Weekly Intelligence Report – 31 Jul 2026 | #ransomware | #cybercrime

Ransomware In Focus

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows OS

Introduction:
CYFIRMA Research and Advisory Team has found InterServer Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

InterServer Ransomware
InterServer is a ransomware strain that encrypts files on an infected system and renames them by adding a variant-specific extension, such as .interserver12. The malware also creates an HTML ransom note named RANSOM_NOTE.html. As with other ransomware, the encryption process is intended to prevent access to affected files, and removing the malware stops additional encryption but does not automatically recover files that have already been encrypted.

Screenshot: File encrypted by the ransomware (Source: Surface Web)

The ransom note states that the victim’s corporate network has been compromised and claims that sensitive information was exfiltrated and stored on an attacker-controlled server. It threatens to publish or sell the allegedly stolen data if payment is not made. The operators offer to decrypt a small number of non-critical files as proof of their claimed recovery capability and provide email addresses and a Tor-based communication channel for contact. The note also warns victims against third-party recovery services, instructs them to communicate through specific email providers, and states that the ransom demand may increase if the attackers are not contacted within 72 hours.

Screenshot: The appearance of InterServer’s ransom note (RANSOM_NOTE.html) (Source: Surface Web)

Recovery of files encrypted by InterServer depends on the specific implementation of its encryption mechanism and the availability of a suitable decryptor. In the absence of a reliable decryption method, restoring data from backups created before the infection is the primary recovery approach. Maintaining multiple backup copies, including offline or otherwise isolated storage, reduces the risk of losing all accessible copies if ransomware compromises the primary system and connected backups.

Screenshot: The appearance of InterServer’s Tor Chat window

The following are the TTPs based on the MITRE Attack Framework

Relevancy and Insights:

• The ransomware primarily targets the Windows operating system, leveraging native Windows utilities, services, registry settings, and filesystem APIs to execute its malicious activities. Its behavior indicates compatibility with enterprise and personal Windows environments.
• calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system.
• Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior, such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.
• The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.

ETLM Assessment:
InterServer ransomware may evolve through improvements in encryption, evasion, and deployment techniques. Future variants could modify file extensions, ransom note formats, and communication infrastructure while incorporating stronger defenses against security software and forensic analysis. The malware may also become more adaptable to different environments, targeting a wider range of file types, network shares, and enterprise systems. Such changes would make detection and incident response more challenging for security teams.

Future versions could also place greater emphasis on data theft alongside file encryption, increasing pressure on organizations through combined encryption and extortion tactics. Attackers may adopt more automated methods for identifying valuable systems and sensitive information before executing the encryption stage. Ransomware operators could further change their communication channels and operational methods to make infrastructure disruption and attribution more difficult. From a defensive perspective, organizations should expect ransomware threats to become more technically sophisticated and should strengthen prevention, detection, and recovery capabilities accordingly. Effective measures include network segmentation, offline or isolated backups, endpoint monitoring, timely vulnerability remediation, access-control restrictions, and regular incident-response exercises. These controls can reduce the potential impact of future ransomware variants, even as their implementation and delivery methods continue to change.

Sigma rules:
title: Shadow Copies Deletion Using Operating Systems Utilities tags:
– attack.impact
– attack.stealth
– attack.t1070 logsource:
category: process_creation product: windows
detection: selection1_img:
– Image|endswith:
– ‘\powershell.exe’
– ‘\pwsh.exe’
– ‘\wmic.exe’
– ‘\vssadmin.exe’
– ‘\diskshadow.exe’
– OriginalFileName:
– ‘PowerShell.EXE’
– ‘pwsh.dll’
– ‘wmic.exe’
– ‘VSSADMIN.EXE’
– ‘diskshadow.exe’ selection1_cli:
CommandLine|contains|all:
– ‘shadow’ # will match “delete shadows” and “shadowcopy delete” and “shadowstorage”
– ‘delete’ selection2_img:
– Image|endswith: ‘\wbadmin.exe’
– OriginalFileName: ‘WBADMIN.EXE’ selection2_cli:
CommandLine|contains|all:
– ‘delete’
– ‘catalog’
– ‘quiet’ # will match -quiet or /quiet selection3_img:
– Image|endswith: ‘\vssadmin.exe’
– OriginalFileName: ‘VSSADMIN.EXE’ selection3_cli:
CommandLine|contains|all:
– ‘resize’
– ‘shadowstorage’ CommandLine|contains:
– ‘unbounded’
– ‘/MaxSize=’
condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives:
– Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
– LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high
(Source: Surface Web)

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

RECOMMENDATIONS

STRATEGIC RECOMMENDATIONS

• Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
• Ensure that backups of critical systems are maintained that can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATIONS

• A data breach prevention plan must be developed considering (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
• Implement a zero-trust security model alongside multifactor authentication (MFA) to reduce the risk of credential compromise.
• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATIONS

• Update all applications/software regularly with the latest versions and security patches alike.
• Add the Sigma rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.
• Establish and implement protective controls by actively monitoring and blocking identified indicators of compromise (IoCs) and reinforcing defensive measures based on the provided tactical intelligence.

Active Malware of the Week

Type: Information Stealer | Objectives: Credential Theft | Target Technology: Windows/ Web Browsers | Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the Week
This week, “BlackSeeStealer” Malware is in focus.

Overview of Operation BlackSeeStealer Malware
The analyzed BlackSeeStealer malware sample demonstrates the characteristics of credential-focused malware designed to quietly collect sensitive user information while avoiding immediate detection. Rather than exhibiting destructive behavior, the malware emphasizes reconnaissance, browser data collection, and communication with external infrastructure, suggesting that its primary objective is to harvest valuable information for later exploitation. Its execution pattern reflects a well-planned attack that prioritizes stealth and persistence over rapid impact.

Behavioral analysis indicates that malware targets a broad range of web browsers and user environments, attempting to access stored credentials, browsing artifacts, and locally available user information. During execution, it performs environmental checks, gathers system details, and establishes outbound network connections to transmit the collected data. These activities are consistent with modern information-stealing malware that seeks to maximize the value of compromised systems while maintaining a low operational profile.

The sample also incorporates several techniques intended to complicate detection and analysis. By leveraging obfuscation, delaying execution, and checking for analysis environments, it attempts to evade automated security solutions and sandbox environments. Such defensive measures increase the likelihood of successful execution on victim systems and demonstrate a level of operational maturity commonly observed in contemporary cybercriminal malware campaigns.

Overall, the observed behavior highlights a persistent threat to enterprise and individual users who rely on web browsers for credential storage and online activities. The malware’s emphasis on covert information theft, combined with its ability to communicate with external servers and evade analysis, reinforces the importance of proactive endpoint monitoring, credential protection, and behavioral detection mechanisms to reduce the risk of compromise.

Attack Method
The malware begins its execution by performing multiple environmental validation checks before activating its primary functionality. It gathers system information, verifies the execution environment, and inspects the host for indicators associated with debugging or virtualized analysis platforms. These preliminary checks, combined with delayed execution and obfuscated code, are intended to reduce the likelihood of automated detection and ensure that the malware operates only in suitable environments. The sample also dynamically resolves required functions at runtime and loads additional components through shared modules, making static analysis significantly more challenging.

After establishing execution, the malware performs extensive reconnaissance of the infected host. It enumerates running processes, queries the Windows registry, identifies installed security products, and collects detailed operating system and hardware information. The malware then searches for installed web browsers, including Chromium-based browsers, Microsoft Edge, Google Chrome, Brave, Firefox, Opera, Vivaldi, Yandex Browser, and other browser variants. It accesses browser-specific files such as cookies, login databases, browsing history, web data, local storage, IndexedDB, and browser preference files, indicating a strong focus on harvesting authentication material and user activity.

To support credential theft, the malware copies browser-related data into temporary working directories, creates intermediate files containing collected information, and attempts to process encrypted browser databases. The sample also generates auxiliary files containing user system information and installed application details before organizing the harvested data for exfiltration. Throughout this process, it leverages process injection and execution flow manipulation techniques to conceal malicious activity while minimizing direct interaction with user-facing processes. The observed file system activity demonstrates systematic collection of browser artifacts across multiple user profiles and applications.

Following data collection, the malware establishes outbound network communication with external infrastructure to facilitate data transfer. It first queries public IP lookup services to determine the victim’s external network location before transmitting the collected information to a remote server using HTTP POST requests. Network traffic analysis further reveals encrypted communications, DNS lookups, and multiple outbound connections that support command-and-control operations. Combined with its anti-analysis capabilities, browser-focused credential harvesting, runtime code loading, and controlled data exfiltration workflow, the malware demonstrates a structured information-stealing attack chain designed to operate stealthily while maximizing the collection of valuable victim data.

The following are the TTPs based on the MITRE ATT&CK Enterprise framework

INSIGHTS

• The sample analyzed demonstrates that modern information-stealing malware continues to prioritize silent data collection over overtly disruptive activity. Instead of immediately affecting system availability or drawing user attention, the malware operates in the background, systematically gathering information from multiple sources before completing its objective. This operational approach reflects an emphasis on maximizing the value of a compromised system while minimizing indicators that could alert the victim during execution.
• Another notable observation is the malware’s broad targeting strategy. Rather than focusing on a single application or browser, it attempts to interact with numerous widely used browsers and user environments, indicating an effort to increase the likelihood of recovering valuable user data regardless of the victim’s software preferences. This multi-platform collection capability highlights how contemporary credential theft campaigns are designed to remain effective across diverse endpoint configurations without requiring environment-specific customization.
• The overall execution flow also reflects a structured and organized design rather than opportunistic behavior. Individual activities, including environment validation, information collection, temporary data organization, and external communication, appear to be coordinated as part of a defined operational sequence. This level of organization suggests that the malware has been developed with efficiency and reliability in mind, enabling it to complete its objective while maintaining a relatively low operational profile throughout the infection lifecycle.

ETLM ASSESSMENT
From an ETLM Perspective, the continued evolution of this information-stealing malware is expected to reinforce a threat landscape where digital identities and browser-stored credentials become increasingly attractive targets for financially motivated threat actors. As organizations continue to embrace cloud-first environments, browser-based business applications, and hybrid work models, compromised employee accounts are likely to become a preferred pathway for unauthorized access to enterprise resources, sensitive business information, and interconnected third-party services.

This shift is expected to increase the role of information-stealing malware as an enabler of identity-based attacks rather than standalone infections. The growing reliance on legitimate user credentials may facilitate account compromise, business fraud, unauthorized access, and data exposure across multiple industry sectors, ultimately expanding the operational and financial risks associated with modern enterprise environments.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)

YARA Rules
rule BlackSeaStealer_InfoStealer_2026
{
meta:
description = “Detects BlackSeaStealer based on browser credential theft artifacts, network indicators, and behavioral strings”
author = “CYFIRMA” date = “2026-07-27”
strings:

/* IOC */
$hash = “77be91fc4ee0154ee4b6d0a48c596de2bffca40f1aebbf888b9ee2f3e09c89e9” ascii

/* Network Indicators */
$ipify = “api.ipify.org”
$ipapi = “ip-api.com”
$upload = “/upload”
$ua = “IP Checker/1.0”

/* Browser Credential Artifacts */
$login1 = “Login Data”
$login2 = “Login Data For Account”
$cookie1 = “Cookies”
$cookie2 = “Network\\Cookies”
$webdata = “Web Data”
$history = “History”
$local = “Local State”
$prefs = “Preferences”

/* Firefox */
$ff1 = “key4.db”
$ff2 = “logins.json”
$ff3 = “cookies.sqlite”
$ff4 = “places.sqlite”

/* Output Files */
$out1 = “UserInformation.txt”
$out2 = “browser_decryption.log”
$out3 = “installed_applications.txt”

/* Targeted Browsers */
$chrome = “Google\\Chrome”
$edge = “Microsoft\\Edge”
$brave = “BraveSoftware”
$firefox = “Mozilla\\Firefox”
$opera = “Opera”
$vivaldi = “Vivaldi”
$yandex = “YandexBrowser”
$tor = “Tor Browser”

condition:
uint16(0) == 0x5A4D and (
$hash or
(4 of ($login*,$cookie*,$webdata,$history,$local,$prefs,$ff*)) or (2 of ($ipify,$ipapi,$upload,$ua) and 3 of
($out*,$chrome,$edge,$brave,$firefox,$opera,$vivaldi,$yandex,$tor))
)
}

Recommendations

Strategic Recommendations

• Implement a Zero Trust security model with continuous identity verification and least privilege access controls.
• Strengthen enterprise identity protection using multi-factor authentication (MFA) and phishing-resistant authentication methods.
• Establish a comprehensive threat intelligence program to monitor emerging information-stealer campaigns and associated infrastructure.
• Conduct regular security awareness training focused on credential theft, phishing, and malicious downloads.

Management Recommendations

• Enforce organizational policies restricting the storage of business credentials and sensitive information in web browsers.
• Ensure all endpoints are protected with modern Endpoint Detection and Response (EDR) solutions and centralized monitoring.
• Maintain timely patch management for operating systems, browsers, and third-party applications.
• Implement periodic reviews of privileged accounts and regularly rotate credentials for critical business systems.

Tactical Recommendations

• Monitor for unauthorized access to browser credential stores, cookies, and login databases.
• Detect anomalous outbound HTTP/HTTPS communications, especially connections to unknown or low-reputation infrastructure.
• Deploy YARA, Sigma, and IOC-based detection rules to identify BlackSeaStealer artifacts and behaviors.
• Enable PowerShell, Sysmon, and endpoint telemetry logging to improve visibility into process injection, file creation, and credential access activities.
• Block execution from temporary directories and monitor for suspicious file creation associated with browser data collection.
• Continuously hunt for indicators of compromise (IOCs), including known hashes, domains, IP addresses, and behavioral TTPs associated with BlackSeaStealer.

CYFIRMA’s Weekly Insights

1. Weekly Attack Types and Trends

Key Intelligence Signals:

• Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware – RansomHouse Ransomware, The Gentlemen Ransomware| Malware – BlackSeeStealer

o RansomHouse Ransomware– One of the ransomware groups.

o The Gentlemen Ransomware – One of the ransomware groups.
Please refer to the trending malware advisory for details on the following:

• Malware – BlackSeeStealer
  Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

Kimsuky Expands Supply Chain Espionage Through Compromised South Korean Groupware Vendors

• Threat Actor: Kimsuky aka APT43
• Attack Type: Credential Harvesting, Vulnerabilities & Exploits, Social Engineering, Connection Proxy, Supply Chain Compromise
• Objective: Information Gathering, Espionage.
• Suspected Target Technology: Bandzip, Hangul Word Processor, Office Suites Software, Operating System, Social Platforms, Web Application, Windows, macOS, Groupware Platforms, Internet-Facing Mail Servers, Linux Servers, Google Drive, DWAgent
• Suspected Target Geography: Belgium, Bulgaria, Canada, Croatia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Lithuania, Luxembourg, Montenegro, North Macedonia, Norway, Poland, Portugal, Romania, Slovakia, Slovenia., the Czech Republic, the Netherlands, Albania, Brazil, Japan, South Korea, Thailand, USA, Vietnam.
• Suspected Target Industries: Aerospace, Construction, Consulting, Defence, Education, Government, Hi-Tech, Manufacturing, Media & Entertainment, NGO, Pharmaceuticals, Professional Services, Research, Telecommunications, Think Tanks.
• Business Impact: Financial Loss, Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor
Kimsuky is a North Korea-linked advanced persistent threat (APT) group that has been active since at least 2012, conducting cyber espionage operations in support of the Democratic People’s Republic of Korea’s (DPRK) strategic intelligence objectives. The threat actor aligns its operations with national security, foreign policy, and sanctions-related intelligence collection priorities, while continuously evolving its malware ecosystem and intrusion capabilities to maintain long-term covert access. Kimsuky has also demonstrated operational collaboration and resource sharing with other DPRK state-sponsored cyber actors, enhancing its ability to conduct sustained intelligence-gathering campaigns.

Details on Exploited Vulnerabilities

TTPs based on the MITRE ATT&CK Framework

Latest Developments Observed
The Kimsuky threat actor is observed targeting South Korean groupware vendors and their downstream customers by exploiting internet-facing mail server vulnerabilities and conducting spear-phishing against employees. The campaign deploys Gomir, BirdTroy, and DriveTroy malware, followed by lateral movement into customer environments, credential harvesting through tampered groupware login pages, and the abuse of Google Drive as a command-and-control channel to support long-term cyber espionage and sensitive information theft.

ETLM Insights
Kimsuky continues to operate as a North Korea-aligned cyber espionage group focused on long-term strategic intelligence collection in support of the DPRK’s national security and geopolitical objectives. Recent operations demonstrate an increasingly mature operational model centered on compromising trusted enterprise software providers to enable downstream access, extend intelligence collection opportunities, and strengthen operational persistence across interconnected organizational environments.

The threat actor’s operations reflect:

• Strategic exploitation of trusted enterprise software providers to enable indirect compromise of downstream organizations.
• Credential-centric intrusion activity through authentication abuse and trusted identity compromise to expand operational access.
• Sustained operational persistence supported by layered malware deployment, lateral movement, and abuse of legitimate administrative and cloud-based services.
• Adaptive espionage tradecraft through continuous refinement of malware capabilities, command-and-control mechanisms, and operational infrastructure to improve stealth and resilience.

Looking ahead, Kimsuky is expected to further strengthen its supply-chain intrusion capabilities, expand abuse of trusted enterprise ecosystems, and refine stealth-oriented operational methodologies to support persistent intelligence collection. This continued evolution reinforces the group’s ability to conduct scalable downstream compromise while maintaining long-term access across interconnected enterprise environments, posing a sustained espionage threat to organizations operating within complex digital ecosystems.

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

YARA Rules
rule Kimsuky_Gomir_BirdTroy_DriveTroy_IOCs
{
meta:
author = “CYFIRMA”
description = “Detects Kimsuky campaign artifacts based on observed filenames and infrastructure”
date = “2026-07-28”
actor = “Kimsuky”
malware = “Gomir, BirdTroy, DriveTroy” strings:
/* Malware / File Names */
$f1 = “frpc.exe” ascii nocase
$f2 = “exe\\frpc.exe” ascii nocase
$f3 = “install.bat” ascii nocase
$f4 = “win32.dll” ascii nocase

/* Infrastructure */
$d1 = “load.auraria.org” ascii nocase
$d2 = “file.bigcloud.n-e.kr” ascii nocase
$d3 = “erp.spaceme.p-e.kr” ascii nocase
$d4 = “cms.spaceyou.o-r.kr” ascii nocase
$d5 = “female-disorder-beta-metropolitan.trycloudflare.com” ascii nocase
/* Exploited CVEs */
$cve1 = “CVE-2020-8515” ascii
$cve2 = “CVE-2017-17215” ascii
$cve3 = “CVE-2021-26855” ascii
$cve4 = “CVE-2020-5902” ascii condition:
3 of ($f*) or 2 of ($d*) or
(1 of ($f*) and 1 of ($d*)) or 2 of ($cve*)
}

Recommendations

Strategic Recommendations

• Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
• Assess and deploy alternatives for an advanced endpoint protection solution that provides detection/prevention for malware and malicious activities that do not rely on signature-based detection methods.
• Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more, by identifying such patterns.

Management Recommendations

• Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.
• Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.

Tactical Recommendations

• For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
• Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
• Apply security measures to detect unauthorized activities, protect sensitive production and process control systems from cyberattacks.
• Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

3. Major Geopolitical Developments in Cybersecurity

Thailand’s Ministry of Finance hacked with an autonomous AI agent
According to researchers, a threat actor recently deployed an autonomous AI agent during an apparent cyberespionage campaign targeting Thailand’s Ministry of Finance after discovering an exposed server operated by the attackers. The logs revealed that the hackers utilized “Hermes,” an open-source AI agent, configured in “YOLO” mode – a setting that automatically executes potentially dangerous commands without asking for human approval. Operating autonomously, Hermes scanned and enumerated ministry hosts, navigated through file systems, and captured diagnostic output from the privilege-escalation tool LinPEAS on adjacent network devices. While the researchers have stopped short of formally attributing the campaign to a specific group, several indicators discovered during the investigation point toward Chinese-speaking attackers.

ETLM Assessment:
China-aligned cyberespionage groups have a long-standing history of targeting Thai government entities and critical infrastructure to gather economic and strategic intelligence. Campaigns by state-backed APTs such as Mustang Panda, RedHotel, and the emergent group CeranaKeeper have repeatedly breached Southeast Asian public sector networks, specifically focusing on Thai ministries, cabinet offices, and state agencies. These operations typically focus on long-term data exfiltration and persistent network access to monitor trade negotiations, financial policy, and regional geopolitical developments, making economic institutions like the Ministry of Finance routine targets for Chinese intelligence gathering.

Russian hackers target unpatched Zimbra servers
US intelligence agencies, alongside their Five Eyes partners and European allies, have issued a joint advisory warning of an ongoing Russian state-sponsored phishing campaign targeting Western government and commercial entities. The operation, attributed to the Russian threat group tracked as “Laundry Bear” or “Void Blizzard,” aims to harvest sensitive email data on behalf of the Russian government by exploiting vulnerable installations of the Zimbra Collaboration Suite (ZCS).

The campaign initially leveraged a critical Zimbra vulnerability (CVE-2025-66376) as a zero-day starting last year. Although Zimbra issued a patch for the flaw in November 2025, Laundry Bear continues to successfully breach organizations that have failed to update their systems. According to researchers, the flaw allows for “half-click” exploitation, meaning the malicious payload executes automatically as soon as a target opens the email.

The investigation revealed that the phishing messages deploy a JavaScript payload into the victim’s browser, which proceeds to exfiltrate email credentials, CSRF tokens, two-factor authentication scratch codes, system environment details, and up to 90 days of the victim’s email and search history.

ETLM Assessment:
Based on intelligence advisories from Western security agencies (including CISA, the NSA, and Five Eyes partners), groups like Laundry Bear / Void Blizzard are driven by political and military espionage rather than financial gains. Their primary target is Western military support & logistics for Ukraine, like tracking schedules, routes, and procurement details for Western military equipment and weapons shipments moving into Ukraine. On top of that, there are defense contractors, aerospace engineering firms, and logistics providers in NATO countries to assess manufacturing capacities and military supply chains.

4. Rise in Malware/Ransomware and Phishing

RansomHouse Ransomware Impacts a Food & Beverage Company from Japan

• Attack Type: Ransomware
• Target Industry: Food & Beverage
• Target Geography: Japan
• Ransomware: RansomHouse Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by RansomHouse Ransomware. The Compromised company is a premier Japanese holding company that has established itself as a market leader by pioneering the frozen food industry and providing end-to-end temperature-controlled logistics solutions. With a clear mission to deliver true satisfaction, the Group leverages its integrated capabilities across food procurement, processing, and logistics to optimize the supply chain and support the nation’s food culture. As Japan’s number one frozen food producer and the holder of the largest refrigerated warehouse capacity in the country, the company combines advanced R&D with a robust global network to ensure quality and consistency. The company’s business portfolio extends from processed foods and marine products to bioscience and logistics, serving as a critical social infrastructure for food distribution. By adapting to changing social needs and economic environments, it continues to create sustainable value and strengthen its position as a cornerstone of the food industry. The compromised data includes confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

• RansomHouse emerged in March of 2022 and is categorized as a multi-pronged extortion threat. The attackers exfiltrate all enticing data and threaten to post it all publicly.
• The RansomHouse Ransomware group primarily targets countries such as the United States of America, China, Spain, Brazil and Japan.
• The RansomHouse Ransomware group primarily targets industries such as Manufacturing, Information Technology, Healthcare, Government & Civic, and Professional Goods & Services.
• Based on the RansomHouse Ransomware victims list from 1st Jan 2026 to 28th July 2026, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the RansomHouse Ransomware group victims list from 1st Jan 2026 to 28th July 2026 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, RansomHouse ransomware predominantly targets large enterprises and high-value organizations through phishing and spear phishing campaigns. The group also employs third-party frameworks such as Vatet Loader, Metasploit, and Cobalt Strike to gain initial access and perform lateral movements within victim networks. RansomHouse typically skips data encryption, focusing instead on exfiltrating sensitive data to extort victims by threatening to publicly release the stolen information. This approach allows the group to maintain stealth and prolong their presence in targeted environments.

The Gentlemen Ransomware Impacts a Construction and Information Technology Company from Japan
Attack Type: Ransomware
Target Industry: Construction and Information Technology
Target Geography: Japan
Ransomware: The Gentlemen Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a Japanese software company based in Itoigawa, Niigata, specializing in construction project management solutions. For over three decades, the company has developed the CDPM series, a widely recognized software for creating and managing complex construction schedules. Recently, the company has been actively driving digital transformation in the construction industry through its advanced CDPM-X64 platform, which introduces innovative features such as native JSON support and comprehensive schedule analysis tools. The compromised data includes confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

• The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
• The Gentlemen Ransomware group primarily targets countries such as the United States of America, Thailand, France, Germany, and Brazil.
• The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
• Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 28th July 2026, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 28th July 2026 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploit

Vulnerability in Atlassian Sourcetree

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Source Code Management (SCM) Client / Version Control Application
• Vulnerability: CVE-2026-21575
• CVSS Base Score: 7.1 Source
• Vulnerability Type: Improper Access Control
• Summary: The vulnerability allows a remote attacker to execute arbitrary code.

Relevancy & Insights:
The vulnerability exists due to improper access control in Sourcetree for Windows when handling crafted content.

Impact:
A remote attacker can trick the victim into processing crafted content to execute arbitrary code.
User interaction is required for exploitation.

Affected Products:
https[:]//jira[.]atlassian[.]com/browse/SRCTREE-8275

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment
The vulnerability in Atlassian Sourcetree poses a security risk to organizations that rely on the application for managing source code repositories and software development workflows. As Sourcetree is widely used by developers and development teams to interact with Git and Mercurial repositories, exploitation of this improper access control vulnerability could allow unauthorized users to access sensitive information or perform actions beyond their intended privileges. Such unauthorized access may expose source code, development assets, configuration data, and other sensitive project information, potentially impacting the confidentiality and integrity of software development environments. Organizations using Atlassian Sourcetree should promptly apply the latest security updates, enforce strong access control policies, restrict application usage to authorized users, and continuously monitor for suspicious activities to reduce the risk of compromise. Timely remediation is essential to protecting development environments and maintaining the security of enterprise software development operations.

6. Latest Cyber-Attacks, Incidents, and Breaches

Krybit Ransomware attacked and published the data of a Manufacturing company from India

• Threat Actor: Krybit Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Manufacturing
• Target Geography: India
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a Manufacturing company from India on its dark web website. The compromised company is a recently incorporated Indian private limited company established on March 27, 2023, headquartered in Bangalore, Karnataka, India. The company is classified under the manufacture of pharmaceuticals, medicinal chemicals, and botanical products sector, as well as paper and paper products manufacturing. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of data compromised is approximately 31.40.

Source: Dark Web

Relevancy & Insights:

• Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is paid.
• The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Government & Civic, Consumer Goods & Services, and Information Technology.

ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.

7. Data Leaks

Unauthorized Reservation Platform Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Information Technology (Reservation & Business Management Software / SaaS)
• Target Geography: Japan
• Objective: Financial Gain
• Business Impact: Exposure of Personally Identifiable Information (PII), Customer Privacy Risks, Credential Disclosure, Business Information Exposure, Regulatory Compliance Concerns, Financial Loss, Reputational Damage

Summary
The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large database allegedly obtained from a Japanese online reservation and business management platform. According to the forum advertisement, the seller claims to have compromised the organization’s infrastructure and exfiltrated approximately 32 million customer records from its database. The advertisement further states that sample records have been published as proof of possession while the complete dataset is being offered for sale through an escrow-based transaction. This reporting format is consistent with previously documented dark web data leak assessments.

Allegedly Exposed Data
Based on the information presented in the forum advertisement and the visible sample records, the exposed dataset may contain:

• Customer identification numbers
• Customer names
• Email addresses
• Telephone numbers
• Residential addresses
• Reservation history
• Appointment information
• Date of birth
• Gender information
• Account credentials (where available)
• Password hashes or authentication-related fields
• Internal customer identifiers
• Business-related records
• Database metadata
• Additional structured customer information

The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and accompanying screenshots and has not been independently confirmed.

Source: Underground Forums

Unauthorized Job Portal Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Human Resources & Recruitment
• Target Geography: Saudi Arabia
• Objective: Financial Gain
• Business Impact: Exposure of Sensitive Corporate Data, Intellectual Property Risks, Operational Information Disclosure, Regulatory Compliance Concerns, Financial Loss, Reputational Damage.

Summary:
The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large database allegedly obtained from a Middle Eastern online recruitment platform. According to the forum advertisement, the seller claims to possess approximately 872,000 records containing user registration details, authentication information, candidate profiles, and associated metadata. The advertisement states that sample information has been shared as proof of possession, while the complete dataset is being offered for sale through an escrow-based transaction. This reporting structure follows the same assessment methodology used for previously documented data leak advertisements.

Allegedly Exposed Data
Based on the information presented in the forum advertisement, the allegedly exposed dataset may contain:

Candidate Personal Information

• First, middle, and last names
• Email addresses
• Mobile and landline phone numbers
• Residential addresses
• City, state, and country information
• Nationality
• Gender
• Date of birth (DOB)
• Marital status
• Emergency contact information
• Preferred communication preferences
• Linked professional profile references

Candidate Professional Information

• Passport information
• Work experience and employment history
• Local, Gulf, Qatar, and international experience
• Skills and competencies
• Educational background
• Certifications
• Languages spoken
• Current salary
• Expected salary
• Notice period
• Preferred job location
• Employment availability
• Resume and profile metadata

Recruitment & System Information

• Candidate registration records
• Authentication-related logs
• Contact ownership information
• Recruiter assignments
• Lead source details
• Account status information
• Record update timestamps
• Profile completion status
• Internal reference identifiers
• Additional recruitment platform metadata
• The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and accompanying screenshots and has not been independently confirmed.

Source: Underground Forums

Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:
The threat actor is assessed as an active and capable entity primarily engaged in data-leak operations, with multiple credible indications linking them to incidents involving unauthorized system access and the dissemination or sale of stolen data on dark web forums. These activities underscore the growing sophistication of cyber threats driven by organized underground networks and highlight the urgent need for organizations to enhance their cybersecurity posture through continuous monitoring, improved threat intelligence, and proactive defensive measures to protect sensitive information and critical infrastructure.

Recommendations: Enhance the cybersecurity posture by:

1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
2. Ensure proper database configuration to mitigate the risk of database-related attacks.
3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large collection of documents allegedly obtained from a healthcare organization in Qatar. According to the forum advertisement, the seller claims to possess more than 30,000 curriculum vitae (CVs) belonging to healthcare professionals, including doctors, nurses, paramedics, and other medical staff. The advertisement states that sample files have been made available as proof of possession, while the complete dataset is being offered for sale through an escrow-based transaction. This reporting format follows the standard methodology used for assessing dark web data leak advertisements.

Allegedly Exposed Data
Based on the information shared in the forum advertisement, the allegedly exposed dataset may include:

• Curriculum Vitae (CVs) of healthcare professionals
• Doctors’ professional profiles
• Nurses’ employment records
• Paramedics’ professional documents
• Medical staff resumes
• Personal identification details
• Contact information
• Educational qualifications
• Professional certifications
• Employment history
• Clinical experience
• Skills and areas of specialization
• Professional references
• Licenses and accreditation details
• Additional recruitment and employment documentation

Advertisement Claims
According to the forum post, the seller claims:

• The dataset contains approximately 30,993 medical professional CVs.
• The files are available in multiple document formats, including:
• PDF documents
• DOCX files
• DOC files
• Sample documents have been published to demonstrate possession.
• The complete dataset is available through an escrow-based transaction.
• Payment is requested using cryptocurrency through the forum’s escrow service.

The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and accompanying screenshots and has not been independently confirmed.

Source: Underground Forums

RECOMMENDATIONS

STRATEGIC RECOMMENDATIONS

• Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response plan.
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATIONS

• Take advantage of global Cyber Intelligence, providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions, remediations, and lessons learned.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM solutions.
• Ensure that detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies should be continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATIONS

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Consider using security automation to speed up threat detection, improved incident response, increased visibility of security metrics, and rapid execution of security checklists.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence provided.
• Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security controls, such as reCAPTCHA (completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.