CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: Ransomware Target Technologies: Windows OS
Introduction: CYFIRMA Research and Advisory Team has found UMBRA Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
UMBRA Ransomware UMBRA is a file-encrypting ransomware that targets data stored on an infected Windows system. During execution, it encrypts accessible files and appends the .umbra extension to their existing filenames, resulting in filenames such as 1.jpg.umbra and 2.png.umbra. It also creates a victim-specific ransom note named README_[victim_ID].txt and modifies the desktop wallpaper with a custom image, providing visible indicators of compromise. The malware follows a double-extortion model: in addition to encrypting local data, the operators claim to exfiltrate sensitive information and threaten to disclose it if the ransom demand is not fulfilled.
Screenshot: File encrypted by ransomware (Source: Surface Web)
The ransom note informs the victim that their files have been encrypted and states that stolen data may be publicly released if communication with the operators is not established. Each infected system is assigned a unique hexadecimal decryption ID, which the victim is instructed to provide through an anonymous communication portal. The note also contains operational warnings intended to prevent interference with the encrypted data, specifically advising against deleting or modifying encrypted files and against attempting recovery with external decryption utilities, claiming such actions could result in permanent data corruption or loss. Overall, the note functions as both a notification of encryption and a mechanism for directing victims toward attacker-controlled communication while reinforcing the extortion threat.
Screenshot: The appearance of UMBRA’s ransom note (README_[victim_ID].txt) (Source: Surface Web)
Screenshot: The appearance of UMBRA’s ransomware Wallpaper (Source: Surface Web)
The following are the TTPs based on the MITRE ATT&CK Framework
Relevancy and Insights:
The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities.
calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system.
The ransomware terminates processes such as vssadmin.exe Delete Shadows /all/quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.
Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior, such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.
ETLM Assessment: UMBRA could evolve beyond its current file-encryption capability by adopting more sophisticated intrusion and evasion mechanisms. Future variants may focus on compromising systems before encryption, obtaining higher privileges, disabling or bypassing security controls, and targeting network-connected resources rather than limiting activity to individual endpoints. The malware could also become more selective which files and systems it affects, allowing attackers to maximize operational disruption while reducing the chance of early detection. This direction is consistent with the broader ransomware landscape, where attackers increasingly combine credential abuse, lateral movement, data theft, and rapid exploitation into a single intrusion chain.
The extortion component of UMBRA is also likely to become more significant. Future versions could place greater emphasis on stealing sensitive information before encryption, allowing attackers to maintain leverage even when victims can recover their files from backups. The current double-extortion model could therefore develop into multi-stage extortion involving threats to disclose stolen information or cause additional operational disruption. Ransomware operations are already showing movement toward data-exfiltration-only attacks because stolen information can remain valuable even when encryption is successfully defeated. Consequently, a future UMBRA variant may rely less on the .umbra encryption impact itself and more on persistent access, data theft, and pressure against the victim to increase the likelihood of payment.
Sigma rules: title: Boot Configuration Tampering Via Bcdedit.EXE tags: – attack.impact – attack.t1490 logsource: category: process_creation product: windows detection: selection_img: – Image|endswith: ‘\bcdedit.exe’ – OriginalFileName: ‘bcdedit.exe’ selection_set: CommandLine|contains: ‘set’ selection_cli: – CommandLine|contains|all: – ‘bootstatuspolicy’ – ‘ignoreallfailures’ – CommandLine|contains|all: – ‘recoveryenabled’ – ‘no’ condition: all of selection_* falsepositives: – Unlikely level: high (Source: Surface Web)
IOCs: Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
STRATEGIC RECOMMENDATIONS
Implement competent security protocols and encryption, authentication, or access credential configurations to access critical systems in your cloud and local environments.
Ensure that backups of critical systems are maintained, which can be used to restore data in case the need arises.
MANAGEMENT RECOMMENDATIONS
A data breach prevention plan must be developed considering (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
Implement a zero-trust security model alongside multifactor authentication (MFA) to reduce the risk of credential compromise.
Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.
TACTICAL RECOMMENDATIONS
Update all applications/software regularly with the latest versions and security patches alike.
Add the Sigma rules for threat detection and monitoring, which will help to detect anomalies in log events, identify and monitor suspicious activities.
Establish and implement protective controls by actively monitoring and blocking identified indicators of compromise (IoCs) and reinforcing defensive measures based on the provided tactical intelligence.
Active Malware of the Week
Type: Infostealer | Objectives: Credential Theft and Data Exfiltration | Target Technology: Windows | Target Geography: Global CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week This week, NyxStealer Malware is in focus.
Overview of Operation NyxStealer Malware The analyzed sample, identified as NyxStealer, is a malicious program designed to operate quietly on compromised systems while maintaining access over time. Its behavior shows clear intent to interact with the affected machine, monitor information of interest, and establish a continued presence rather than performing a single, isolated malicious action.
The malware shows particular interest in information that may be present during normal user activity, including clipboard content, local files, and system settings. This creates a potential risk for sensitive business information, credentials, account details, and other data that may temporarily reside on an employee’s workstation.
The sample also demonstrates mechanisms intended to survive system restarts and user logons. This means that simply restarting an affected machine may not remove the threat, allowing the malware to continue operating without requiring additional action from the user. Its efforts to remain less visible further increase the difficulty of identifying and removing the compromise.
Overall, the presence of NyxStealer should be treated as a serious security incident rather than an isolated malware detection. Its ability to maintain access, observe user activity, interact with locally stored information, and communicate with external infrastructure indicates that the affected system may have been deliberately targeted for information collection and continued access.
Attack Method Upon execution on a Windows system, the malware begins by establishing controls over its own execution and profiling the host environment. It creates mutex objects, including OneSettingQueryMutex+compat+encapsulation and AmiProviderMutex_InventoryApplicationFile, to prevent multiple instances of the payload from operating simultaneously. It then performs host reconnaissance using native system utilities such as tasklist, allowing it to identify running processes and gather information the system, user environment, network configuration, installed software, and available security controls. The malware can use these environmental indicators to determine whether the host is suitable for continued execution and may terminate or modify its behavior when conditions appear suspicious.
The sample subsequently employs memory-oriented execution and process manipulation to make its activity more difficult to inspect. Its use of reflective, memory-based techniques reduces reliance on conventional on-disk execution and can complicate static analysis because important payload components may only become available during runtime. The malware also demonstrates behavior consistent with code injection, enabling its malicious code to operate within the context of a legitimate process. By abusing trusted process execution, it can attempt to blend with normal system activity and reduce the effectiveness of application-control mechanisms that rely primarily on identifying suspicious executable files.
For persistence, the malware places components within the user’s Windows Startup directory, causing the malicious code to be launched automatically when the affected user signs in. This provides a straightforward mechanism for maintaining execution across system restarts without requiring the victim to manually launch the malware again. In parallel, the sample uses techniques intended to evade visibility and attempts to bypass User Account Control (UAC), potentially allowing it to obtain higher privileges while reducing the likelihood of generating obvious user-facing warnings. The combination of automatic startup, privilege elevation, and concealed execution gives the malware a stronger foothold on the compromised workstation.
Data collection represents a major component of the malware’s operation. The sample systematically accesses local files and documents that may contain valuable information while also monitoring clipboard activity, potentially capturing passwords, cryptocurrency wallet addresses, copied credentials, confidential text, and other transient data. Before transferring information externally, it performs additional reconnaissance of processes, system conditions, and security-related components to understand the compromised environment. The collected information can then be communicated to attacker-controlled infrastructure through multiple external endpoints, including legitimate internet-facing services such as api.ipify.org. This combination of host discovery, persistence, privilege escalation, stealth, information collection, and external communication demonstrates a multi-stage attack method designed to maintain access while extracting valuable information from the compromised system.
The following are the TTPs based on the MITRE ATT&CK Framework for Enterprise
The behavior of NyxStealer indicates that the malware is primarily interested in valuable digital identity information, rather than simply causing disruption to the infected computer. Its attention to credentials, browser-related information, and user-generated content suggests that access to an individual’s digital accounts may be more valuable to the operator than the underlying device itself. This makes the compromise significant because stolen information can have value beyond the original endpoint.
Another notable insight is the malware’s apparent selectivity in how it operates. Rather than treating every compromised machine identically, its environment checks indicate an attempt to understand the system before proceeding further. This behavior provides an indication that the malware is designed to distinguish useful targets from less valuable environments, suggesting that the operator’s objective is to obtain information from systems that can provide meaningful access or financial value.
The overall behavior also suggests a structured and purpose-driven malware operation. Different capabilities appear to support a common objective: obtaining information while reducing the chances of the activity being noticed. The combination of information theft, environmental awareness, and efforts to maintain access indicates that the malware was designed around the value of the information it can obtain, making the incident more significant than a conventional unwanted software infection.
ETLM ASSESSMENT For the ETLM perspective, the future impact of threats such as NyxStealer is likely to extend beyond individual endpoints, as stolen information increasingly becomes a catalyst for wider business disruption. Organizations may face greater exposure to fraudulent transactions, unauthorized use of employee accounts, privacy incidents, and loss of customer trust when compromised information is reused elsewhere. Employees are also likely to experience more targeted and convincing follow-on attacks, where information gathered from one compromise is used to make subsequent deception appear legitimate. As a result, a single infected device could increasingly become the starting point for broader organizational consequences, making information-stealing malware a growing business risk rather than simply an endpoint security issue.
IOCs: Kindly refer to the IOCs below to exercise controls on your security systems. (Source: Open Surface)
YARA Rules rule NyxStealer_Malware { meta: description = “Detection rule for the analyzed malware sample” author = ” CYFIRMA Research”
strings: $hash = “84114420fc4a73b25f6d70d44893bf7a5d5ac7d7418dcca1e5574681cee85c36” $s1 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”tasklist /fo csv 2>nul” $s2 = “tasklist /FI \”USERNAME eq \” /FI \”IMAGENAME eq SyncClient.exe\” /FO csv” $s3 = “C:\\Windows\\system32\\find.exe\” \”SyncClient.exe” $s4 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding” $s5 = “C:\\Users\\ \\AppData\\Local\\Programs\\chiloutvrmod\\SyncClient.exe ” $s6 = “C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Appinfo” $s7 = “C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted – p” $s8 = “consent.exe 1552 516 000001F3E143A600” $s9 = “wscsvc” $s10 = “PcaSvc” $s11 = “WSearch” $s12 = “SyncClient.exe” $s13 = “program.exe” $s14 = “C:\\Users\\ \\Desktop\\program.exe” $s15 = “FO csv” $s16 = “syncclient.exe” $s17 = “%LOCALAPPDATA%\\programs\\chiloutvrmod\\syncclient.exe” $s18 = “tlovhurr.exe” $s19 = “C:\\tflq\\tlovhurr.exe” $s20 = “C:\\Users\\user\\Desktop\\program.exe” $s21 = “3472 – taskhost.exe SYSTEM” $s22 = “3576 – taskhost.exe $(Arg0)” $s23 = “OneSettingQueryMutex+compat+encapsulation” $s24 = “AmiProviderMutex_InventoryApplicationFile” $s25 = “chiloutvrmodProcessSingletonStartup” $s26 = “7cde390c-5ca8-54f7-812f-4146f75ded62” $s27 = “SyncRootManager” $s28 = “\\REGISTRY\\A\\{8e9d7769-f601-4364-39fd- e5b0e969c619}\\Root\\InventoryApplicationFile\\WritePermissionsCheck” $s29 = “\\REGISTRY\\A\\{8e9d7769-f601-4364-39fd- e5b0e969c619}\\Root\\InventoryApplicationFile\\syncclient.exe|e5d6d61295a855 0f\\ProgramId” $s30 = “\\REGISTRY\\A\\{8e9d7769-f601-4364-39fd- e5b0e969c619}\\Root\\InventoryApplicationFile\\syncclient.exe|e5d6d61295a855 0f\\FileId” $s31 = “NyxStealer” condition: $hash or 2 of ($s*) }
Strategic Recommendations
Establish an organization-wide endpoint security strategy covering malware prevention, detection, and response.
Prioritize protection of sensitive credentials and business information stored or accessed from employee endpoints.
Adopt layered security controls so that a single compromised endpoint does not provide prolonged access to organizational resources.
Conduct periodic threat assessments to identify exposure to multi-purpose malware and similar information-stealing threats.
Management Recommendations
Direct affected users to rotate passwords and confirm multi-factor enrolment as part of the response checklist.
Ensure endpoint protection and security monitoring capabilities are consistently deployed across employee systems.
Establish clear incident-response procedures for suspected malware infections, including isolation, investigation, and recovery.
Provide regular security-awareness training focused on suspicious files, links, downloads, and unexpected system activity.
Maintain appropriate controls over access to sensitive corporate information and user accounts.
Tactical Recommendations
Audit Run/RunOnce registry values and Startup-folder entries for unfamiliar items and remove anything created by this threat.
Monitor endpoints for unusual PowerShell activity, unexpected process trees, and unauthorized changes to security settings.
Block and monitor the infrastructure listed in the IOC section at DNS, proxy, and perimeter controls.
Isolate confirmed cases promptly, then reset credentials and review autostart locations before restoration.
CYFIRMA’s Weekly Insights
1. Weekly Attack Types and Trends
Key Intelligence Signals:
Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
Ransomware – RansomHouse Ransomware, The Gentlemen Ransomware| Malware – NyxStealer
RansomHouse Ransomware– One of the ransomware groups.
The Gentlemen Ransomware – One of the ransomware groups. Please refer to the trending malware advisory for details on the following:
Malware – NyxStealer Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.
2. Threat Actor in Focus
Lazarus Group: Campaign Activity, Targeting and Infrastructure Evolution
Threat Actor: Lazarus Group
Attack Type: Botnet Operations, Malware Implant, DLL Injection Attacks, Direct IP-based C2 Communication, Impersonation, Obfuscation, Open Proxy Usage, Credential Stealing, Social Engineering Attack, Supply Chain Attacks, Ransomware Attacks, Cryptocurrency theft, Exploitation of Vulnerabilities.
Objective: Information theft, Cyber Espionage, Financial Gains, Credential Theft.
Suspected Target Technology: Windows, macOS, Linux, SAP Systems, Cryptocurrency Exchanges, Financial Platforms (including SWIFT), JetBrains TeamCity, Oracle Products, Dell Systems, Atlassian Confluence, Citrix NetScaler ADC/Gateway, GitHub and GitLab repositories, Microsoft Visual Studio Code.
Suspected Target Geography: Argentina, Australia, Bangladesh, Belgium, Brazil, Brunei, Canada, Chile, China, Cyprus, Darussalam, Democratic People’s Republic of Korea, Denmark, Ecuador, Estonia, France, Germany, Guatemala, Hong Kong, Hongkong, Hungary, India, Indonesia, Iran, Iraq, Ireland, Islamic Republic of Iran, Israel, Italy, Japan, Korea, Republic of, Luxembourg, Malaysia, Malta, Mexico, Myanmar, Netherlands, New Zealand, Panama, Philippines, Poland, Republic of Korea, Romania, Russia, Russian Federation, Saudi Arabia, Seychelles, Singapore, Slovenia, South Africa, South Korea, Spain, Sri Lanka, Sweden, Switzerland, Taiwan, Taiwan, Province of China, Thailand, Turkey, Türkiye, Ukraine, United Arab Emirates, United Kingdom, United States, Vietnam.
Suspected Target Industries: Advertising Agencies, Aerospace & Defense, Air Transportation, Banking, Capital Markets, Communication Services, Computer Systems Design & Related Services, Cryptocurrency, Data Processing & Hosting, Defense, Diversified Financial Services, Educational Services, Energy, Entertainment, Financials, Government & Public Sector / Critical Infrastructure, Health Care, Information Services, Information Technology, Insurance, Media, Motor Vehicle Manufacturing, National Security, Public Administration, Software, Software Publishers, Space & Defense, Telecommunications, Utilities, Travel Agencies.
Business Impact: Financial Loss, Data Theft, Operational Disruption, Reputational Damage.
the Threat Actor Lazarus Group is a highly sophisticated North Korea-linked threat actor that has been active since at least 2009 and is widely assessed to operate in support of the DPRK’s strategic and intelligence objectives. Also tracked by the U.S. government as Hidden Cobra, the group is associated with Lab 110, an entity linked to North Korean military intelligence. Lazarus Group possesses advanced malware development capabilities, allowing it to rapidly evolve its toolsets, adapt existing exploits, and develop new offensive capabilities designed to evade detection.
The group has conducted a broad range of cyber espionage, disruptive, and financially motivated operations, with recent campaigns increasingly targeting cryptocurrency organizations to generate revenue and support state objectives. Historically, the threat actor has been linked to high-profile operations including the Sony Pictures attack, Bangladesh Bank SWIFT heist, WannaCry ransomware, Operation Troy, DarkSeoul, and several long-running espionage campaigns. The group is believed to comprise multiple operational subgroups, including Andariel, which primarily targets South Korean interests, and Bluenoroff, which specializes in financially motivated operations and global espionage. Additionally, UNC1069 has been assessed to infrastructure overlaps with Bluenoroff, indicating potential operational coordination within the broader Lazarus ecosystem.
Details on Exploited Vulnerabilities
TTPs based on MITRE ATT&CK Framework
Latest Developments Observed The threat actor is suspected of targeting South Korean automotive and media organizations with a previously undocumented Linux-based toolkit designed for long-term access and surveillance. The toolkit includes a custom HAProxy-based “ted” backdoor, trojanized system daemons, an SSH keylogger, and CurlRAT, enabling credential harvesting, remote command execution, data exfiltration, traffic interception, and selective malicious script injection. The activity has been assessed with medium confidence as linked to DPRK-aligned APT activity, with APT37 infrastructure associations identified in the observed C2 infrastructure.
ETLM Insights Lazarus Group continues to demonstrate a highly adaptive and multi-dimensional operational model combining cyber espionage, disruptive activity, and financially motivated operations in support of broader DPRK strategic objectives. Its ability to rapidly develop malware, adapt existing exploits, and evolve offensive capabilities enables the group to maintain persistent access while adjusting its tradecraft against changing defensive environments.
The threat actor’s operations reflect:
Rapid capability development through evolving malware and exploitation techniques.
Multi-objective operations combining intelligence collection, disruption, and financial gain.
Specialized operational capabilities across espionage-focused and financially motivated activities.
Adaptive tradecraft designed to improve stealth, persistence, and resilience against defensive controls.
Looking ahead, Lazarus Group is expected to further mature its malware-development and exploitation capabilities while continuing to diversify its operational objectives and targeting. The group is likely to refine its ability to rapidly adapt offensive tooling and intrusion techniques, enabling more persistent and resilient campaigns across espionage, disruptive, and financially motivated operations.
IOCs: Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules rule Threat_Indicators_2026 { meta: description = “Detects files containing provided threat intelligence indicators” author = “CYFIRMA” date = “2026-09-08” reference = “Threat Intelligence IOCs”
strings: // IP addresses $ip1 = “209.127.228.186” ascii wide $ip2 = “162.241.230.122” ascii wide $ip3 = “82.118.248.205” ascii wide $ip4 = “162.241.99.71” ascii wide $ip5 = “24.199.118.157” ascii wide
// Domains / configuration $domain1 = “config.data” ascii wide $domain2 = “uxtramine.org” ascii wide $domain3 = “enveil.online” ascii wide $domain4 = “envell.xyz” ascii wide
// CVEs $cve1 = “CVE-2026-54121” ascii wide $cve2 = “CVE-2012-5687” ascii wide $cve3 = “CVE-2013-5947” ascii wide $cve4 = “CVE-2013-7389” ascii wide $cve5 = “CVE-2014-1225” ascii wide
// Files / malware artifacts $file1 = “myreader.apk” ascii wide $file2=”remotepe_2024-05-11_710f15302859c7af1c1e25219d704841b3fdbc48f16a5a574d5ab6cf4f4842e8.bin” ascii wide // Generic artifact indicators $shell = “shell script” ascii wide $winexe = “win32 exe” ascii wide condition: 1 of ($ip*) or 1 of ($domain*) or 1 of ($cve*) or 1 of ($file*) or $shell or $winexe }
Strategic Recommendations
Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
Establish comprehensive identification and prioritization of cyber risks associated with third-party vendors and services through periodic risk assessments, vulnerability assessments, and system reviews.
Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more, by identifying such patterns.
Management Recommendations
Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.
Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.
Strengthen boundary defense such as network segmentation and have a strong access management capability in line with the Principle of Least Privilege (POLP) that can assist in mitigating cyberattacks.
Tactical Recommendations
For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
Use a software development lifecycle (SDLC) and incorporate secure software development practices throughout all lifecycle phases.
Apply security measures to detect unauthorized activities, protect sensitive production, and process control systems from cyberattacks.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events, identify and monitor suspicious activities.
3. Major Geopolitical Developments in Cybersecurity
Russian and other state-backed hackers target EU officials via messaging apps The European Union confirmed that state- threat actors – primarily originating from Russia, Iran, and China – are rapidly shifting their phishing vectors from traditional email to encrypted messaging applications like Signal and WhatsApp.
Throughout 2026, the European Union’s Joint Cyber Unit identified at least eight “significant” account-takeover incidents targeting high-ranking officials across member states. In Germany, attackers compromised the Bundestag President (speaker of parliament) via Signal, while Dutch authorities reported widespread campaigns targeting dignitaries, military personnel, and diplomats across both WhatsApp and Signal. The risk reached a point where the European Commission instructed a group of senior officials to abandon a high-level Signal group chat due to fear of active compromise.
ETLM Assessment: Rather than relying on zero-day software vulnerabilities or complex malware, these groups leverage pure social engineering to exploit the implicit trust, speed, and urgency with which high-level government employees interact with instant messaging. Attackers frequently impersonate official support teams or automated chatbots, issuing fake security alerts to trick targets into revealing their account PINs, or prompt them to scan QR codes that silently link an attacker’s secondary device to the victim’s account. Moving communications to these consumer apps allows threat actors to operate entirely outside the visibility of standard enterprise security monitoring while enabling them to wipe their tracks using disappearing message features.
US Senate Considers Private Sector Contracts for Military Hacking Under a provision in the Senate’s fiscal 2027 defense authorization bill, private contractors would be permitted to conduct offensive cyber operations with U.S. government authorization – potentially marking the first time Congress would have explicitly authorized private sector military hacking.
The proposal creates a pilot program under U.S. Cyber Command, permitting private firms to execute “access generation” operations (breaking into targeted adversary systems) under Pentagon oversight. This initiative aligns with the administration’s National Cybersecurity Strategy, which aims to leverage private sector capabilities to scale national defense against foreign cyber threats. It also builds on a White House memorandum issued earlier this summer that authorized private firms to perform broader “cyber effects operations” – including disruption and destruction – against foreign cyber-enabled transnational criminal organizations under the direction of the Justice Department and Department of Homeland Security.
ETLM Assessment: This shift toward privatization occurs amid major structural strain and an ongoing overhaul known as “Cybercom 2.0.” U.S. Cyber Command faces severe workforce pressures, persistent talent shortages, intensifying workloads driven by multiple overseas conflicts, and rising internal concerns over operational burnout and operator mental health. Boosters view private contractors as a necessary force multiplier to address government shortfalls. Conversely, critics warn that establishing a commercial military hacking industry introduces significant risks of unintended escalation, foreign retaliation, and insufficient oversight. If enacted in the final National Defense Authorization Act (NDAA), the pilot program would launch by March 1, 2027.
4. Rise in Malware/Ransomware and Phishing
RansomHouse Ransomware Impacts a Retail and E-commerce Company from Japan
Attack Type: Ransomware
Target Industry: Retail and E-commerce
Target Geography: Japan
Ransomware: RansomHouse Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage
Summary: CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by RansomHouse ransomware. The compromised company is a Japanese retail and e-commerce company headquartered in Shinjuku, Tokyo. The company operates a diversified portfolio of entertainment, reuse, apparel, lifestyle-goods, and e-commerce businesses through several retail brands. The compromised data includes confidential and sensitive information belonging to the organization.
Relevancy & Insights:
RansomHouse emerged in March of 2022 and is categorized as a multi-pronged extortion threat. The attackers exfiltrate all sensitive data and threaten to post it publicly.
The RansomHouse Ransomware group primarily targets countries such as the United States of America, Brazil, China, Japan, and Thailand.
The RansomHouse Ransomware group primarily targets industries such as Manufacturing, Government & Civic, Real Estate & Construction, Information Technology, and Healthcare.
Based on the RansomHouse Ransomware victims list from 1st Jan 2026 to 08th September 2026, the top 5 Target Countries are as follows:
The Top 10 Industries most affected by the RansomHouse Ransomware group victims list from 1st Jan 2026 to 08th September 2026 are as follows:
ETLM Assessment: According to CYFIRMA’s assessment, RansomHouse ransomware predominantly targets large enterprises and high-value organizations through phishing and spear phishing campaigns. The group also employs third-party frameworks such as Vatet Loader, Metasploit, and Cobalt Strike to gain initial access and perform lateral movements within victim networks. RansomHouse typically skips data encryption, focusing instead on exfiltrating sensitive data to extort victims by threatening to publicly release the stolen information. This approach allows the group to maintain stealth and prolong their presence in targeted environments.
The Gentlemen Ransomware Impacts a Manufacturing Company from Malaysia
Attack Type: Ransomware
Target Industry: Manufacturing
Target Geography: Malaysia
Ransomware: The Gentlemen Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage
Summary: CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Malaysia was compromised by The Gentlemen Ransomware. The compromised company is a Malaysian publicly listed company primarily involved in automotive manufacturing and automotive component production. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Relevancy & Insights:
The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Italy.
The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 08th September 2026, the top 5 Target Countries are as follows:
The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 08th September 2026 are as follows:
ETLM Assessment: According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
5. Vulnerabilities and Exploits
Vulnerability in Elastic Agent
Attack Type: Vulnerabilities & Exploits
Target Technology: Endpoint Security
Vulnerability: CVE-2026-78604
CVSS Base Score: 7.8 Source
Vulnerability Type: Incorrect Permission Assignment for Critical Resource
Summary: The vulnerability allows a local user to execute arbitrary code with SYSTEM privileges.
Relevancy & Insights: The vulnerability exists due to incorrect permission assignment for a critical resource in resources used by the Elastic Agent service when running on Windows systems with Elastic Agent installed in unprivileged mode.
Impact: A local user can replace binaries to execute arbitrary code with SYSTEM privileges. Only Windows deployments using the unprivileged installation mode are affected.
Affected Products: https[:]// [.]elastic[.]co/t/elastic-agent-8-19-21-9-4-6-9-5-2-security-update-esa-2026-150/390109
Recommendations: Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment: The vulnerability in Elastic Agent presents a significant security risk to organizations using affected versions on Windows systems configured with the unprivileged installation mode. The vulnerability is caused by incorrect permission assignment for critical resources used by the Elastic Agent service, potentially allowing a local low-privileged user to replace or tamper with binaries used by the service. Successful exploitation could allow threat actors to execute arbitrary code with SYSTEM privileges and potentially gain full control of the affected Windows system. Although exploitation requires existing local access and low-level privileges, the vulnerability does not require user interaction and could enable a significant escalation of privileges following initial access to an endpoint. Organizations using affected versions of Elastic Agent should prioritize upgrading to the latest available security update and identify systems where the unprivileged installation mode is in use. In addition, organizations should review access permissions associated with Elastic Agent resources and restrict local user access to critical binaries and service-related files. Security teams should also monitor affected endpoints for unauthorized modifications to Elastic Agent binaries, suspicious local processes, and unexpected SYSTEM-level process execution. Prompt remediation and continuous monitoring are recommended to reduce the risk of local privilege escalation and potential compromise of affected Windows systems.
6. Latest Cyber-Attacks, Incidents, and Breaches
Dire Wolf Ransomware attacked and published the data of an Industrial Machinery & Equipment company from Indonesia
Threat Actor: Dire Wolf Ransomware
Attack Type: Ransomware
Objective: Data Leak, Financial Gains
Target Technology: Web Applications
Target Industry: Industrial Machinery & Equipment
Target Geography: Indonesia
Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage
Summary: Recently, we observed that Dire Wolf Ransomware attacked and published the data of an Industrial Machinery & Equipment company from Indonesia on its dark web website. The compromised organisation is s a prominent Indonesian corporation established in 1970. Initially focused on heavy equipment solutions, the company has grown into a diversified holding group operating across multiple sectors supporting industrial development and infrastructure in Indonesia. The compromised data reportedly includes approximately 64 GB of sensitive corporate information, primarily related to financial and payment operations, including financial documents, email backups, Purchase-to-Pay (P2P) records, payment requests and approvals, purchase orders (POs), invoices, general-ledger records, bank-account information, cost-centre details, tax records, vendor and customer numbers, employee-related information, and SAP user IDs. The exposed dataset also reportedly contains master-data and financial reports, more than 27,000 detailed payment-request records containing hundreds of PO line items, and over 30,000 purchase-order documents, including trade and non-trade POs and associated document URLs. The data warehouse reportedly totals approximately 63.3 GB across more than 183,000 objects, indicating substantial exposure of financial, procurement, accounting, banking, and business-operational information.
Relevancy & Insights:
Dire Wolf is a newly emerged ransomware group that surfaced in May 2025. It operates an onion-based data leak site (DLS) where it posts information its victims, including file trees, sample files, and descriptions of stolen data.
The Dire Wolf Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Transportation & Logistics, Information Technology, and Consumer Goods & Services
ETLM Assessment: According to CYFIRMA’s assessment, the Dire Wolf ransomware group emerged in May 2025, distinguished by its use of double-extortion tactics combining data encryption with data theft and threats of public exposure via an onion-based leak site. The group appears to operate solely for financial gains, without ideological motives. Its emergence highlights the evolving nature of ransomware threats in 2025, particularly the increased reliance on data exfiltration to amplify extortion efforts. These activities reinforce the urgent need for strong cybersecurity defenses and effective incident response strategies across all sectors.
Cryptocurrency Customer Database Advertised on a Leak Site
Attack Type: Data Leak
Target Industry: Financial Services
Target Geography: Singapore
Objective: Financial Gains
Business Impact: Exposure of Personally Identifiable Information (PII), Customer Data Disclosure, Identity Theft Risks, Phishing and Social Engineering Risks, Regulatory Compliance Concerns, Financial Loss, and Reputational Damage
Customer information
Structured customer database records
Additional account or customer-related information
The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.
Source: Underground Forums
Customer, Rider and Vendor Database Advertised for Sale on a Leak Site
Attack Type: Data Leak
Target Industry: Food Delivery / Local Commerce / Digital Platform
Target Geography: Malaysia
Objective: Financial Gains
Business Impact: Exposure of Customer and Employee/Contractor Data, Privacy Risks, Financial Fraud, Identity Theft, Account Takeover, Regulatory Compliance Concerns, Reputational Damage
Customer Database: Approximately 300,518 records
Geographic coordinates
Delivery Rider Database: Approximately 22,508 records
Full identification card (IC) number
License expiry information
Road tax expiry information
Vendor Database: Approximately 28,562 records
Geographic coordinates
E-Wallet Transaction Data:
Approximately 1,245 sample transaction rows reportedly provided as proof of possession
Source: Underground Forums
Relevancy & Insights: Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment: The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure.
Recommendations: Enhance the cybersecurity posture by: 1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited. 2. Ensure proper database configuration to mitigate the risk of database-related attacks. 3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.
8. Other Observations
Allegedly Exposed Information
SMS and messaging traffic
OTP and verification messages
Authentication-related communications
Mobile phone numbers or recipient information
Message content and metadata
Transactional messaging records
Customer or account-related messaging information
Communication timestamps and delivery information
Messaging-service records associated with global organizations
Other data contained within the allegedly leaked 12 TB database
Potential Impact If the alleged breach is authentic, exposure of messaging and OTP-related information could create significant risks for organizations and individuals. Threat actors could potentially exploit the information for:
Phishing and social-engineering campaigns
OTP interception or abuse
Account takeover attempts
Identity theft and impersonation
Credential harvesting
Business Email Compromise (BEC)
Targeted scams using legitimate-looking SMS content
Unauthorized access to online accounts
Further attacks against customers and organizations
Exposure of authentication-related messages is particularly concerning because OTPs and verification codes may be used as part of account-login, password-reset, transaction-confirmation, or identity-verification processes. If active or recently generated authentication information were exposed, attackers could potentially attempt to use it before expiration, depending on the affected systems and associated security controls.
The authenticity, origin, completeness, and actual accessibility of the alleged 12 TB dataset could not be independently verified from the screenshot alone. Therefore, the incident should be treated as an alleged data breach pending independent verification.
Source: Underground Forums
STRATEGIC RECOMMENDATIONS
Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through -generation security solutions and a ready-to-go incident response plan.
Create risk-based vulnerability management with deep knowledge each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.
MANAGEMENT RECOMMENDATIONS
Take advantage of global Cyber Intelligence, providing valuable insights on threat actor activity, detection, and mitigation techniques.
Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions, remediations, and lessons learned.
Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM solutions.
Ensure that detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies should be continuously evolved to keep up with refined ransomware threats.
TACTICAL RECOMMENDATIONS
Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
Consider using security automation to speed up threat detection, improved incident response, ...