | Process Injection: Dynamic-link Library Injection |
| Privilege Escalation | T1078 | Valid Accounts |
| Privilege Escalation | T1134.002 | Access Token Manipulation: Create Process with Token |
| Stealth | T1134.002 | Access Token Manipulation: Create Process with Token |
| Stealth | T1218 | System Binary Proxy Execution |
| Stealth | T1218.005 | System Binary Proxy Execution: Mshta |
| Stealth | T1218.010 | System Binary Proxy Execution: Regsvr32 |
| Stealth | T1218.011 | System Binary Proxy Execution: Rundll32 |
| Stealth | T1620 | Reflective Code Loading |
| Stealth | T1070 | Indicator Removal |
| Stealth | T1070.003 | Indicator Removal: Clear Command History |
| Stealth | T1070.004 | Indicator Removal: File Deletion |
| Stealth | T1202 | Indirect Command Execution |
| Stealth | T1036.003 | Masquerading: Rename Legitimate Utilities |
| Stealth | T1036.004 | Masquerading: Masquerade Task or Service |
| Stealth | T1036.005 | Masquerading: Match Legitimate Resource Name or Location |
| Stealth | T1036.008 | Masquerading: Masquerade File Type |
| Stealth | T1027.002 | Obfuscated Files or Information: Software Packing |
| Stealth | T1027.007 | Obfuscated Files or Information: Dynamic API Resolution |
| Stealth | T1027.009 | Obfuscated Files or Information: Embedded Payloads |
| Stealth | T1027.013 | Obfuscated Files or Information: Encrypted/Encoded File |
| Stealth | T1220 | XSL Script Processing |
| Stealth | T1497.003 | Virtualization/Sandbox Evasion: Time-Based Evasion |
| Stealth | T1622 | Debugger Evasion |
| Stealth | T1140 | Deobfuscate/Decode Files or Information |
| Stealth | T1564.001 | Hide Artifacts: Hidden Files and Directories |
| Stealth | T1684.001 | Social Engineering: Impersonation |
| Stealth | T1221 | Template Injection Authentication Process: Conditional Access Policies |
| Stealth | T1574.001 | Hijack Execution Flow: DLL |
| Stealth | T1574.013 | Hijack Execution Flow: KernelCallbackTable |
| Stealth | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Stealth | T1078 | Valid Accounts |
| DefenseImpairment | T1686.003 | Disable or Modify System Firewall: Windows Host Firewall |
| DefenseImpairment | T1685 | Disable or Modify Tools |
| Credential Access | T1056.001 | Input Capture: Keylogging |
| Credential Access | T1110.003 | Brute Force: Password Spraying |
| Credential Access | T1557.001 | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1057 | Process Discovery |
| Discovery | T1497.001 | Virtualization/Sandbox Evasion: System Checks |
| Discovery | T1497.003 | Virtualization/Sandbox Evasion: Time-Based Evasion |
| Discovery | T1087.002 | Account Discovery: Domain Account |
| Discovery | T1010 | Application Window Discovery |
| Discovery | T1046 | Network Service Discovery |
| Discovery | T1622 | Debugger Evasion |
| Discovery | T1082 | System Information Discovery |
| Discovery | T1012 | Query Registry |
| Discovery | T1614.001 | System Location Discovery: System Language Discovery |
| Discovery | T1016 | System Network Configuration Discovery |
| Discovery | T1049 | System Network Connections Discovery |
| Discovery | T1033 | System Owner/User Discovery |
| Discovery | T1680 | Local Storage Discovery |
| Discovery | T1124 | System Time Discovery |
| LateralMovement | T1021.002 | Remote Services: SMB/Windows Admin Shares |
| LateralMovement | T1021.001 | Remote Services: Remote Desktop Protocol |
| LateralMovement | T1021.004 | Remote Services: SSH |
| LateralMovement | T1534 | Internal Spearphishing |
| Collection | T1056.001 | Input Capture: Keylogging |
| Collection | T1560 | Archive Collected Data |
| Collection | T1560.001 | Archive Collected Data: Archive via Utility |
| Collection | T1560.002 | Archive Collected Data: Archive via Library |
| Collection | T1560.003 | Archive Collected Data: Archive via Custom Method |
| Collection | T1557.001 | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay |
| Collection | T1005 | Data from Local System |
| Collection | T1074.001 | Data Staged: Local Data Staging |
| Command and Control | T1071.001 | Application Layer Protocol: Web Protocols |
| Command and Control | T1571 | Non-Standard Port |
| Command and Control | T1132.001 | Data Encoding: Standard Encoding |
| Command and Control | T1001.003 | Data Obfuscation: Protocol or Service Impersonation |
| Command and Control | T1573.001 | Encrypted Channel: Symmetric Cryptography |
| Command and Control | T1090.001 | Proxy: Internal Proxy |
| Command and Control | T1090.002 | Proxy: External Proxy |
| Command and Control | T1104 | Multi-Stage Channels |
| Command and Control | T1008 | Fallback Channels |
| Command and Control | T1105 | Ingress Tool Transfer |
| Command and Control | T1102.002 | Web Service: Bidirectional Communication |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Exfiltration | T1567.002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
| Exfiltration | T1048.003 | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol |
| Impact | T1561.001 | Disk Wipe: Disk Content Wipe |
| Impact | T1561.002 | Disk Wipe: Disk Structure Wipe |
| Impact | T1489 | Service Stop |
| Impact | T1485 | Data Destruction |
| Impact | T1529 | System Shutdown/Reboot |
| Impact | T1491.001 | Defacement: Internal Defacement |
Latest Developments Observed
The threat actor is suspected of conducting coordinated software supply chain attacks by compromising trusted NPM package maintainer accounts and trojanizing widely used open-source libraries, including Axios, Debug, Chalk, and Typo-Crypto. The campaign appears to leverage social engineering and malicious package updates to compromise downstream developer environments, with the primary objective of gaining large-scale access for financially motivated operations and sensitive information theft.
ETLM Insights
Lazarus Group continues to demonstrate a mature and adaptive operational model centered on exploiting trusted software development ecosystems to support strategic intelligence collection and financially motivated operations. The group’s evolving tradecraft reflects a deliberate emphasis on compromising trusted software maintainers and open-source supply chains to achieve large-scale downstream access while maintaining operational stealth, scalability, and long-term resilience.
The threat actor’s operations reflect:
Looking ahead, Lazarus Group is expected to further strengthen its software supply chain capabilities by expanding abuse of trusted developer ecosystems, integrating AI-assisted development and social engineering techniques, and refining stealth-oriented intrusion methodologies. This continued evolution reinforces the group’s ability to conduct large-scale downstream compromises through trusted software dependencies, posing a sustained threat to organizations that rely on open-source software, modern DevOps environments, and interconnected software supply chains.
YARA Rules
rule Lazarus_SupplyChain_IOC_Hunting
{
meta:
author = “CYFIRMA”
description = “Detects Lazarus-related supply chain campaign artifacts based on observed IOCs”
date = “2026-08-03”
actor = “Lazarus Group” tlp = “TLP:CLEAR”
strings:
/* Domains */
$domain1 = “zmail.vetstarts.com” ascii nocase
$domain2 = “zimbra.planetink.com” ascii nocase
$domain3 = “www2.planetink.com” ascii nocase
$domain4 = “www1.planetink.com” ascii nocase
$domain5 = “www.vetstarts.com” ascii nocase
/* Installer / Payload names */
$file1 = “telloo trader.msi” ascii nocase
$file2 = “c:\\windows\\installer\\5fd39b9.msi” ascii nocase
$file3 = “c:\\windows\\installer\\505df9.msi” ascii nocase
$file4 = “c:\\windows\\installer\\3f217f.msi” ascii nocase
$file5 = “c:\\windows\\installer\\4059ff.msi” ascii nocase
/* CVE References */
$cve1 = “CVE-2023-22518” ascii
$cve2 = “CVE-2022-41082” ascii
$cve3 = “CVE-2022-41040” ascii
$cve4 = “CVE-2021-26855” ascii
$cve5 = “CVE-2021-34523” ascii
/* Infrastructure */
$ip1 = “91.132.144.59” ascii
$ip2 = “104.239.66.201” ascii
$ip3 = “73.158.81.165” ascii
$ip4 = “76.229.204.88” ascii
$ip5 = “68.183.59.139” ascii condition:
3 of ($domain*) or 3 of ($file*) or
3 of ($ip*) or
(2 of ($domain*) and 2 of ($file*)) or (2 of ($domain*) and 2 of ($ip*)) or (2 of ($file*) and 2 of ($ip*)) or
any of ($cve*)
}
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Iran likely behind a coordinated cyberattack on water systems in Minnesota
U.S. intelligence agencies assess that Iran was likely responsible for a coordinated cyberattack targeting over 30 municipal water systems in Minnesota. The FBI is actively investigating the intrusion, which briefly took at least one system offline while disrupting remote sensors on another and forcing workers to switch to manual operations. Minnesota IT Services confirmed that state and federal authorities are collaborating on threat intelligence and remediation, emphasizing that residents currently do not need to modify their drinking water usage.
The breach marks the latest in a series of digital intrusions striking American critical infrastructure since military conflict broke out on February 28. Federal cybersecurity officials have repeatedly warned that Iranian actors are actively targeting internet-exposed operational controls across the water, wastewater, and energy sectors. According to threat research experts, these ongoing disruptions represent a significant escalation in non-kinetic warfare, with Iranian-linked groups consistently probing vulnerable municipal networks nationwide.
ETLM Assessment:
Iran has been quietly carrying out cyberattacks against the U.S. since a conflict began on February 28. Cybersecurity experts point out that these attacks mostly focus on easy targets, such as small utility companies that use internet-connected controllers with default passwords. Similar incidents occurred in late 2023, when a group linked to Iran’s Islamic Revolutionary Guard Corps targeted water infrastructure using programmable logic controllers (PLCs) across multiple countries.
According to threat intelligence specialists, the main goals of these attacks are psychological rather than destructive; shifting American sentiment by trying to make people feel anxious about the costs of the war and demonstrating capability to influence the American public to domestic audiences, both writ large and to appear useful to Iran’s leadership. Government agencies, including the Cybersecurity and Infrastructure Agency (CISA), have issued warnings about these threats and urged organizations to disconnect vulnerable controllers from the internet and update default passwords immediately.
Russian hackers hijack Wi-Fi in hotels
Microsoft has officially attributed a widespread Wi-Fi hijacking campaign targeting routers at hotels and hospitality venues to Storm-2945, a subgroup of the Russian cyberespionage actor Midnight Blizzard. The operation compromises network routers to redirect unsuspecting travelers to malicious phishing portals designed to steal credentials and launch ClickFix social engineering attacks. In light of these findings, researchers advise travelers to avoid public hotel, conference, and airport networks whenever possible, recommending private connectivity options such as mobile hotspots, satellite links, or cellular eSIMs instead.
ETLM Assessment:
Storm-2945, also widely known by security researchers as APT29 or Cozy Bear, is an elite cyberespionage group tied directly to Russia’s Foreign Intelligence Service (SVR). They are the same group historically responsible for high-profile operations like the SolarWinds supply chain attack and breaches of major technology and government organizations worldwide.
Hotels, conference centers, and business lounges frequently host foreign diplomats, government officials, corporate executives, defense contractors, and journalists. Hijacking the Wi-Fi at these venues creates a digital dragnet to identify and target specific high-value individuals while they are away from their secure office networks. Stolen credentials from traveling executives allow Russian intelligence to bypass perimeter defenses and quietly infiltrate sensitive corporate or government networks back in the targets’ home countries, where Russia intends to gather intelligence of strategic value.
Gunra Ransomware Impacts a Manufacturing Company from Thailand
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Thailand was compromised by Gunra Ransomware. The Compromised company is a Thailand-based chemical manufacturer. The company specializes in the production and supply of plastic additives, particularly PVC stabilizers, serving customers across Thailand and the ASEAN region. According to the leak site, the ransomware incident appears to involve the compromise of technical data stored within an internal repository. Based on the available evidence, the exposed information may include engineering documentation, technical files, system configurations, project-related data, infrastructure information, source materials, and other proprietary technical assets. The total size of compromised data is approximately 100GB.
Source : Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Gunra Ransomware is a financially motivated ransomware group that emerged in April 2025, rapidly establishing itself as a significant threat within the evolving ransomware landscape. Leveraging a double-extortion model, Gunra encrypts victim data while simultaneously exfiltrating sensitive information to pressure organizations into paying ransom demands.
The Gentlemen Ransomware Impacts a Banking and Financial Services Company from the Philippines
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from the Philippines was compromised by The Gentlemen Ransomware. The compromised company is one of the Philippines’ leading savings banks, established in 1960. The bank offers a comprehensive range of retail banking products and services, including savings and checking accounts, time deposits, consumer loans, home loans, auto loans, SME financing, digital banking, and payment solutions. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
Vulnerability in JetBrains TeamCit
Relevancy & Insights:
The vulnerability exists due to improper input validation in fastjson type resolution logic when parsing user-supplied JSON input.
Impact:
A remote attacker can send a specially crafted JSON payload to execute arbitrary code.
Exploitation requires the application to run as a Spring Boot executable fat-jar under the default configuration with AutoType disabled and SafeMode disabled.
Affected Products:
https[:]//fearsoff[.]org/research/fastjson-1-2-83-rce
Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment
The vulnerability in JetBrains TeamCity presents a significant security risk to organizations that rely on TeamCity On-Premises for software build automation and Continuous Integration/Continuous Delivery (CI/CD) operations. As TeamCity commonly manages source code, build pipelines, deployment workflows, credentials, and software artifacts, successful exploitation of this unauthenticated remote code execution vulnerability could allow threat actors to gain control of the TeamCity server without requiring valid credentials. Such access may expose sensitive source code, configuration files, stored secrets, build artifacts, and deployment pipelines while enabling attackers to manipulate software development processes or introduce malicious code into enterprise environments. Because CI/CD platforms often serve as critical components within software supply chains, compromise of TeamCity can have cascading effects across multiple production systems and downstream applications. Organizations using TeamCity On-Premises should immediately apply the latest security updates or vendor-provided security patch plugin, restrict access to trusted networks, implement strong monitoring for anomalous server and agent activity, and review system logs for indicators of compromise. Prompt remediation and continuous monitoring are essential to protecting enterprise software development infrastructure and reducing the risk of supply chain compromise resulting from exploitation of this critical vulnerability.
Krybit Ransomware attacked and published the data of a Construction and Engineering company from Thailand
Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a Construction and Engineering company from Thailand on its dark web website. The Compromised company is the second-largest construction and engineering company in Thailand. The company provides comprehensive construction services across two core segments: Construction and Related Services (mass rapid transit systems, airports, roads and expressways, energy projects, water supply, harbour projects, and buildings); and Investment in Infrastructure Business (toll roads, MRT operations, hydropower, and water supply businesses). Notable completed projects include Bangkok’s MRT Blue Line, MRT Purple Line, BTS Skytrain extensions, Xayaburi Dam (Laos), Nam Ngum 2 Hydroelectric Power Plant (Laos), Royal Thai Police Headquarters, Phuket wastewater system, and Thai Airways International cargo maintenance area. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of data compromised is approximately 103.01 GB.
Source: Dark Web
Relevancy & Insights:
ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
Unauthorized Manufacturing Database Advertised on a Leak Site
Summary:
The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large database allegedly originating from a South Korean automotive parts manufacturing organization. According to the advertisement, the seller claims to possess complete database dumps extracted from the organization’s infrastructure, including information related to employees, manufacturing operations, customers, suppliers, business partners, and vehicle parts. The advertisement further states that the data is offered in CSV format and includes hundreds of database tables containing millions of records. Sample data has reportedly been shared as proof of possession, while the complete dataset is being offered for sale through a cybercrime marketplace. According to the forum advertisement, the complete database is being offered for sale at an asking price of USD 40,000
Based on the information shared in the forum advertisement, the allegedly exposed data may include:
The authenticity of the advertised dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and has not been independently confirmed.
Source: Underground Forums
Unauthorized Recruitment Platform Database Advertised on a Leak Site
Summary:
The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of a database allegedly obtained from a Japanese online recruitment platform. According to the forum advertisement, the dataset reportedly contains approximately 320,000 records in CSV format, with the seller offering the complete database for sale and publishing sample records as proof of possession. The advertisement claims the database contains personal information associated with platform users, including identity, contact, and profile-related data. The authenticity of these claims has not been independently verified. According to the forum advertisement, the complete database is being offered for sale at an asking price of USD 7000.
Based on the information shared in the forum post, the allegedly exposed dataset may include:
Potential Impact
If verified, exposure of this information could pose significant risks to affected individuals and the organization. Cybercriminals may exploit the leaked data to conduct:
The disclosure of user credentials and personal information may further enable attackers to correlate identities across multiple online services, increasing the likelihood of broader compromise where users have reused passwords or similar account information.
At the time of reporting, the authenticity of the alleged dataset remains unverified. This assessment is based solely on information published in the cybercrime forum advertisement and the accompanying sample screenshots. No independent verification has been performed regarding the origin, completeness, or legitimacy of the advertised data.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable entity primarily engaged in data-leak operations, with multiple credible indications linking them to incidents involving unauthorized system access and the dissemination or sale of stolen data on dark web forums. These activities underscore the growing sophistication of cyber threats driven by organized underground networks and highlight the urgent need for organizations to enhance their cybersecurity posture through continuous monitoring, improved threat intelligence, and proactive defensive measures to protect sensitive information and critical infrastructure.
Recommendations: Enhance the cybersecurity posture by:
The CYFIRMA research team identified a post on a dark web forum advertising a database allegedly originating from a telecommunications value-added services (VAS) provider operating in the Middle East. According to the advertisement, the dataset contains information associated with approximately 59,903 Saudi mobile subscribers and includes over 88,000 transaction events. The forum post claims that the leaked data includes subscriber information, transaction history, billing-related records, and technical service metadata. The dataset is reportedly being offered as a free download, accompanied by sample records intended to demonstrate possession of the data. The authenticity of the advertised dataset has not been independently verified. The reporting structure follows the format of the uploaded document.
Based on the information shared in the forum advertisement, the allegedly exposed data may include:
Potential Impact
If verified, exposure of this information could pose significant risks to affected subscribers and the service provider. Cybercriminals could exploit the leaked data to conduct targeted phishing campaigns, SIM swap attacks, identity theft, social engineering, credential stuffing, business email compromise (BEC), fraudulent subscription activities, and unauthorized account access. The availability of transaction history, technical metadata, and billing-related information may further facilitate financial fraud, abuse of telecommunications services, and additional attacks against associated platforms and subscribers.
The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and has not been independently confirmed.
Source: Underground Forums
STRATEGIC RECOMMENDATIONS
MANAGEMENT RECOMMENDATIONS
TACTICAL RECOMMENDATIONS
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.
