CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.
Type: Ransomware Target Technologies: Windows OS Targeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, Chile Targeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation
Introduction: CYFIRMA Research and Advisory Team has found MAJINAHANASHI Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
MAJINAHANASHI Group Ransomware MAJINAHANASHI is a Windows-based ransomware family that encrypts files in place using AES-256 and generates a unique key for each file. The per-file keys are protected using an RSA public key embedded within the ransomware binary, preventing straightforward recovery without the corresponding private key. Encrypted files are renamed with the .majin extension, and the malware creates a README.txt ransom note. The ransomware can execute as a Windows service and supports multiple command-line modes, including targeted-path execution. It also creates a custom lock screen and wallpaper to reinforce the ransom demand after encryption.
Screenshot: File encrypted by ransomware (Source: Surface Web)
Before encryption, MAJINAHANASHI performs extensive recovery inhibition and defense-evasion activities. It deletes volume shadow copies, removes the USN journal, disables System Restore and hibernation, modifies boot-recovery settings, clears Windows event logs, and can terminate security and backup-related processes and services. The malware also employs direct system calls, dynamic API resolution, PEB access, XOR-obfuscated stack strings, geographic and keyboard-layout checks, and I/O-priority manipulation. Network-related functionality based on Windows Filtering Platform and QoS policy controls may be used to interfere with endpoint-security or cloud-agent communications during execution. These capabilities indicate that the ransomware is designed not only to encrypt data but also to reduce detection opportunities and prevent common recovery mechanisms.
Screenshot: The appearance of MAJINAHANASHI’s ransom note (README.txt) (Source: Surface Web)
MAJINAHANASHI follows a double-extortion model by claiming to exfiltrate internal data in addition to encrypting local files. The ransom note threatens public disclosure of stolen information if negotiations fail and provides a short deadline intended to increase pressure on victims. Technical artifacts associated with the malware include a distinctive mutex, encryption marker, service name, dropped-file paths, wallpaper files, and characteristic ransom-note strings, which can support host-based detection and incident investigation. Overall, the malware combines conventional AES/RSA-based encryption with aggressive recovery inhibition, security-control interference, and data-leak threats, making the primary risk a combination of operational disruption, loss of data availability, and potential exposure of sensitive organizational information.
Screenshot: The appearance of MAJINAHANASHI’s DLS site (Source: Dark web)
The following are the TTPs based on the MITRE ATT&CK framework
Relevancy and Insights:
ETLM Assessment: MAJINAHANASHI is likely to evolve toward stronger defense evasion and more automated disruption of enterprise security and recovery infrastructure. Its existing use of direct system calls, dynamic API resolution, process termination, recovery inhibition, and Windows Filtering Platform controls provides a foundation for expanding anti-analysis and security-agent interference capabilities. Future variants may further automate the identification and termination of endpoint protection, backup, virtualization, and monitoring services before encryption, while improving privilege escalation, environment checks, and execution logic to adapt the attack to different Windows environments. The ransomware may also refine its encryption workflow for greater performance and reliability across large enterprise file systems and network-accessible storage.
The double-extortion model is also likely to become more operationally mature, with greater emphasis on data theft, victim profiling, and coordinated leak pressure alongside file encryption. Based on the observed combination of encryption, recovery destruction, network-control capabilities, and data-disclosure threats, future versions could expand their targeting of centralized backup repositories, file servers, and virtualized infrastructure to maximize operational impact. The malware may additionally introduce stronger anti-forensic mechanisms, more flexible command-and-control functionality, and improved mechanisms for selectively encrypting high-value data. Overall, its likely evolution is toward a more resilient and enterprise-focused threat that combines rapid encryption, suppression of recovery and security controls, and sustained pressure through exfiltration-based extortion.
title: Boot Configuration Tampering Via Bcdedit.EXE tags: – attack.impact – attack.t1490 logsource: category: process_creation product: windows detection: selection_img: – Image|endswith: ‘\bcdedit.exe’ – OriginalFileName: ‘bcdedit.exe’ selection_set: CommandLine|contains: ‘set’ selection_cli: – CommandLine|contains|all: – ‘bootstatuspolicy’ – ‘ignoreallfailures’ – CommandLine|contains|all: – ‘recoveryenabled’ – ‘no’ condition: all of selection_* falsepositives: – Unlikely level: high (Source: Surface Web)
Kindly refer to the IOCs section to exercise control of your security systems (Source: Surface Web)
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Type: RAT Objectives: Surveillance/ Data Exfiltration Target Technology: Windows Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the week This week “HeroinRAT” Malware is in focus.
Overview of Operation HeroinRAT Malware
The analyzed malware sample exhibits a broad set of behaviors indicating that it is designed to gain control of a Windows system, remain active, collect valuable information, and create additional opportunities for abuse. Its observed activity goes beyond simple information gathering, with the sample interacting extensively with the host environment and attempting to establish a foothold that can survive beyond its initial execution. The overall behavior suggests a multi-purpose threat capable of affecting both user data and system security.
A significant concern is the sample’s focus on information that could be valuable to an attacker. Observed behavior includes keystroke collection, access to stored credentials, examination of local files, and attempts to obtain sensitive information such as Wi-Fi credentials and credit-card-related data. The malware also gathers information the system, users, running processes, installed software, and security products, allowing it to understand the environment in which it is operating.
The sample also demonstrates several behaviors intended to make detection and removal more difficult. It can establish recurring execution through scheduled tasks and registry-based startup mechanisms, while its activity includes attempts to weaken Windows security protections. During analysis, the sample was observed stopping or disabling Windows Defender and using hidden scripting activity, creating conditions in which additional malicious components could operate with reduced interference.
Another notable aspect is the sample’s ability to support secondary malicious activity. Its observed behavior includes retrieving and executing an external mining-related script, suggesting that a compromised system could potentially be used to generate cryptocurrency for an attacker in addition to serving as a source of sensitive information. Taken together, the findings indicate a threat with the potential to compromise confidentiality, weaken endpoint defenses, maintain continued access, and misuse system resources. Organizations should therefore treat detections associated with this sample as a high-priority security event and investigate affected systems for persistence, credential exposure, and unauthorized resource usage.
The malware begins its activity by executing on a Windows host and interacting directly with the operating system to identify the environment and prepare itself for subsequent actions. It gathers host information such as the logged-in username, hostname, system characteristics, available memory, running processes, installed software, accounts, files, and security products. The sample also uses mutex-related checks to identify an existing instance and contains anti-analysis capabilities, including checks intended to identify analysis or sandbox environments. Its executable structure includes a TLS section and runtime API resolution, while memory-related operations include allocating executable memory and manipulating thread execution, which can complicate conventional analysis.
For persistence, the malware uses multiple mechanisms rather than depending on a single startup location. Analysis identified scheduled-task activity and registry-based startup persistence, including the creation of a task named “MicrosoftEdgeUpdate” that periodically launches an executable from a temporary directory. The sample also demonstrates registry modification and service-related activity, providing additional avenues for maintaining execution. This multi-layered persistence approach increases the likelihood that the malware can regain execution after a reboot or interruption of its primary process.
Malware places substantial emphasis on credential and information collection. Its observed capabilities include polling-based keylogging, accessing credential stores, credential dumping-related activity, collecting information from the local system, reading files, and examining user and account information. It also attempts to obtain saved Wi-Fi credentials by using netsh wlan export profile key=clear, while its behavior indicators show an interest in credit-card information. These activities are supported by discovery routines covering processes, system information, directories, installed software, security products, and registry data, allowing the malware to identify potentially valuable information before further actions are performed.
The sample additionally attempts to weaken endpoint defenses and execute externally retrieved content. During behavioral analysis, it invoked PowerShell to disable Windows Defender real-time monitoring and used sc commands to stop and disable the Defender service. It also executed PowerShell with hidden-window and execution-bypass options to retrieve an external xmrig.ps1 script associated with cryptocurrency mining. The malware therefore combines host reconnaissance, credential collection, persistence, defense impairment, scripting, and resource hijacking within a single attack chain. Its use of XOR-based data encoding, runtime API linking, process/thread manipulation, and reflective or memory-based execution further demonstrates an emphasis on maintaining control while reducing the visibility of its activities.
The following are the TTPs based on the MITRE ATT&CK Framework for Enterprises
From an ETLM perspective, this malware represents a growing risk for organizations because future variants of similarly versatile threats may increasingly combine information theft, system misuse, and financial objectives within a single compromise. Organizations could face greater disruption when employee endpoints are abused for multiple purposes, while employees may become more exposed to the loss of credentials, personal information, and system resources. Over time, such infections are likely to increase the cost and complexity of incident response, particularly when attackers use compromised employee systems for several interconnected objectives rather than pursuing a single form of exploitation.
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)
rule HeroinRAT_Malware { meta: description = “Detection rule for the analyzed malware sample” author = “Threat Research” date = “2026-08-17”
strings: $hash = “f3755d4d4fe143a1757bcadc32c848331de371dd7fa8ce3821e87a671a7cecf7” $s1 = “Set-MpPreference -DisableRealtimeMonitoring $true” $s2 = “sc config WinDefend start= disabled” $s3 = “sc stop WinDefend” $s4 = “MicrosoftEdgeUpdate” $s5 = “netsh wlan export profile key=clear” $s6 = “malicious-miner.com/xmrig.ps1” $s7 = “powershell -window hidden -exec bypass” $s8 = “xmrig.ps1” $s9 = “HeroinRAT”
condition: $hash or ( uint16(0) == 0x5A4D and 4 of ($s*) ) }
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Key Intelligence Signals:
APT36: Evolving Espionage Tradecraft Across South Asian Critical Infrastructure
the Threat Actor
Transparent Tribe, also known as APT36, is a state- Pakistani threat actor believed to have been active since 2016. The group conducts cyber-espionage operations aimed at collecting sensitive information to support Pakistan’s military and diplomatic interests. The threat actor primarily relies on spear-phishing and watering-hole attacks to gain initial access, using malicious macro-enabled documents or vulnerability-based RTF files as delivery mechanisms.
Details on Exploited Vulnerabilities:
TTPs based on MITRE ATT&CK Framework
Latest Developments Observed
APT36 (Transparent Tribe), a state- threat actor assessed to operate in alignment with Pakistan’s strategic intelligence objectives, continues to demonstrate an intelligence-driven and adaptive operational model focused on sustained access, surveillance, and sensitive information collection. The group’s evolving tradecraft reflects a deliberate emphasis on social engineering, credential-focused intrusion, and custom malware to establish covert access while maintaining operational persistence. The threat actor’s operations reflect:
Looking ahead, APT36 is expected to further mature its espionage tradecraft by refining social-engineering techniques, diversifying malware and delivery mechanisms, and strengthening persistence-oriented capabilities. The continued evolution of its operational model is likely to enhance its ability to conduct long-term intelligence collection while maintaining stealth and resilience against modern defensive controls.
IOCs: Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
YARA Rules rule APT36_Suspicious_Malware_Indicators { meta: description = “Detects malware associated with APT36-related activity using provided indicators” author = “CYFIRMA” date = “2026-08-17” threat_actor = “APT36 (Transparent Tribe)”
strings: $domain1 = “departmentofdefence.live” ascii nocase $domain2 = “accounts.mgovcloud.in.departmentofdefence.live” ascii nocase $domain3 = “mdgovindia.space” ascii nocase $domain4 = “securestore.tv” ascii nocase $domain5 = “sorlastore.com” ascii nocase
$file1 = “nbtscan-1.0.35.exe” ascii nocase $file2 = “nbt.exe” ascii nocase $file3 = “abuse-ransomware.csv” ascii nocase $file4 = “ransomware.csv” ascii nocase
condition: 2 of ($domain*) or 2 of ($file*) }
Strategic Recommendations
Management Recommendations
Tactical Recommendations
Poland describes a cyberattack against a heat-and-power plant from this winter
According to Poland’s CERT, hackers breached a combined heat-and-power plant by leveraging a wind farm’s compromised firewall to tunnel through a misconfigured private APN network. The attackers accessed a power plant controller secured with default credentials, temporarily disabling a steam turbine and water treatment system before authorities restored full operations without public impact. The December 29, 2025, attack – the first recorded instance of an APN being used for lateral OT network movement – was part of a broader campaign linked to Russia’s Electrum APT aimed at shutting down heating facilities across Poland during mid-winter.
Poland serves as the logistical, military, and humanitarian hub for Western assistance to Ukraine. Because direct military aggression against a NATO member state would trigger Article 5, Moscow relies on non-kinetic, “grey-zone” operations (such as cyberattacks, sabotage, and disinformation) to inflict infrastructure friction and economic costs on Warsaw without crossing the threshold into open war.
Beyond immediate disruption, successful intrusions act as strategic signaling to NATO. Probing or briefly disabling turbines communicates capability: it demonstrates to Western leadership that Russia possesses the cyber tools to paralyze civilian life deep inside NATO territory, should regional tensions escalate further.
U.K. Naval Drones Component Sent Signals to China
Cameras mounted on British naval drones were discovered sending signals to an internet address in China, exposing severe supply chain vulnerabilities in Western military hardware. A Ministry of Defence investigation confirmed that while the component broadcast a signal, no sensitive data or systems were compromised. The issue affected the K3 Scout drone boat – manufactured by UK-based Kraken Technology, which recently secured a $49 million U.S. Special Operations Command contract – though company officials state the vulnerability has since been resolved.
The incident highlights the defense sector’s deep reliance on Chinese components, particularly for low-cost parts like motors, cameras, and batteries. While the U.K. banned new Chinese drones and components, tracing small electronics deep within global supply chains remains exceptionally difficult. The challenge is further complicated by cost: Western-made alternatives can cost up to ten times more than Chinese parts. As naval and aerial drones become central to modern warfare – as demonstrated in recent operations across Ukraine and the Middle East – Western militaries face an ongoing struggle to purge Chinese hardware without driving production costs out of reach.
Under Chinese legal frameworks such as the National Intelligence Law, domestic companies operating in China can be compelled by Beijing to assist state intelligence work, feed state actors backdoors, or hand over remote access infrastructure to any of its products.
Gunra Ransomware Impacts an Agricultural Biotechnology and Fertilizer Manufacturing Company from Indonesia
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Indonesia was compromised by Gunra Ransomware. The compromised company is an agricultural biotechnology and fertilizer manufacturing company. Its core activity is the manufacturing and sale of biochemical/organic compound fertilizers, with an emphasis on improving soil quality, crop productivity, and more sustainable agricultural practices. The compromised data includes confidential and sensitive information belonging to the organization. The total size of compromised data is approximately 150 GB.
The following screenshot was observed published on the dark web:
Relevancy & Insights:
The Gentlemen Ransomware Impacts a Healthcare Company from Japan
CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a prominent Japanese brand renowned for its high-quality cosmetics, dietary supplements, and health foods. Originally founded as a translation company, it achieved global success by focusing on pure, natural ingredients—most notably its signature olive oil skincare. Today, the company is trusted worldwide for combining rigorous scientific research with effective, affordable wellness products. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Relevancy & Insights:
Vulnerability in Vault Secrets Operator
Relevancy & Insights:
https[:]// [.]hashicorp[.]com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645
Monitoring and Detection:
Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
The vulnerability in Vault Secrets Operator presents a critical security risk to organizations using affected versions in Kubernetes environments. The issue allows a tenant with limited Kubernetes RBAC permissions to read files from the operator pod’s filesystem and transmit their contents to a tenant-controlled endpoint through the AppRole authentication configuration. Successful exploitation could result in the exposure of sensitive files and credentials and may facilitate privilege escalation within the Kubernetes cluster. Organizations using Vault Secrets Operator versions 1.3.0 through 1.4.1 should prioritize upgrading to version 1.5.0 or later. Organizations should also review Kubernetes RBAC permissions, monitor operator activity and outbound connections, and rotate potentially exposed credentials where necessary. Prompt remediation and continuous monitoring are recommended to reduce the risk of unauthorized access and credential compromise.
Krybit Ransomware attacked and published the data of a Healthcare company from Singapore
Relevancy & Insights:
Unauthorized Food Delivery Platform Database Exposure Advertised on a Leak Site
Allegedly Exposed Information
Source: Underground Forums
Unauthorized Subscription and Invoice Data Advertised on a Leak Site
Source: Underground Forums
Relevancy & Insights:
Recommendations: Enhance the cybersecurity posture by
Source : Underground forums
STRATEGIC RECOMMENDATION
MANAGEMENT RECOMMENDATION
TACTICAL RECOMMENDATION
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, technology, please access DeCYFIR.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
