Weekly Intelligence Report - 18 Sep 2026

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.

Type: Ransomware Target Technologies: Windows OS

Introduction: CYFIRMA Research and Advisory Team has found Regulus Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

Regulus Ransomware Regulus is a ransomware threat that encrypts files and appends a variant-specific extension, such as .regulus16, to the affected filenames. It also creates an HTML ransom note after encryption. The malware follows a double-extortion model by claiming to have copied confidential data to an external server and threatening to publish or sell it if the ransom is not paid. The note warns victims against modifying encrypted files or using third-party recovery methods and states that a small number of files may be decrypted without charge as proof of the attackers’ capability.

Screenshot: File encrypted by the ransomware (Source: Surface Web)

The ransom note provides email and Tor-based communication channels for negotiating payment and obtaining a decryptor. It imposes a 72-hour deadline and threatens increased ransom demands afterward, while attempting to discourage victims from seeking alternative recovery services. From a technical impact perspective, the primary consequences are file unavailability through encryption and potential exposure of stolen information. Removing the ransomware can prevent further encryption but does not decrypt previously affected files; recovery therefore depends on a valid, uncompromised backup or a decryptable encryption implementation.

Screenshot: The appearance of Regulus’s ransom note (RANSOM_NOTE.html) (Source: Surface Web)

The following are the TTPs based on the MITRE ATT&CK framework

Relevancy and Insights:

The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities.

calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system.

The ransomware terminates processes such as vssadmin.exe Delete Shadows /all/quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.

Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior, such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.

ETLM Assessment: Regulus ransomware could evolve by adopting more advanced encryption, evasion, and deployment techniques to increase its effectiveness against targeted environments. Future variants may improve their ability to identify and prioritize valuable files, including documents, databases, backups, network shares, and other business-critical data, while optimizing encryption to reduce execution time and system visibility. The malware could also incorporate stronger anti-analysis capabilities, such as detecting virtualized or monitored environments, terminating security-related processes, and modifying its behavior to make forensic analysis more difficult. Changes to file-extension patterns, ransom-note generation, encryption routines, and system-level persistence or execution mechanisms could further distinguish new variants from earlier samples.

Regulus ransomware may also expand its double-extortion operations by placing greater emphasis on data theft alongside file encryption. Future campaigns could automate additional stages of an intrusion, including credential discovery, internal reconnaissance, lateral movement, data collection, and deployment across multiple systems within an affected network. Attackers could target centralized storage, backup infrastructure, and shared resources to reduce recovery options and increase operational disruption. Communication infrastructure may also be changed periodically through new email addresses, hidden services, or other channels to maintain with victims. Ransom demands and deadlines could become more customized according to the perceived value of the compromised environment, while threats involving publication or sale of stolen information may remain an important component of the extortion process.

Sigma rules: title: Shadow Copies Deletion Using Operating Systems Utilities tags: – attack.impact – attack.stealth logsource: category: process_creation product: windows detection: selection1_img: – Image|endswith: – ‘\powershell.exe’ – ‘\pwsh.exe’ – ‘\wmic.exe’ – ‘\vssadmin.exe’ – ‘\diskshadow.exe’ – OriginalFileName: – ‘PowerShell.EXE’ – ‘pwsh.dll’ – ‘wmic.exe’ – ‘VSSADMIN.EXE’ – ‘diskshadow.exe’ selection1_cli: CommandLine|contains|all: – ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage” – ‘delete’ selection2_img: – Image|endswith: ‘\wbadmin.exe’ – OriginalFileName: ‘WBADMIN.EXE’ selection2_cli: CommandLine|contains|all: – ‘delete’ – ‘catalog’ – ‘quiet’ # will match -quiet or /quiet selection3_img: – Image|endswith: ‘\vssadmin.exe’ – OriginalFileName: ‘VSSADMIN.EXE’ selection3_cli: CommandLine|contains|all: – ‘resize’ – ‘shadowstorage’ CommandLine|contains: – ‘unbounded’ – ‘/MaxSize=’ condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives: – Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason – LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high (Source: Surface Web)

IOCs: Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

STRATEGIC RECOMMENDATIONS

Implement competent security protocols and encryption, authentication, or access credential configurations to access critical systems in your cloud and local environments.

Ensure that backups of critical systems are maintained, which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATIONS

A data breach prevention plan must be developed considering (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.

Implement a zero-trust security model alongside multifactor authentication (MFA) to reduce the risk of credential compromise.

Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATIONS

Update all applications/software regularly with the latest versions and security patches alike.

Add the Sigma rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.

Establish and implement protective controls by actively monitoring and blocking identified indicators of compromise (IoCs) and reinforcing defensive measures based on the provided tactical intelligence.

Active Malware of the Week

Type: Info Stealer | Objectives: Credential Theft and Data Exfiltration | Target Technology: Windows | Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the Week This week, BTWStealer Malware is in focus.

Overview of Operation BTWStealer Malware The analyzed sample, identified as “BTWStealer,” is a malicious program designed to compromise a system and access information that should remain protected. Its activity is inconsistent with legitimate software, as it focuses on obtaining sensitive information from the affected device while maintaining access to the compromised environment. The overall behavior indicates that the malware is intended to support unauthorized access and data collection rather than perform a legitimate user-facing function.

Once present on a system, the malware shows particular interest in information that may contain account details and other valuable data. It examines information stored locally, including data associated with web browsers and system settings. This behavior increases the potential impact of an infection, as information collected from a single device could provide an attacker with access to additional accounts, services, or organizational resources.

The malware also demonstrates efforts to remain unnoticed during its activity. It can conceal parts of its operation and remove traces that could otherwise help identify what occurred on the affected system. By combining information gathering with measures intended to maintain its presence, the threat can remain active without immediately attracting the attention of the user or security personnel.

Overall, BTWStealer represents a purposeful information-stealing threat rather than a harmless or accidental program. Its ability to collect valuable information and communicate with external infrastructure creates a pathway for continued attacker activity after the initial compromise. For organizations, infection therefore represents a broader security concern because compromised systems may become a source of sensitive information and a foothold for further unauthorized activity.

Attack Method The execution chain begins with the malware establishing an exclusive runtime state on the infected Windows system. It creates mutex objects associated with system performance-related identifiers, using them as a mechanism to prevent multiple copies of the payload from operating simultaneously. The sample then performs host reconnaissance through native Windows commands, including process enumeration with tasklist, to identify the active user context, running applications, network configuration, and installed software. Its execution also incorporates reflective and memory-resident techniques, reducing reliance on conventional files on disk. In addition, thread and memory manipulation consistent with process injections allows malicious code to execute within a legitimate process context, potentially reducing the effectiveness of application-control mechanisms that rely on trusted process identities.

Following initial execution, the malware establishes mechanisms intended to maintain control while limiting visibility. It invokes PowerShell with parameters designed to suppress visible execution and bypass normal script restrictions, using it to obtain additional content such as SourceMap.js. Payload components are handled through memory-based execution techniques rather than being exposed through a straightforward disk-based execution chain. The sample also attempts to remove or suppress evidence of its activity, including clearing selected artifacts and event records. Together, these behaviors provide the malware with a combination of execution flexibility, defense evasion, and reduced forensic visibility.

The primary objective of the implant is information collection. It interacts with Windows credential-related storage to obtain authentication material and targets browser databases containing saved credentials and session-related information. Browser cookies are also of interest because they may contain active authentication tokens that can allow access to web services without requiring the original password. Beyond credential theft, the malware systematically examines locally stored files and configuration data, creating opportunities to collect documents and other information available to the compromised account. At the same time, it performs additional discovery of running processes, system characteristics, and security-related software, enabling the malware to identify the environment and determine what information or security controls are present.

The collected information is subsequently prepared for transfer to external infrastructure controlled or utilized by the malware operator. Analysis identified communication with numerous external endpoints, including services such as api.gofile.io, indicating that the malware can use web-accessible infrastructure as part of its data-transfer activity. The combination of credential harvesting, browser-session theft, local file collection, host discovery, and outbound communication gives the sample capabilities extending beyond simple information gathering. Its execution strategy is therefore structured around establishing a covert runtime presence, profiling the host, obtaining valuable data, and maintaining a communication path through which collected information can be moved outside the compromised environment.

The Following are the TTPs based on the MITRE ATT&CK Framework for Enterprises

INSIGHTS The behavior of BTWStealer indicates that the value of a compromised device extends beyond the information stored directly on it. Access to accounts and authentication-related information can provide opportunities to take advantage of existing digital relationships, making the compromised user identity an important asset in the overall operation. This shifts the significance of the infection from simple data theft toward the potential misuse of trusted access associated with the victim.

Another notable aspect is the apparent prioritization of information that can have value across different online services. Rather than being dependent on one victim’s data, the malware operates in a way that can expose several forms of information from the same environment. This suggests that the underlying objective is centered on obtaining useful digital assets, with the actual value determined by what can be recovered from each individual system.

The broader picture also reflects an operation built around maintaining control and extracting value quietly. The malware’s activity is structured to reduce attention while continuing its intended collection process, indicating that successful compromise depends on remaining inconspicuous rather than causing visible disruption. This makes the threat notable not because of destructive behavior, but because of the way a seemingly routine user environment can become a source of information for unauthorized activity.

ETLM ASSESSMENT From an ETLM perspective, BTWStealer-like threats are expected to contribute to a broader shift in which compromised employee identities become increasingly valuable to cybercriminal operations. In the future, organizations may face incidents where the initial theft of an individual’s information develops into unauthorized access to business services, financial activity, or sensitive corporate resources. Employees are likely to remain an important exposure point as everyday digital interactions continue to generate valuable identity and access data. This could increase the business impact of seemingly isolated compromises, with organizations potentially facing greater financial losses, operational disruption, and reputational consequences as stolen identities are reused across multiple stages of an attack.

IOCs: Kindly refer to the IOCs below to exercise controls on your security systems. (Source: Open Surface)

YARA Rules rule BTWStealer_Malware { meta: description = “Detection rule for the analyzed malware sample” author = “CYFIRMA Research” strings: $hash1 = “b377fb7c454dea093ba4c63040f6177dd6a1ef7cf623497c043a9ce631e5d0b4” $hash2= “70a0b041d945a1d26a65ae366537e5de7353f0a4b0b0c9abcbfe9eb6cfa8d44b” $s1 = “C:\\Windows\\system32\\cmd.exe /c \”ver” $s2 = “powershell -window hidden -exec bypass” $s3 = “powershell -exec bypass” $s4 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”tasklist /FO CSV /NH” $s5 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”taskkill /IM Exodus.exe /F” $s6 = “C:\\Windows\\system32\\cmd.exe /d /s /c \”taskkill /IM Telegram.exe /F” $s7 = “cscript //nologo //B \”C:\\Users\\ \\AppData\\Local\\Temp\\system_check_1785488770263.v bs” $s8 = “WSearch” $s9 = “python.exe -m pip install –no-cache-dir –no-warn-script-location –disable-pip-version-check -q pycryptodome” $s10 = “python.exe -m pip install –no-cache-dir –no-warn-script-location –disable-pip-version-check -q pywin32” $s11 = “python.exe -m pip install –no-cache-dir –no-warn-script-location –disable-pip-version-check -q PythonForWindows” $s12 = “tvrth310.exe” $s13 = “C:\\Users\\ \\Desktop\\tvrth310.exe” $s14 = “system_check_1785488770263.vbs” $s15 = “fwdqbf.exe” $s16 = “C:\\qwdjs\\fwdqbf.exe”

condition: any of ($hash*) or 2 of ($s*) }

Strategic Recommendations

Establish an organization-wide endpoint security strategy covering malware prevention, detection, and response.

Prioritize protection of sensitive credentials and business information stored or accessed from employee endpoints.

Adopt layered security controls so that a single compromised endpoint does not provide prolonged access to organizational resources.

Conduct periodic threat assessments to identify exposure to multi-purpose malware and similar information-stealing threats.

Management Recommendations

Direct affected users to rotate passwords and confirm multi-factor enrolment as part of the response checklist.

Ensure endpoint protection and security monitoring capabilities are consistently deployed across employee systems.

Establish clear incident-response procedures for suspected malware infections, including isolation, investigation, and recovery.

Provide regular security-awareness training focused on suspicious files, links, downloads, and unexpected system activity.

Maintain appropriate controls over access to sensitive corporate information and user accounts.

Tactical Recommendations

Force password resets and revoke active sessions for users on affected systems; verify MFA coverage to blunt harvested-credential replay.

Monitor endpoints for unusual PowerShell activity, unexpected process trees, and unauthorized changes to security settings.

Block and monitor the infrastructure listed in the IOC section at DNS, proxy, and perimeter controls.

Isolate confirmed cases promptly, then reset credentials and review AutoStart locations before restoration.

CYFIRMA’s Weekly Insights

1. Weekly Attack Types and Trends

Key Intelligence Signals:

Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.

Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.

Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.

Ransomware – Qilin Ransomware, The Gentlemen Ransomware| Malware – BTWStealer

Qilin Ransomware– One of the ransomware groups.

The Gentlemen Ransomware – One of the ransomware groups. Please refer to the trending malware advisory for details on the following:

Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

APT31 (JungleBamboo): Evolving Browser Exploitation and Espionage Operations

Threat Actor: JungleBamboo aka APT31aka (Violet Typhoon, TA412)

Attack Type: Connection Proxy, Credential Dumping, Exploitation of Vulnerabilities, spear-phishing.

Objective: Information theft, Cyber Espionage, Financial Gains, Credential Theft.

Suspected Target Technology: Cisco RV042 routers, Internet Information Services (IIS), SMB/Windows Admin Shares, Microsoft Internet Explorer, Microsoft SharePoint Server, Pakedge RK-2, Pakedge RK-1, Google sChrome, sharepoint server, Pakedge RE-2, RDP endpoints, Pakedge RE-1, VPN gateways, Microsoft Exchange Server, Dropbox, Yandex Disk, Email accounts, Sophos Cyberoam routers, SOHO routers, Telephone call records, GitHub repositories, Virtual Private Servers (VPS), IoT devices, Cisco RV042G routers, Active Directory, Cloud storage accounts, Windows GDI, Windows 7, Windows Server 2008, FortiOS VPN appliances, Windows WalletService.

Suspected Target Geography: Australia, Belarus, Belgium, Canada, China, Czech Republic, Estonia, Finland, France, Hong Kong, Italy, Japan, Korea, Mongolia, New Zealand, Norway, the Russian Federation, the United Kingdom, the United States.

Suspected Target Industries: Software, Government & Public Sector, Information Technology Services, Oil, Gas & Consumable Fuels, Communications Equipment, Retail, Professional Services, Media & Entertainment, Construction & Engineering, Telecommunications, Commercial Services & Supplies, Health Care Providers & Services, Aerospace & Defense, Industrials, IT Services, Legal Services, Education Services, Energy, Financial Services, Capital Goods, Manufacturing, Restaurants, Utilities, Insurance, Interactive Media & Services, Air Freight & Logistics.

Business Impact: Financial Loss, Data Theft, Operational Disruption, Reputational Damage.

the Threat Actor APT31 is a China-linked threat actor known for conducting cyber operations focused on the theft of intellectual property and sensitive information. Researchers characterize APT31 as specializing in obtaining data and projects that provide organizations with a competitive advantage within their respective industries. The group is suspected of conducting network operations at the direction of, or in support of, the Chinese Government, aligning its activities with broader strategic intelligence objectives.

Details on Exploited Vulnerabilities

TTPs based on the MITRE ATT&CK Framework

Latest Developments Observed APT31 (JungleBamboo) is suspected of exploiting a Chrome zero-day vulnerability chain involving CVE-2026-85046 to target organizations through spear-phishing emails. The campaign leveraged a reflected XSS vulnerability on a legitimate university website to redirect victims to threat-actor-controlled infrastructure, ultimately deploying the SUPERSTOMP loader and LONGTALE Chrome extension to steal browser credentials, cookies, session data, keystrokes, and other sensitive information. The activity appears focused on credential theft and surveillance, with APT31 using the Chrome patch-gap window to conduct exploitation against vulnerable users.

ETLM Insights APT31 (JungleBamboo) continues to demonstrate an adaptive and exploitation-focused operational model centered on leveraging browser vulnerabilities and targeted social engineering to establish access and conduct credential theft and surveillance. The use of a multi-stage Chrome exploit chain, combined with a browser-based information-stealing payload, reflects an ability to adapt its post-exploitation approach while taking advantage of short-lived patch gaps.

The threat actor’s operations reflect:

Exploitation of patch-gap vulnerabilities to operationalize newly disclosed browser vulnerabilities before fixes reach end-user releases.

Targeted social engineering through phishing campaigns designed to direct victims toward malicious infrastructure while using legitimate websites as part of the delivery chain.

Browser-focused credential theft and surveillance through malicious Chrome extensions capable of collecting credentials, cookies, session data, keystrokes, and browser activity.

Adaptive post-exploitation tradecraft through the use of browser-based tooling that prioritizes information theft and surveillance without requiring extensive remote code execution capabilities.

Looking ahead, APT31 (JungleBamboo) is expected to further refine its browser-focused intrusion capabilities by exploiting vulnerability disclosure and patch-release gaps to establish access against targeted users. The group is likely to continue developing or adopting stealthier browser-based payloads for credential and session theft, enabling sustained surveillance while reducing reliance on conventional executable malware. Its continued use of tailored phishing and legitimate web infrastructure may also improve the effectiveness and resilience of future campaigns.

IOCs: Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

YARA Rules import “hash” rule APT31_JungleBamboo_IOCs { meta: description = “Detects artifacts and IOCs associated with APT31 (JungleBamboo)” author = “CYFIRMA” date = “2026-09-15” strings: // File names $file1 = “msvcr100.bin” ascii wide nocase $file2 = “e1999a3e5a611312e16bb65bb5a880dfedbab8d4d2c0a5d3ed1ed926a3f63e94.elf” ascii wide nocase $file3 = “002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8.bin” ascii wide nocase // IP addresses $ip1 = “88.247.129.12” ascii $ip2 = “195.91.239.226” ascii $ip3 = “89.31.228.228” ascii $ip4 = “184.75.129.113” ascii $ip5 = “50.71.100.164” ascii // Domains $domain1 = “hdpopcorn.live” ascii nocase $domain2 = “gitloucache.com” ascii nocase $domain3 = “edgecloudc.com” ascii nocase $domain4 = “ramblercloud.com” ascii nocase $domain5 = “yandexpro.net” ascii nocase condition: // Exact SHA-256 matches hash.sha256(0, filesize) == “e1999a3e5a611312e16bb65bb5a880dfedbab8d4d2c0a5d3ed1ed926a3f63e94” or hash.sha256(0, filesize) == “002dc9f6823ad8d3de23bcb5e41bcefd895df573ed3d89e0821243aa9b7bb4a8” // IOC-based detection or 1 of ($file*) or 1 of ($ip*) or 1 of ($domain*) }

Strategic Recommendations

Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.

Establish comprehensive identification and prioritization of cyber risks associated with third-party vendors and services through periodic risk assessments, vulnerability assessments, and system reviews.

Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more by identifying such patterns.

Management Recommendations

Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.

Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.

Strengthen boundary defense such as network segmentation and have a strong access management capability in line with the Principle of Least Privilege (POLP) that can assist in mitigating cyberattacks.

Tactical Recommendations

For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.

Use a software development lifecycle (SDLC) and incorporate secure software development practices throughout all lifecycle phases.

Apply security measures to detect unauthorized activities, protect sensitive production, and process control systems from cyberattacks.

Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

Add the YARA rule for threat detection and monitoring, which will help to detect anomalies in log events, identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

AI Cyber Threat This Week: Slowdowns, Security, and Chinese Distillation Anthropic CEO Dario Amodei has published an essay calling for a slowdown in AI development. “Over the last few months, I have become convinced that fully addressing the risks requires even more prudence — not just investing in risk prevention, but pacing the rate of capabilities advancement so that risk prevention has time to keep up,” he wrote. As a concrete example, he cited a recent incident in which a swarm of AI agents conducted unauthorized attacks against a real-world target, and warned that within 6–12 months such a swarm could be capable of taking over the entire internet via a persistent botnet, causing hundreds of billions of dollars in damage. Amodei’s call was backed by OpenAI CEO Sam Altman and Elon Musk. Critics, however, warn that dramatic warnings from established players may also serve to deter new competitors through regulation. President Trump rejected the idea outright, arguing that an American slowdown would hand the AI race to China.

China’s Ministry of State Security issued its first public warning AI risks, flagging the abuse of generative AI — deepfake video, AI-generated text, and “intelligent troll armies” — to spread political disinformation and inflame social divisions. Separately, Chinese security officials were alarmed by a proof-of-concept tool developed by a team of California researchers that could launch a worm attack against millions of WeChat users simply by calling compromised accounts’ contacts. WeChat has 1.4 billion monthly users and is deeply embedded in Chinese government services and payments. According to The New York Times, the discovery is expected to feature in upcoming talks between Trump and Xi Jinping, where AI security is on the agenda.

The NSA, FBI, and CISA issued a joint statement accusing leading Chinese AI companies of systematically extracting proprietary knowledge from American models. Named explicitly were DeepSeek, Moonshot AI (maker of Kimi), Alibaba, MiniMax, StepFun, and Z.AI. The agencies say these firms have been accessing US AI models “at an industrial scale” since at least 2024, routing requests through multiple pathways to evade terms-of-use restrictions — likely with the knowledge of the Chinese government. Distillation is a legitimate technique in which a more powerful model trains a smaller one, but conducting it without the model owner’s consent is treated as intellectual property theft. The alert comes weeks before Trump’s scheduled summit with Xi. China’s Ministry of Commerce rejected the accusations as baseless, called distillation a “common practice,” and threatened countermeasures if the US uses the issue to suppress Chinese AI companies.

ETLM Assessment: China’s approach to AI competition increasingly follows a two-track strategy: state-linked actors use AI to supercharge cyber operations against Western targets, while Chinese AI companies quietly distillate from American frontier models — effectively letting US firms absorb the enormous R&D costs of pushing the frontier forward, then extracting the results at a fraction of the price.

Iran, Russia and Other Threat Actors Using Claude for Weapons Research and Cyber Operations Automation Frontier artificial intelligence developer Anthropic disclosed that its flagship model, Claude, has been repeatedly targeted by state-aligned actors, cybercriminals, and covert researchers seeking to build military-grade weaponry, surveillance tools, and automated cyber-weapons. According to a detailed report from the company’s threat intelligence team, high-risk misuse originated from actors operating out of Russia, China, Iran, Mali, and Houthi-controlled Yemen.

The threat landscape spans conventional weapons development, biological research, and intrusive state surveillance. In Russia, non-state threat actors attempted to leverage Claude to write software for autonomous, FPV kamikaze drone swarms trained on Ukrainian combat footage. In Houthi-controlled northern Yemen, operatives used the AI to build guidance software for multiple missile types, returning to the model to troubleshoot flight telemetry after a failed test-fire of a guided rocket. Elsewhere, China-linked actors utilized Claude to track and recruit Uyghurs in the Syrian Army, while an intelligence consultant in Mali deployed a Claude-backed system capable of generating warrantless intelligence dossiers on 25 million mobile phones—a platform that remains operational locally despite account termination. Anthropic also flagged ambiguous cases involving potential dual-use biological research, including a grant application for enhancing the debilitating chikungunya virus at an unnamed foreign military institute.

ETLM Assessment: While Anthropic emphasized that the incidents did not involve its most advanced models, Fable and Mythos, the findings highlight an intensifying struggle to keep civilian AI systems from becoming force multipliers for adversary capabilities.

Concurrently, sophisticated cyber-espionage groups have integrated Claude directly into their offensive toolchains. Russia’s SVR-linked intelligence unit – tracked as Midnight Blizzard, APT29, or Cozy Bear – deployed customized, AI-driven workflows to automate nearly every stage of their operations against US, European, and Ukrainian military, diplomatic, and defense targets. By automating infrastructure acquisition, malware development, phishing generation, and data exfiltration, the group dramatically accelerated its operational cadence. Similarly, the ShinyHunters cyber-extortion gang used Claude to scan for leaked credentials to execute rapid data thefts.

4. Rise in Malware/Ransomware and Phishing

Qilin Ransomware Impacts a Business Services Company from Japan

Attack Type: Ransomware

Target Industry: Business Services

Target Geography: Japan

Ransomware: Qilin Ransomware

Objective: Data Theft, Data Encryption, Financial Gains

Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary: CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by Qilin ransomware. The compromised company is a Japanese trading and manufacturing company. The businesses involve synthetic-resin materials, plastic-product manufacturing, SMC/FRP materials, textiles, apparel, and related trading activities. The compromised data includes confidential and sensitive information belonging to the organization.

Relevancy & Insights:

The Qilin Ransomware group operates a Ransomware-as-a-Service (RaaS) model, allowing affiliates to carry out attacks while Qilin provides infrastructure and malware tools.

The Qilin Ransomware group primarily targets countries such as the United States of America, Germany, Canada, the United Kingdom, and France.

The Qilin Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Real Estate & Construction, Consumer Goods & Services, and Healthcare.

Based on the Qilin Ransomware victims list from 1st Jan 2026 to 15th September 2026, the top 5 Target Countries are as follows:

The Top 10 Industries most affected by the Qilin Ransomware group victims list from 1st Jan 2026 to 15th September 2026 are as follows:

ETLM Assessment: According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and a focus on speed and evasion, make it a particularly dangerous actor.

The Gentlemen Ransomware Impacts an Engineering and Architectural Consulting Company from Saudi Arabia

Attack Type: Ransomware

Target Industry: Engineering and Architectural Consulting

Target Geography: Saudi Arabia

Ransomware: The Gentlemen Ransomware

Objective: Data Theft, Data Encryption, Financial Gains

Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary: CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Saudi Arabia was compromised by The Gentlemen Ransomware. The compromised company is a Saudi Arabian multidisciplinary engineering and architectural consulting firm. The company states that it was established in 1965 as the first Saudi engineering consulting firm and has more than six decades of experience supporting major projects. The compromised data includes confidential and sensitive information belonging to the organization.

Relevancy & Insights:

The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.

The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Italy.

The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.

Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 15th September 2026, the top 5 Target Countries are as follows:

The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 15th September 2026 are as follows:

ETLM Assessment: According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploits

Vulnerability in ConnectWise ScreenConnect

Attack Type: Vulnerabilities & Exploits

Target Technology: Remote Access / Remote Support

Vulnerability: CVE-2026-84869

CVSS Base Score: 9.9 Source

Vulnerability Type: Missing Authorization / Improper Privilege Management

Summary: The vulnerability allows a remote user to compromise the affected system.

Relevancy & Insights: The vulnerability exists due to improper privilege management during guest file transfer in the ScreenConnect client.

Impact: A remote user can transfer and execute files through an active remote session without authorization or Host confirmation

Affected Products: https[:]//www[.]connectwise[.]com/company/trust/advisories#September+3%2 C+2026%3A+ScreenConnect%26reg%3B+Remote+Access%3A+Guest+File+Tran sfer+Advisory

Recommendations: Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment: The vulnerability in ConnectWise ScreenConnect presents a significant security risk to organizations using affected versions of the remote access software. The vulnerability is caused by missing authorization and improper privilege management in the ScreenConnect client, potentially allowing an attacker with access to an active remote session to bypass expected authorization controls for file-transfer and file-execution operations. Successful exploitation could allow unauthorized files to be transferred and executed on the affected endpoint, potentially resulting in arbitrary code execution and further compromise of the system. Although exploitation requires additional access and an active remote session, the vulnerability carries a CVSS v3.1 score of 9.9 and has been assigned Priority 1 – High by ConnectWise due to the risk of being targeted by exploits in the wild. Organizations using affected ScreenConnect versions should prioritize upgrading to version 26.6.5 or later. Security teams should also review ScreenConnect roles and permissions, particularly the Transfer Files permission, and monitor endpoints for suspicious file-transfer activity, unauthorized binary modifications, and unexpected process execution originating from ScreenConnect sessions. Prompt remediation, access-control review, and continuous monitoring are recommended to reduce the risk of unauthorized code execution and potential compromise of affected systems.

6. Latest Cyber-Attacks, Incidents, and Breaches

Krybit Ransomware attacked and published the data of a Healthcare company from Thailand

Threat Actor: Krybit Ransomware

Attack Type: Ransomware

Objective: Data Leak, Financial Gains

Target Technology: Web Applications

Target Industry: Healthcare

Target Geography: Thailand

Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary: Recently, we observed that Krybit Ransomware attacked and published the data of a healthcare company from Thailand on its dark web website. The compromised company is a Thai trusted distributor and one-stop service provider of medical products, pharmaceuticals, medical equipment, dietary supplements, cosmetics, and health products, headquartered in Nonthaburi, Thailand. Originally founded as an importer of X-ray films from European countries, it expanded into a comprehensive healthcare distribution company serving Thailand’s health authorities and other ASEAN countries. The company operates a modern warehouse with advanced operating systems and innovative machinery, with carefully allocated space for efficient inventory management. It is trusted by manufacturers and distributors of pharmaceuticals, medical equipment, dietary supplements, and health products worldwide. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of the compromised data is approximately 194.49 GB.

Relevancy & Insights:

Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is paid.

The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Government & Civic, Consumer Goods & Services, and Information Technology.

ETLM Assessment: According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.

Unauthorized Corporate Data Exposure Advertised on a Leak Site

Attack Type: Data Leak

Target Industry: Pharmaceutical / Consumer Healthcare

Target Geography: Japan

Objective: Financial Gains

Alleged Data Volume: Approximately 4 TB

Business Impact: Exposure of Customer and Corporate Data, Privacy Risks, Intellectual Property Exposure, Operational Information Disclosure, Regulatory Compliance Concerns, Financial Loss, and Reputational Damage

Approximately 3,949,883 customer records reportedly stored within a Salesforce environment.

Approximately 850,000 recorded customer calls, representing around 3.5 TB of voice recordings.

Customer-service and -center conversations associated with eye-care and skincare support services.

Voice recordings reportedly averaging approximately 4.3 MB per recording.

Call recordings reportedly covering the period from September 2025 through April 2026.

Approximately 439 GB of corporate documents, comprising around 52,000 files.

Data reportedly sourced from SharePoint document libraries and OneDrive repositories.

Sales-office meeting or huddle minutes and historical corporate records.

Product campaign calendars and related business planning information.

POP design source files and other marketing-related materials.

Corporate presentation decks, including thousands of PPTX files.

Large collections of spreadsheets, PDFs, training and event videos.

Marketing-related PNG/JPG image files and creative assets.

Additional documents and information stored within enterprise cloud repositories.

Source: Underground Forums

Alleged Database Access Advertised on a Leak Site

Attack Type: Database Access

Target Industry: Food & Beverage – Dairy Manufacturing and Distribution

Target Geography: Saudi Arabia

Objective: Financial Gains

Business Impact: Exposure of Customer and Employee/Contractor Data, Privacy Risks, Financial Fraud, Identity Theft, Account Takeover, Regulatory Compliance Concerns, Reputational Damage

Unauthorized access to one or more corporate databases.

Potential access to business and operational information stored within the database environment.

Potential access to information supporting food and beverage manufacturing and distribution operations.

Possible access to internal organizational information and business processes.

Database access being advertised for potential monetization through the cybercrime ecosystem.

Source: Underground Forums

Relevancy & Insights: Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment: The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure.

Recommendations: Enhance the cybersecurity posture by:

Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.

Ensure proper database configuration to mitigate the risk of database-related attacks.

Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a post on a cybercrime forum claiming that data associated with an Australian organization operating in the supply chain and retail logistics sector had been compromised. The forum post states that the alleged breach resulted in the theft of the organization’s source code, which has subsequently been uploaded and made available for download.

The incident reportedly occurred in September 2026.

The alleged compromised information consists of source code.

A tree-file sample has been provided as evidence of the claimed possession.

The alleged stolen material has reportedly been uploaded for download.

Access to additional content appears to be restricted behind a forum-based payment mechanism.

Source-code repositories

Source-code directory and file structures

Software development files

Potential application components and modules

Potential configuration information contained within source-code repositories

Other development-related materials associated with the organization’s software environment

Potential Impact If the source-code exposure is authentic, the incident could create significant security and operational risks. Threat actors or other unauthorized parties could potentially analyze the exposed code to:

Identify software vulnerabilities and security weaknesses.

Discover hardcoded credentials, API keys, tokens, or other secrets if present.

Develop exploits against externally accessible applications.

Conduct targeted attacks against associated infrastructure.

Identify internal architecture, application logic, and technology dependencies.

Facilitate supply-chain attacks against customers, partners, or connected services.

Steal proprietary software and intellectual property.

Reuse exposed code in competing or malicious applications.

Identify weaknesses that could support future unauthorized access.

Conduct further reconnaissance against the organization’s technology environment.

For an organization operating within the supply chain and retail logistics sector, source-code expos...