Ransomware in focus CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.
Type: Ransomware Target Technologies: Windows OS Targeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, Chile
Targeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation
Introduction: CYFIRMA Research and Advisory Team has found Fiasco Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
Fiasco Ransomware Fiasco Ransomware is a file-encrypting ransomware that compromises systems, encrypts files using the AES algorithm, and appends the .secure extension to affected filenames. For example, files such as 1.jpg and 2.png are renamed to 1.jpg.secure and 2.png.secure. The malware also creates a ransom note named US.txt after encryption. In addition to file encryption, the attackers claim to have exfiltrated sensitive information before encryption, including personal records, financial documents, customer information, business-confidential files, source code, databases, accounting data, and audit reports. This makes the threat a double-extortion ransomware, combining data encryption with the threat of public data disclosure.
Screenshot: File encrypted by ransomware
(Source: Surface Web)
The ransom note informs victims that their network has been compromised and that their files have been encrypted, while threatening to publish the allegedly stolen data if the victim does not cooperate. It instructs victims to establish through a private messaging service and provide a specified identification key so the attackers can identify the victim and continue ransom negotiations. No fixed ransom amount is provided; payment demands and further instructions are apparently given after communication is established. The note also attempts to discourage victims from seeking outside assistance by warning against third-party decryption tools, authorities, recovery specialists, and intermediaries, while threatening permanent data loss, fraud, identity theft, reputational damage, financial losses, regulatory consequences, and exposure of confidential information if the ransom demands are not followed.
Screenshot: The appearance of Fiasco’s ransom note ( US.txt) (Source: Surface Web)
Following are the TTPs based on the MITRE Attack Framework.
Relevancy and Insights:
The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities. calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system. The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities. Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult. Check-bios: The ransomware checks the system’s BIOS information to identify characteristics of the underlying machine, such as the manufacturer, model, or firmware details. This information can help the malware determine whether it is running on a physical Windows system, virtualized environment, or an analysis/sandbox setup. Such checks may support environment awareness and anti-analysis behavior, allowing the ransomware to alter or avoid execution when suspicious system characteristics are detected.
calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system. The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities. Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult. Check-bios: The ransomware checks the system’s BIOS information to identify characteristics of the underlying machine, such as the manufacturer, model, or firmware details. This information can help the malware determine whether it is running on a physical Windows system, virtualized environment, or an analysis/sandbox setup. Such checks may support environment awareness and anti-analysis behavior, allowing the ransomware to alter or avoid execution when suspicious system characteristics are detected.
The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities. Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult. Check-bios: The ransomware checks the system’s BIOS information to identify characteristics of the underlying machine, such as the manufacturer, model, or firmware details. This information can help the malware determine whether it is running on a physical Windows system, virtualized environment, or an analysis/sandbox setup. Such checks may support environment awareness and anti-analysis behavior, allowing the ransomware to alter or avoid execution when suspicious system characteristics are detected.
Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult. Check-bios: The ransomware checks the system’s BIOS information to identify characteristics of the underlying machine, such as the manufacturer, model, or firmware details. This information can help the malware determine whether it is running on a physical Windows system, virtualized environment, or an analysis/sandbox setup. Such checks may support environment awareness and anti-analysis behavior, allowing the ransomware to alter or avoid execution when suspicious system characteristics are detected.
Check-bios: The ransomware checks the system’s BIOS information to identify characteristics of the underlying machine, such as the manufacturer, model, or firmware details. This information can help the malware determine whether it is running on a physical Windows system, virtualized environment, or an analysis/sandbox setup. Such checks may support environment awareness and anti-analysis behavior, allowing the ransomware to alter or avoid execution when suspicious system characteristics are detected.
ETLM Assessment: Fiasco Ransomware is likely to evolve by improving its stealth, environment awareness, and encryption capabilities to make detection and analysis more difficult. Future variants may expand their use of Windows-native utilities, system APIs, WMI, registry modifications, and other legitimate system components to blend malicious activity with normal administrative operations. The malware may also strengthen its anti-analysis mechanisms by performing more extensive checks for virtual machines, sandboxes, debugging environments, BIOS characteristics, security software, and other indicators of automated analysis. Additional techniques for disabling recovery mechanisms, terminating security-related processes, deleting backups and shadow copies, and maintaining persistence could further increase its impact on compromised Windows systems.
Future versions may also place greater emphasis on data theft and double-extortion operations, potentially targeting a wider range of sensitive files before encryption. Attackers could automate the identification and collection of high-value information such as financial records, databases, credentials, source code, and confidential business documents, followed by threats of public disclosure to increase pressure on victims. The ransomware may further evolve through more sophisticated command-and-control mechanisms, configurable encryption routines, and improved evasion techniques. Overall, the likely evolution of Fiasco is toward a more stealthy, automated, and resilient ransomware operation that combines rapid file encryption, recovery inhibition, sensitive-data exfiltration, and extortion to maximize operational and financial impact.
Sigma rule: title: Boot Configuration Tampering Via Bcdedit.EXE tags: – attack.impact – attack.t1490 logsource: category: process_creation product: windows detection: selection_img: – Image|endswith: ‘\bcdedit.exe’ – OriginalFileName: ‘bcdedit.exe’ selection_set: CommandLine|contains: ‘set’ selection_cli: – CommandLine|contains|all: – ‘bootstatuspolicy’ – ‘ignoreallfailures’ – CommandLine|contains|all: – ‘recoveryenabled’ – ‘no’ condition: all of selection_* falsepositives: – Unlikely level: high (Source: Surface Web) Indicators of Compromise Kindly refer to the IOCs section to exercise control of your security systems (Source: Surface Web)
STRATEGIC RECOMMENDATION
Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
Ensure that backups of critical systems are maintained which can be used to restore data in case a need arises.
MANAGEMENT RECOMMENDATION
A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) If there is a requirement to inform the local authority.
To reduce the risk of credentials being compromised, enable multifactor authentication (MFA) and zero-trust architecture.
Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.
TACTICAL RECOMMENDATION
Ensure that all applications and software are consistently maintained by deploying the most recent releases and applying available security updates and patches in a timely manner.
Incorporate the Sigma rule for threat detection and monitoring, which will assist in identifying and tracking suspicious activity as well as detecting anomalies in log events.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
Focus Malware of the Week
Active Malware of the Week Type: RAT (Remote Access Trojean) Objectives: Survillance and Data Exfiltration Target Technology: Windows Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the week This week “LiquidRAT” Malware is in focus.
Overview of Operation LiquidRAT Malware LiquidRAT is a malicious remote-access threat designed to establish and maintain unauthorized control over a compromised system. Its observed behavior indicates that the malware is intended to operate quietly in the background while providing an attacker with continued access to the affected environment. Rather than performing a single disruptive action, it combines several capabilities that allow an intrusion to remain active and potentially expand over time.
The sample demonstrates a clear interest in information available on the compromised device, including sensitive account information, browser-related data, local files, and system configuration. This activity indicates that the malware is focused on gathering information that could be useful to an attacker. From an organizational perspective, such behavior creates the possibility of unauthorized access to business information, user accounts, and other valuable resources.
LiquidRAT also incorporates mechanisms intended to maintain its presence after routine system events such as restarts or user logons. At the same time, its behavior shows an effort to reduce the likelihood of being discovered and removed. This combination of persistence and stealth increases the potential exposure period, allowing unauthorized activity to continue even when the original point of compromise is no longer obvious.
The overall assessment indicates that LiquidRAT represents a significant security concern because it provides a sustained foothold from which an attacker can monitor the affected system, gather information, and maintain communication with external infrastructure. Organizations should therefore treat any confirmed presence of the malware as a potential compromise rather than an isolated malware detection and conduct appropriate investigation, containment, and remediation activities.
Attack Method Upon execution on a Windows system, LiquidRAT establishes an initial execution state by creating mutex objects that help prevent multiple copies of the malware from running simultaneously. The use of unique mutex names, including OneSettingQueryMutex+compat+encapsulation and WillyRat_Client_SingleInstance_Mutex, indicates that the sample performs an instance check before continuing its activity. It also performs limited host-level checks to understand the environment in which it is running. The malware further employs memory-based execution techniques that reduce the amount of directly observable code on disk and complicate conventional static examination. Activity consistent with code injection allows portions of its functionality to operate within legitimate processes, making process-level identification more challenging.
The malware establishes persistence through multiple Windows autostart locations. It modifies the user’s Run registry configuration so that the malicious component can be launched when the affected user signs in. It also places a component in the user’s Startup directory, providing a second mechanism for automatic execution during logon. This redundancy increases the likelihood that the malware will remain operational if one persistence location is removed. In parallel, LiquidRAT incorporates techniques intended to conceal its activity, remove selected traces from the system, and obtain elevated privileges. These behaviors collectively make remediation more difficult and can reduce the amount of evidence available for subsequent investigation.
A significant part of the malware’s operation is dedicated to collecting information from the compromised host. It accesses Windows credential-related data and attempts to obtain cached authentication material without requiring direct user interaction. The malware also targets browser data stores, including locations containing saved credentials and session-related information such as cookies. In addition, it searches and reads files stored locally on the system, potentially exposing documents, configuration information, and other sensitive content. Before or alongside collection, the malware performs host and process discovery and examines aspects of the system and its security environment, allowing it to understand the available resources and identify information of potential value.
The collected information is prepared for communication with external infrastructure controlled by the operator. Analysis identified communication with multiple external endpoints, including services such as api.ipify.org, demonstrating that the malware maintains network connectivity as part of its operational workflow. This communication channel provides the implant with a means to exchange information with its remote infrastructure and potentially support additional activity after the initial compromise. The combination of single-instance control, memory-based execution, persistent autostart mechanisms, privilege-related activity, host discovery, credential and browser-data collection, local file access, and external communication demonstrates a multi-stage attack method designed to maintain access while extracting valuable information from the compromised Windows environment.
Following are the TTPs based on the MITRE Attack Framework for Enterprise
LiquidRAT’s overall design suggests that the compromised system is treated as a source of opportunity rather than simply a target for disruption. Its activity reflects an emphasis on obtaining information that can provide continuing value to an attacker, particularly information connected to user activity and access. This makes the threat more closely associated with unauthorized information acquisition and account abuse than with immediate system damage.
The sample also reveals a level of operational maturity in how its different capabilities complement one another. Its behavior does not appear to be a collection of unrelated functions; instead, the activities observed during analysis support a broader intrusion objective. The combination of information gathering, system awareness, and continued operation indicates that considerable attention was given to making the malware useful after the initial compromise.
Another notable insight is the apparent value placed on identity and access-related information. The focus on credentials and browser-associated information suggests that access itself may be more valuable to the operator than any individual document stored on the machine. This distinction is important because compromised accounts can potentially provide access beyond the originally infected endpoint, making the affected system a possible entry point into a wider environment rather than an isolated victim.
ETLM ASSESSMENT From an ETLM perspective, LiquidRAT-like threats are likely to contribute to a future where malware-driven compromises become increasingly intertwined with normal business activity rather than appearing as isolated security incidents. Organizations may face greater operational and financial consequences as compromised identities are used across legitimate services, making the boundary between genuine employee activity and attacker activity harder to distinguish. For employees, this could translate into greater disruption to routine work, increased scrutiny of account activity, and a higher likelihood that a single compromised identity triggers consequences beyond the original device. As criminal ecosystems become more organized, the value of access may increasingly extend beyond immediate data theft, with compromised accounts potentially becoming steppingstones for fraud, impersonation, and broader business disruption. The resulting incidents are therefore likely to demand faster organizational decision-making and stronger coordination between security, IT, and business teams, particularly as the distinction between a malware infection and a wider identity-related compromise becomes less clear.
IOCs: Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)
YARA Rule rule LiquidRAT_Malware { meta: description = “Detection rule for the analyzed malware sample” author = “CYFIRMA” date = “9-01-2026”
strings: $hash = “38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057” $s1 = “C:\\Windows\\System32\\fodhelper.exe” $s2 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding” $s3 = “C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\” /svc” $s4 = “C:\\Windows\\System32\\svchost.exe -k NetworkService -p” $s5 = “C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup” $s6 = “C:\\Windows\\system32\\sppsvc.exe” $s7 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc” $s8 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost” $s9 = “C:\\Windows\\system32\\lsass.exe” $s10 = “C:\\Windows\\system32\\svchost.exe -k LocalService -s W32Time” $s11 = “C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p” $s12 = “C:\\Users\\user\\AppData\\Roaming\\WindowsRuntime\\winrt.exe\” –u USERNAME_PLACEHOLDER –n \”NOTE_PLACEHOLDER” $s13 = “C:\\Users\\user\\AppData\\Roaming\\WindowsRuntime\\winrt.exe –u USERNAME_PLACEHOLDER –n \”NOTE_PLACEHOLDER” $s14 = “VaultSvc” $s15 = “clipsvc” $s16 = “PcaSvc” $s17 = “BITS” $s18 = “WSearch” $s19 = “dnsCache” $s20 = “executable.exe” $s21 = “C:\\Users\\ \\Desktop\\executable.exe” $s22 = “winrt.exe” $s23 = “%APPDATA%\\windowsruntime\\winrt.exe” $s24 = “stealer.exe” $s25 = “%TEMP%\\windowsruntime\\stealer.exe” $s26 = “trtlvpe.exe” $s27 = “C:\\gqqwhk\\trtlvpe.exe” $s28 = “file.exe” $s29 = “C:\\Users\\user\\Desktop\\file.exe” $s30 = “ $s31 = “c.pki.goog/r/gsr1.crl” $s32 = “ $s33 = “c.pki.goog/r/gsr1.crl0” $s34 = “ $s35 = “c.pki.goog/r/r4.crl” $s36 = “ $s37 = “c.pki.goog/r/r4.crl0” $s38 = “ $s39 = “c.pki.goog/we1/JWW3Gj56Zd4.crl” $s40 = “LiquidRAT” condition: $hash or 3 of ($s*) }
STRATEGIC RECOMMENDATION
Establish an organization-wide endpoint security strategy covering malware prevention, detection, and response.
Prioritize protection of sensitive credentials and business information stored or accessed from employee endpoints.
Adopt layered security controls so that a single compromised endpoint does not provide prolonged access to organizational resources.
Conduct periodic threat assessments to identify exposure to multi-purpose malware and similar information-stealing threats.
MANAGEMENT RECOMMENDATION
Direct affected users to rotate passwords and confirm multi-factor enrolment as part of the response checklist.
Ensure endpoint protection and security monitoring capabilities are consistently deployed across employee systems.
Establish clear incident-response procedures for suspected malware infections, including isolation, investigation, and recovery.
Provide regular security-awareness training focused on suspicious files, links, downloads, and unexpected system activity.
Maintain appropriate controls over access to sensitive corporate information and user accounts.
TACTICAL RECOMMENDATION
Audit Run/RunOnce registry values and Startup-folder entries for unfamiliar items and remove anything created by this threat.
Block delivery infrastructure such as ‘api.ipify.org’ at DNS, proxy and firewall level, and inspect egress logs for prior retrievals.
Force password resets and revoke active sessions for users on affected systems; verify MFA coverage to blunt harvested-credential replay.
Monitor endpoints for unusual PowerShell activity, unexpected process trees and unauthorized changes to security settings.
Block and monitor the infrastructure listed in the IOC section at DNS, proxy and perimeter controls.
Isolate confirmed cases promptly, then reset credentials and review autostart locations before restoration.
Weekly Intelligence Trends/Advisory
1. Weekly Attack Type and Trends
Key Intelligence Signals:
Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
Ransomware –Krybit Ransomware, The Gentlemen Ransomware | Malware – LiquidRAT
Krybit Ransomware – One of the ransomware groups.
The Gentlemen Ransomware – One of the ransomware groups.
Please refer to the trending malware advisory for details on the following:
Behaviour –Most of these malware use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.
2. Threat Actor in Focus
Tortoiseshell: Recent Infrastructure Expansion and Evolution of Operational Capabilities
Threat Actor: Tortoiseshell aka UNC1549
Attack Type: AppDomainManager Hijacking, DLL Sideloading, Impersonation, Malware Implant, Social Engineering, Spear-Phishing
Objective: Espionage, Credential Theft
Suspected Target Technology: Microsoft Azure, Windows OS
Suspected Target Geography: Albania, India, Israel, Turkey, UAE, US
Suspected Target Industries: Aerospace & Defense, Automotive & Manufacturing, Consulting & Professional Services, Education, Energy & Utilities, Financial Services, Government & Public Administration, Human Resources & Recruitment, Information Technology, Information Services & Media, Telecommunications, Transportation & Logistics, Research & Development, Software & Technology, Nonprofit & Religious Organizations, Advertising & Marketing.
Business Impact: Data Theft, Operational Disruption, Reputational Damage
the Threat Actor UNC1549, an Iranian threat actor linked to Tortoiseshell and potentially to the IRGC, has been active since at least June 2022 and has targeted entities globally, with a primary focus on organizations across the Middle East. Threat actor is suspected of leveraging spear-phishing and credential harvesting for initial access, followed by the deployment of custom malware, including the MINIBIKE and MINIBUS backdoors. The threat actor has also employed evasion techniques and the LIGHTRAIL tunneler during its operations. While UNC1549 maintains a strong regional focus on Middle Eastern targets, its observed activities indicate a potential expansion toward entities across other regions globally.
TTPs based on MITRE ATT&CK Framework
Latest Developments Observed The threat actor Tortoiseshell is assessed to be expanding its operational infrastructure and geographic targeting across the Middle East and Europe, with newly identified infrastructure containing subdomains resembling country names, including the UAE, Saudi Arabia, UK, Belgium, Canada, Australia, and Japan. The investigation also uncovered previously unreported malware, including an SSH-based tunneling utility and a TWOSTROKE backdoor capable of executing shell or file commands, uploading and exfiltrating files, downloading files, and conducting reconnaissance. The findings indicate continued development of Tortoiseshell’s operational capabilities and ongoing use of infrastructure and tooling to maintain access to targeted environments.
ETLM Insights Tortoiseshell (UNC1549) is demonstrating increasing operational maturity through the expansion of infrastructure and continued use of custom tooling to support access to targeted environments. The discovery of infrastructure across the Middle East and Europe indicates that the actor may be broadening its operational reach beyond its historically observed regional focus.
The threat actor’s recent activity highlights:
Infrastructure diversification through geographically distributed servers and country-themed subdomains, potentially supporting operations against a wider range of regional targets.
Network-level access capabilities through reverse SSH tunneling, enabling traffic from attacker-controlled infrastructure to reach compromised internal networks.
Expanded post-compromise functionality through the TWOSTROKE-like backdoor, supporting command execution, file transfer, reconnaissance, and in-memory DLL execution.
C2 resilience through multiple hardcoded C2 servers, allowing compromised systems to communicate with alternative infrastructure if a primary server becomes unavailable.
Looking ahead, the threat actor is likely to further diversify its infrastructure and refine its remote-access capabilities to support persistent operations across strategically relevant targets. The continued use of tunneling utilities and capable backdoors suggests that maintaining reliable access and extending control within compromised environments will remain important elements of the actor’s operations.
IOCs: Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules rule Threat_Indicators_Secur32_Domains_CVEs { meta: description = “Detects known domains, CVE references, and secur32.dll indicator” author = “CYFIRMA” date = “2026-08-31”
strings: $domain1 = “ramiltons-finance.azurewebsites.net” ascii wide nocase $domain2 = “ramiltonsfinance.azurewebsites.net” ascii wide nocase $domain3 = “ramiltonsfinance.com” ascii wide nocase $domain4 = “premier-healthadvisory.azurewebsites.net” ascii wide nocase
$cve1 = “CVE-2023-2033” ascii wide nocase $cve2 = “CVE-2023-2136” ascii wide nocase $cve3 = “CVE-2023-41991” ascii wide nocase $cve4 = “CVE-2023-41992” ascii wide nocase $cve5 = “CVE-2023-41993” ascii wide nocase
$dll = “secur32.dll” ascii wide nocase
condition: 1 of ($domain*) or 1 of ($cve*) or $dll }
Strategic Recommendations
Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
Assess and deploy alternatives for an advanced endpoint protection solution that provides detection/prevention for malware and malicious activities that do not rely on signature-based detection methods.
Deploy Zero Trust Policy that leverages tools like security information management, advanced security analytics platforms, security user behaviour analytics, and other analytics systems to help the organization’s security personnel observe in real-time what is happening within their networks so they can orient defences more intelligently.
Management Recommendations
Look for email security solutions that use ML- and AI-based anti-phishing technology for BEC protection to analyze conversation history to detect anomalies, as well as computer vision to analyze suspect links within emails.
Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.
Move beyond the traditional model of security awareness towards Improved Simulation and training exercises that mimic real attack scenarios, account for behaviors that lead to a compromise, and are measured against real attacks the organization receives.
Tactical Recommendations
For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
Set up DMARC (Domain-based Message Authentication Reporting & Conformance) to stop phishers from spoofing your domain (that is, making their emails look like they come from your organization).
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
Add the YARA rule for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.
3. Major Geopolitical Developments in Cybersecurity
China-Linked Hackers Targeting NASA, DOJ, Fed and US Senate US authorities have disrupted online infrastructure used by a Chinese state- hacking group targeting key American agencies and critical infrastructure. According to the Department of Justice, the FBI and partner agencies disabled two platforms – QScan and QTRouter – operated by QTFY, a contractor linked to Nanjing Xinjiuwei Network Technology. The group, which offers cyber operations to China’s Ministry of State Security and People’s Liberation Army, used the platforms to mask malicious traffic while targeting entities including NASA, the Department of Energy, the Federal Reserve, and the US Senate.
ETLM Assessment: According to the statement, QScan scans and automatically infects thousands of [IoT] devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers. QTRouter then serves as an ‘obfuscation network’ – meaning it allows QTFY and other malicious cyber actors to conceal the PRC origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks. The campaign underscores what US officials describe as a sustained, strategic effort by Beijing to infiltrate key American networks and collect critical intelligence.
Iran Recruiting Thousands of Hacktivist Hackers Ravin Academy, a US-sanctioned Iranian cybersecurity training firm, has announced its largest recruitment drive to date, offering up to 1,200 free scholarships despite federal efforts to shut it down. According to public reporting, the yearlong program recruits Iranians aged 17 to 30, drawing on unauthorized materials from major US tech firms and offering pathways to fulfill military service or work for Iran’s Ministry of Intelligence. While there is no direct evidence linking the academy to recent breaches – such as July cyberattacks on US water systems linked to Iranian-affiliated groups – analysts warn the expanding academy serves as a key feeder for Iran’s strategic cyberwarfare operations. The firm also maintains ties to Positive Technologies, a US-sanctioned Russian cybersecurity company linked to Russian intelligence.
ETLM Assessment: Stripped of cash by US sanctions and facing targeted strikes on its state-run cyber command, Iran has adapted its defense doctrine to a distributed mosaic approach, relying on private academies and outsourced hacktivists to maintain its offensive posture on a budget.
This decentralized pipeline offers Tehran a low-cost, resilient engine to scale up proxy hacktivism and persistent nuisance attacks while navigating severe domestic financial constraints.
4. Rise in Malware/Ransomware and Phishing
Krybit Ransomware Impacts a Manufacturing Company from Thailand
Attack Type: Ransomware
Target Industry: Manufacturing
Target Geography: Thailand
Ransomware: Krybit Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage
Summary: CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Thailand was compromised by Krybit Ransomware. The compromised company is a Thai manufacturer and distributor of metal sheet products established in 2002 as a joint venture, providing high-quality metal roofing, siding, flooring, and ceiling solutions for factories, warehouses, and homes across Thailand. Products are crafted from premium materials like Zincalume and Colorbond from NS BlueScope Steel, ensuring durability, style, and cost-effectiveness. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
The following screenshot was observed published on the dark web:
Relevancy & Insights:
Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is paid.
The Krybit Ransomware group primarily targets countries such as India, Thailand, France, Brazil, and Taiwan.
The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Healthcare, Real Estate & Construction, and Government & Civic.
Based on the Krybit Ransomware victims list from 1st Jan 2026 to 01st September 2026, the top 5 Target Countries are as follows:
The Top 10 Industries most affected by the Krybit Ransomware group victims list from 1st Jan 2026 to 01st September 2026 are as follows:
ETLM Assessment: According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
The Gentlemen Ransomware Impacts a Manufacturing Company from Japan
Attack Type: Ransomware
Target Industry: Manufacturing
Target Geography: Japan
Ransomware: The Gentlemen Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage
Summary: CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a Japanese manufacturing company based in Numazu, Shizuoka, established in 1971. They specialize in powder handling technology, providing comprehensive solutions for the storage, feeding, weighing, and transportation of bulk powders. The company designs and manufactures custom industrial equipment and container systems for various industries dealing with fine particulate materials. The compromised data includes confidential and sensitive information belonging to the organization.
Relevancy & Insights:
The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Italy.
The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 01st September 2026, the top 5 Target Countries are as follows:
The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 01st September 2026 are as follows:
ETLM Assessment: According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
5. Vulnerabilities and Exploits
Vulnerability in Spring Cloud Gateway
Attack Type: Vulnerabilities & Exploits
Target Technology: Web Application
Vulnerability: CVE-2026-47879
CVSS Base Score: 7.7 Source
Vulnerability Type: Improper Access Control
Summary: The vulnerability allows a remote user to access native files and perform server-side request forgery.
Relevancy & Insights: The vulnerability exists due to improper access control in JsonToGrpcGatewayFilterFactory when processing proto descriptor resource locations.
Impact : A remote privileged user can specify an arbitrary Spring Resource location to access native files and perform server-side request forgery.
Affected Products: https[:]//spring[.]io/security/cve-2026-47879
Recommendations: Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED PRODUCTS OF THE WEEK This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment: The vulnerability in Spring Cloud Gateway presents a significant security risk to organizations using the affected versions, particularly because successful exploitation can allow unauthorized access to native files and enable server-side request forgery. The JsonToGrpcGatewayFilterFactory, when processing proto descriptor resource locations, allows a remote privileged user to specify an arbitrary Spring Resource location. Successful exploitation could allow threat actors to access sensitive files from the underlying system, interact with unintended internal or external resources, disclose sensitive information, and potentially compromise the security of systems accessible from the affected Gateway instance. As exploitation requires privileged access, organizations should prioritize protecting administrative and configuration interfaces and limiting access to trusted users and networks. Organizations using affected versions of Spring Cloud Gateway should upgrade to the latest available security update and ensure that resource locations used for proto descriptors are restricted to trusted and permitted resource prefixes. In addition, organizations should monitor Gateway activity for anomalous resource requests, attempts to access native files, and suspicious server-side requests to unexpected destinations. Prompt remediation and continuous monitoring are recommended to reduce the risk of sensitive information disclosure and server-side request forgery resulting from exploitation of this vulnerability.
6. Latest Cyber-Attacks, Incidents, and Breaches
Settra Ransomware Attacked and Published the Data of a Real Estate Company from Japan
Threat Actor: Settra Ransomware
Attack Type: Ransomware
Objective: Data Leak, Financial Gains
Target Technology: Web Applications
Target Industry: Real Estate
Target Geography: Japan
Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage
Summary: Recently, we observed that Settra Ransomware attacked and published the data of a Real Estate company from Japan on its dark web website. The compromised organisation is a Japanese real estate management group operating through several legal entities, including a real estate agency, a property management subsidiary, a holding division, and an investment arm. The group manages residential properties across Tokyo and Kanagawa through a network of offices, providing lease and property management services to both individual and corporate clients. The ransomware attack reportedly involved the exposure of approximately 437 GB of data, including internal corporate documents, a full VPN network diagram with public IP addresses, employee login credentials, 449 lease transaction files, background-check records, 363 active insurance policies, customer-portal credentials, banking IP-VPN configuration containing a pre-shared key, and an insurance payment database containing 833 transactions with recipient banking details. The exposed archive also reportedly includes investment-related documents concerning participation as a shareholder in a blockchain company, along with lease agreements, insurance-related records, financial documents, invoices, and other sensitive business information.
Relevancy & Insights:
Settra Ransomware is an emerging financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to pressure victims by encrypting systems and/or threatening to publish stolen data unless a ransom is paid. The group was first publicly observed in June 2026. The Settra Ransomware group demonstrates opportunistic targeting across multiple industries, with reported victims spanning Technology, Manufacturing, Professional Services, Consumer Services, Transportation & Logistics, Agriculture & Food Production, Construction, Hospitality, and Financial Services. This indicates that the group does not appear to be restricted to a single industry vertical.
The Settra Ransomware group demonstrates opportunistic targeting across multiple industries, with reported victims spanning Technology, Manufacturing, Professional Services, Consumer Services, Transportation & Logistics, Agriculture & Food Production, Construction, Hospitality, and Financial Services. This indicates that the group does not appear to be restricted to a single industry vertical.
ETLM Assessment: According to CYFIRMA’s assessment, Settra represents an emerging, financially motivated ransomware and data-extortion threat that relies on data theft and public exposure to increase pressure on victims. The group maintains a leak site and has demonstrated an opportunistic targeting strategy across multiple industries and countries. Although Settra has been associated with ransomware-style encryption and double-extortion activity, its technical attribution and operational structure remain under assessment due to its recent emergence in 2026. Organizations should therefore prioritize strong identity and access controls, protection of VPN and privileged credentials, continuous network monitoring, endpoint detection, data-loss prevention, and resilient offline backups to detect and mitigate potential Settra-related intrusions.
Thailand-Based Healthcare Technology Database Advertised on a Leak Site
Attack Type: Data Leak
Target Industry: Healthcare Technology / Healthcare Services
Target Geography: Thailand
Objective: Financial Gains
Reported Data Volume: 24 GB
Business Impact: Potential Data Loss, Privacy Exposure, Reputational Damage
Summary: The CYFIRMA research team identified a post observed on a dark web leak platform that claims the exposure of approximately 24 GB of database data belonging to a Thailand-based healthcare technology organization. The organization develops technology solutions for hospitals and healthcare providers, with services reportedly including custom software and hardware, Electronic Health Record (EHR) systems, telemedicine platforms, healthcare consulting, and research and development (R&D). The post identifies the database as a leaked dataset and lists a dump date of 29 August 2026.
Organization Profile According to the information displayed in the post, the affected organization operates in the healthcare technology sector and provides technology-driven solutions intended to support hospitals and healthcare organizations.
Its reported areas of operation include:
Custom healthcare software and hardware
Electronic Health Record (EHR) systems
Telemedicine platforms
Healthcare consulting
Research and Development (R&D)
Technology solutions designed to improve healthcare efficiency and patient care
Leaked Data The post claims that approximately 24 GB of database information has been leaked. However, the provided image cuts off immediately after the statement “In this leak, the database contains:” and does not display the specific categories of records contained in the datab...