Weekly Intelligence Report – 04 Sep 2026 | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Ransomware of the Week

Ransomware in focus
CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology – that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows OS
Targeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, Chile

Targeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation

Introduction:
CYFIRMA Research and Advisory Team has found Fiasco Group Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

Fiasco Ransomware
Fiasco Ransomware is a file-encrypting ransomware that compromises systems, encrypts files using the AES algorithm, and appends the .secure extension to affected filenames. For example, files such as 1.jpg and 2.png are renamed to 1.jpg.secure and 2.png.secure. The malware also creates a ransom note named CONTACT US.txt after encryption. In addition to file encryption, the attackers claim to have exfiltrated sensitive information before encryption, including personal records, financial documents, customer information, business-confidential files, source code, databases, accounting data, and audit reports. This makes the threat a double-extortion ransomware, combining data encryption with the threat of public data disclosure.

Screenshot: File encrypted by ransomware

(Source: Surface Web)

The ransom note informs victims that their network has been compromised and that their files have been encrypted, while threatening to publish the allegedly stolen data if the victim does not cooperate. It instructs victims to establish contact through a private messaging service and provide a specified identification key so the attackers can identify the victim and continue ransom negotiations. No fixed ransom amount is provided; payment demands and further instructions are apparently given after communication is established. The note also attempts to discourage victims from seeking outside assistance by warning against third-party decryption tools, authorities, recovery specialists, and intermediaries, while threatening permanent data loss, fraud, identity theft, reputational damage, financial losses, regulatory consequences, and exposure of confidential information if the ransom demands are not followed.

Screenshot: The appearance of Fiasco’s ransom note (CONTACT US.txt) (Source: Surface Web)

Following are the TTPs based on the MITRE Attack Framework.

Relevancy and Insights:

• The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities.
• calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system.
• The ransomware terminates processes such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.
• Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.
• Check-bios: The ransomware checks the system’s BIOS information to identify characteristics of the underlying machine, such as the manufacturer, model, or firmware details. This information can help the malware determine whether it is running on a physical Windows system, virtualized environment, or an analysis/sandbox setup. Such checks may support environment awareness and anti-analysis behavior, allowing the ransomware to alter or avoid execution when suspicious system characteristics are detected.

ETLM Assessment:
Fiasco Ransomware is likely to evolve by improving its stealth, environment awareness, and encryption capabilities to make detection and analysis more difficult. Future variants may expand their use of Windows-native utilities, system APIs, WMI, registry modifications, and other legitimate system components to blend malicious activity with normal administrative operations. The malware may also strengthen its anti-analysis mechanisms by performing more extensive checks for virtual machines, sandboxes, debugging environments, BIOS characteristics, security software, and other indicators of automated analysis. Additional techniques for disabling recovery mechanisms, terminating security-related processes, deleting backups and shadow copies, and maintaining persistence could further increase its impact on compromised Windows systems.

Future versions may also place greater emphasis on data theft and double-extortion operations, potentially targeting a wider range of sensitive files before encryption. Attackers could automate the identification and collection of high-value information such as financial records, databases, credentials, source code, and confidential business documents, followed by threats of public disclosure to increase pressure on victims. The ransomware may further evolve through more sophisticated command-and-control mechanisms, configurable encryption routines, and improved evasion techniques. Overall, the likely evolution of Fiasco is toward a more stealthy, automated, and resilient ransomware operation that combines rapid file encryption, recovery inhibition, sensitive-data exfiltration, and extortion to maximize operational and financial impact.

Sigma rule:
title: Boot Configuration Tampering Via Bcdedit.EXE
tags:
– attack.impact
– attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
– Image|endswith: ‘\bcdedit.exe’
– OriginalFileName: ‘bcdedit.exe’
selection_set:
CommandLine|contains: ‘set’
selection_cli:
– CommandLine|contains|all:
– ‘bootstatuspolicy’
– ‘ignoreallfailures’
– CommandLine|contains|all:
– ‘recoveryenabled’
– ‘no’
condition: all of selection_*
falsepositives:
– Unlikely
level: high
(Source: Surface Web)
Indicators of Compromise
Kindly refer to the IOCs section to exercise control of your security systems
(Source: Surface Web)

STRATEGIC RECOMMENDATION

• Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
• Ensure that backups of critical systems are maintained which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATION

• A data breach prevention plan must be developed considering, (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) If there is a requirement to inform the local authority.
• To reduce the risk of credentials being compromised, enable multifactor authentication (MFA) and zero-trust architecture.
• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATION

• Ensure that all applications and software are consistently maintained by deploying the most recent releases and applying available security updates and patches in a timely manner.
• Incorporate the Sigma rule for threat detection and monitoring, which will assist in identifying and tracking suspicious activity as well as detecting anomalies in log events.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

Focus Malware of the Week

Active Malware of the Week
Type: RAT (Remote Access Trojean)
Objectives: Survillance and Data Exfiltration
Target Technology: Windows
Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the week
This week “LiquidRAT” Malware is in focus.

Overview of Operation LiquidRAT Malware
LiquidRAT is a malicious remote-access threat designed to establish and maintain unauthorized control over a compromised system. Its observed behavior indicates that the malware is intended to operate quietly in the background while providing an attacker with continued access to the affected environment. Rather than performing a single disruptive action, it combines several capabilities that allow an intrusion to remain active and potentially expand over time.

The sample demonstrates a clear interest in information available on the compromised device, including sensitive account information, browser-related data, local files, and system configuration. This activity indicates that the malware is focused on gathering information that could be useful to an attacker. From an organizational perspective, such behavior creates the possibility of unauthorized access to business information, user accounts, and other valuable resources.

LiquidRAT also incorporates mechanisms intended to maintain its presence after routine system events such as restarts or user logons. At the same time, its behavior shows an effort to reduce the likelihood of being discovered and removed. This combination of persistence and stealth increases the potential exposure period, allowing unauthorized activity to continue even when the original point of compromise is no longer obvious.

The overall assessment indicates that LiquidRAT represents a significant security concern because it provides a sustained foothold from which an attacker can monitor the affected system, gather information, and maintain communication with external infrastructure. Organizations should therefore treat any confirmed presence of the malware as a potential compromise rather than an isolated malware detection and conduct appropriate investigation, containment, and remediation activities.

Attack Method
Upon execution on a Windows system, LiquidRAT establishes an initial execution state by creating mutex objects that help prevent multiple copies of the malware from running simultaneously. The use of unique mutex names, including OneSettingQueryMutex+compat+encapsulation and WillyRat_Client_SingleInstance_Mutex, indicates that the sample performs an instance check before continuing its activity. It also performs limited host-level checks to understand the environment in which it is running. The malware further employs memory-based execution techniques that reduce the amount of directly observable code on disk and complicate conventional static examination. Activity consistent with code injection allows portions of its functionality to operate within legitimate processes, making process-level identification more challenging.

The malware establishes persistence through multiple Windows autostart locations. It modifies the user’s Run registry configuration so that the malicious component can be launched when the affected user signs in. It also places a component in the user’s Startup directory, providing a second mechanism for automatic execution during logon. This redundancy increases the likelihood that the malware will remain operational if one persistence location is removed. In parallel, LiquidRAT incorporates techniques intended to conceal its activity, remove selected traces from the system, and obtain elevated privileges. These behaviors collectively make remediation more difficult and can reduce the amount of evidence available for subsequent investigation.

A significant part of the malware’s operation is dedicated to collecting information from the compromised host. It accesses Windows credential-related data and attempts to obtain cached authentication material without requiring direct user interaction. The malware also targets browser data stores, including locations containing saved credentials and session-related information such as cookies. In addition, it searches and reads files stored locally on the system, potentially exposing documents, configuration information, and other sensitive content. Before or alongside collection, the malware performs host and process discovery and examines aspects of the system and its security environment, allowing it to understand the available resources and identify information of potential value.

The collected information is prepared for communication with external infrastructure controlled by the operator. Analysis identified communication with multiple external endpoints, including services such as api.ipify.org, demonstrating that the malware maintains network connectivity as part of its operational workflow. This communication channel provides the implant with a means to exchange information with its remote infrastructure and potentially support additional activity after the initial compromise. The combination of single-instance control, memory-based execution, persistent autostart mechanisms, privilege-related activity, host discovery, credential and browser-data collection, local file access, and external communication demonstrates a multi-stage attack method designed to maintain access while extracting valuable information from the compromised Windows environment.

Following are the TTPs based on the MITRE Attack Framework for Enterprise

INSIGHTS

• LiquidRAT’s overall design suggests that the compromised system is treated as a source of opportunity rather than simply a target for disruption. Its activity reflects an emphasis on obtaining information that can provide continuing value to an attacker, particularly information connected to user activity and access. This makes the threat more closely associated with unauthorized information acquisition and account abuse than with immediate system damage.
• The sample also reveals a level of operational maturity in how its different capabilities complement one another. Its behavior does not appear to be a collection of unrelated functions; instead, the activities observed during analysis support a broader intrusion objective. The combination of information gathering, system awareness, and continued operation indicates that considerable attention was given to making the malware useful after the initial compromise.
• Another notable insight is the apparent value placed on identity and access-related information. The focus on credentials and browser-associated information suggests that access itself may be more valuable to the operator than any individual document stored on the machine. This distinction is important because compromised accounts can potentially provide access beyond the originally infected endpoint, making the affected system a possible entry point into a wider environment rather than an isolated victim.

ETLM ASSESSMENT
From an ETLM perspective, LiquidRAT-like threats are likely to contribute to a future where malware-driven compromises become increasingly intertwined with normal business activity rather than appearing as isolated security incidents. Organizations may face greater operational and financial consequences as compromised identities are used across legitimate services, making the boundary between genuine employee activity and attacker activity harder to distinguish. For employees, this could translate into greater disruption to routine work, increased scrutiny of account activity, and a higher likelihood that a single compromised identity triggers consequences beyond the original device. As criminal ecosystems become more organized, the value of access may increasingly extend beyond immediate data theft, with compromised accounts potentially becoming steppingstones for fraud, impersonation, and broader business disruption. The resulting incidents are therefore likely to demand faster organizational decision-making and stronger coordination between security, IT, and business teams, particularly as the distinction between a malware infection and a wider identity-related compromise becomes less clear.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems.
(Source: Surface Web)

YARA Rule
rule LiquidRAT_Malware
{
meta:
description = “Detection rule for the analyzed malware sample”
author = “CYFIRMA”
date = “9-01-2026”

strings:
$hash = “38ede0841f4d1b161cc2b1e0857893e596d843703aa16adf32cbdfe37e208057”
$s1 = “C:\\Windows\\System32\\fodhelper.exe”
$s2 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding”
$s3 = “C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\” /svc”
$s4 = “C:\\Windows\\System32\\svchost.exe -k NetworkService -p”
$s5 = “C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup”
$s6 = “C:\\Windows\\system32\\sppsvc.exe”
$s7 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc”
$s8 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost”
$s9 = “C:\\Windows\\system32\\lsass.exe”
$s10 = “C:\\Windows\\system32\\svchost.exe -k LocalService -s W32Time”
$s11 = “C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p”
$s12 = “C:\\Users\\user\\AppData\\Roaming\\WindowsRuntime\\winrt.exe\” –u USERNAME_PLACEHOLDER –n \”NOTE_PLACEHOLDER”
$s13 = “C:\\Users\\user\\AppData\\Roaming\\WindowsRuntime\\winrt.exe –u USERNAME_PLACEHOLDER –n \”NOTE_PLACEHOLDER”
$s14 = “VaultSvc”
$s15 = “clipsvc”
$s16 = “PcaSvc”
$s17 = “BITS”
$s18 = “WSearch”
$s19 = “dnsCache”
$s20 = “executable.exe”
$s21 = “C:\\Users\\\\Desktop\\executable.exe”
$s22 = “winrt.exe”
$s23 = “%APPDATA%\\windowsruntime\\winrt.exe”
$s24 = “stealer.exe”
$s25 = “%TEMP%\\windowsruntime\\stealer.exe”
$s26 = “trtlvpe.exe”
$s27 = “C:\\gqqwhk\\trtlvpe.exe”
$s28 = “file.exe”
$s29 = “C:\\Users\\user\\Desktop\\file.exe”
$s30 = “http://c.pki.goog/r/gsr1.crl”
$s31 = “c.pki.goog/r/gsr1.crl”
$s32 = “http://c.pki.goog/r/gsr1.crl0”
$s33 = “c.pki.goog/r/gsr1.crl0”
$s34 = “http://c.pki.goog/r/r4.crl”
$s35 = “c.pki.goog/r/r4.crl”
$s36 = “http://c.pki.goog/r/r4.crl0”
$s37 = “c.pki.goog/r/r4.crl0”
$s38 = “http://c.pki.goog/we1/JWW3Gj56Zd4.crl”
$s39 = “c.pki.goog/we1/JWW3Gj56Zd4.crl”
$s40 = “LiquidRAT”
condition:
$hash or
3 of ($s*)
}

STRATEGIC RECOMMENDATION

• Establish an organization-wide endpoint security strategy covering malware prevention, detection, and response.
• Prioritize protection of sensitive credentials and business information stored or accessed from employee endpoints.
• Adopt layered security controls so that a single compromised endpoint does not provide prolonged access to organizational resources.
• Conduct periodic threat assessments to identify exposure to multi-purpose malware and similar information-stealing threats.

MANAGEMENT RECOMMENDATION

• Direct affected users to rotate passwords and confirm multi-factor enrolment as part of the response checklist.
• Ensure endpoint protection and security monitoring capabilities are consistently deployed across employee systems.
• Establish clear incident-response procedures for suspected malware infections, including isolation, investigation, and recovery.
• Provide regular security-awareness training focused on suspicious files, links, downloads, and unexpected system activity.
• Maintain appropriate controls over access to sensitive corporate information and user accounts.

TACTICAL RECOMMENDATION

• Audit Run/RunOnce registry values and Startup-folder entries for unfamiliar items and remove anything created by this threat.
• Block delivery infrastructure such as ‘api.ipify.org’ at DNS, proxy and firewall level, and inspect egress logs for prior retrievals.
• Force password resets and revoke active sessions for users on affected systems; verify MFA coverage to blunt harvested-credential replay.
• Monitor endpoints for unusual PowerShell activity, unexpected process trees and unauthorized changes to security settings.
• Block and monitor the infrastructure listed in the IOC section at DNS, proxy and perimeter controls.
• Isolate confirmed cases promptly, then reset credentials and review autostart locations before restoration.

Weekly Intelligence Trends/Advisory

1. Weekly Attack Type and Trends

Key Intelligence Signals:

• Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware –Krybit Ransomware, The Gentlemen Ransomware | Malware – LiquidRAT
• Krybit Ransomware – One of the ransomware groups.
• The Gentlemen Ransomware – One of the ransomware groups.
• Please refer to the trending malware advisory for details on the following:
• Malware – LiquidRAT
• Behaviour –Most of these malware use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

Tortoiseshell: Recent Infrastructure Expansion and Evolution of Operational Capabilities

• Threat Actor: Tortoiseshell aka UNC1549
• Attack Type: AppDomainManager Hijacking, DLL Sideloading, Impersonation, Malware Implant, Social Engineering, Spear-Phishing
• Objective: Espionage, Credential Theft
• Suspected Target Technology: Microsoft Azure, Windows OS
• Suspected Target Geography: Albania, India, Israel, Turkey, UAE, US
• Suspected Target Industries: Aerospace & Defense, Automotive & Manufacturing, Consulting & Professional Services, Education, Energy & Utilities, Financial Services, Government & Public Administration, Human Resources & Recruitment, Information Technology, Information Services & Media, Telecommunications, Transportation & Logistics, Research & Development, Software & Technology, Nonprofit & Religious Organizations, Advertising & Marketing.
• Business Impact: Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor
UNC1549, an Iranian threat actor linked to Tortoiseshell and potentially to the IRGC, has been active since at least June 2022 and has targeted entities globally, with a primary focus on organizations across the Middle East. Threat actor is suspected of leveraging spear-phishing and credential harvesting for initial access, followed by the deployment of custom malware, including the MINIBIKE and MINIBUS backdoors. The threat actor has also employed evasion techniques and the LIGHTRAIL tunneler during its operations. While UNC1549 maintains a strong regional focus on Middle Eastern targets, its observed activities indicate a potential expansion toward entities across other regions globally.

TTPs based on MITRE ATT&CK Framework

Latest Developments Observed
The threat actor Tortoiseshell is assessed to be expanding its operational infrastructure and geographic targeting across the Middle East and Europe, with newly identified infrastructure containing subdomains resembling country names, including the UAE, Saudi Arabia, UK, Belgium, Canada, Australia, and Japan. The investigation also uncovered previously unreported malware, including an SSH-based tunneling utility and a TWOSTROKE backdoor capable of executing shell or file commands, uploading and exfiltrating files, downloading files, and conducting reconnaissance. The findings indicate continued development of Tortoiseshell’s operational capabilities and ongoing use of infrastructure and tooling to maintain access to targeted environments.

ETLM Insights
Tortoiseshell (UNC1549) is demonstrating increasing operational maturity through the expansion of infrastructure and continued use of custom tooling to support access to targeted environments. The discovery of infrastructure across the Middle East and Europe indicates that the actor may be broadening its operational reach beyond its historically observed regional focus.

The threat actor’s recent activity highlights:

Infrastructure diversification through geographically distributed servers and country-themed subdomains, potentially supporting operations against a wider range of regional targets.

Network-level access capabilities through reverse SSH tunneling, enabling traffic from attacker-controlled infrastructure to reach compromised internal networks.

Expanded post-compromise functionality through the TWOSTROKE-like backdoor, supporting command execution, file transfer, reconnaissance, and in-memory DLL execution.

C2 resilience through multiple hardcoded C2 servers, allowing compromised systems to communicate with alternative infrastructure if a primary server becomes unavailable.

Looking ahead, the threat actor is likely to further diversify its infrastructure and refine its remote-access capabilities to support persistent operations across strategically relevant targets. The continued use of tunneling utilities and capable backdoors suggests that maintaining reliable access and extending control within compromised environments will remain important elements of the actor’s operations.

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

YARA Rules
rule Threat_Indicators_Secur32_Domains_CVEs
{
meta:
description = “Detects known domains, CVE references, and secur32.dll indicator”
author = “CYFIRMA”
date = “2026-08-31”

strings:
$domain1 = “ramiltons-finance.azurewebsites.net” ascii wide nocase
$domain2 = “ramiltonsfinance.azurewebsites.net” ascii wide nocase
$domain3 = “ramiltonsfinance.com” ascii wide nocase
$domain4 = “premier-healthadvisory.azurewebsites.net” ascii wide nocase

$cve1 = “CVE-2023-2033” ascii wide nocase
$cve2 = “CVE-2023-2136” ascii wide nocase
$cve3 = “CVE-2023-41991” ascii wide nocase
$cve4 = “CVE-2023-41992” ascii wide nocase
$cve5 = “CVE-2023-41993” ascii wide nocase

$dll = “secur32.dll” ascii wide nocase

condition:
1 of ($domain*) or
1 of ($cve*) or
$dll
}

Recommendations

Strategic Recommendations

• Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
• Assess and deploy alternatives for an advanced endpoint protection solution that provides detection/prevention for malware and malicious activities that do not rely on signature-based detection methods.
• Deploy Zero Trust Policy that leverages tools like security information management, advanced security analytics platforms, security user behaviour analytics, and other analytics systems to help the organization’s security personnel observe in real-time what is happening within their networks so they can orient defences more intelligently.

Management Recommendations

• Look for email security solutions that use ML- and AI-based anti-phishing technology for BEC protection to analyze conversation history to detect anomalies, as well as computer vision to analyze suspect links within emails.
• Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.
• Move beyond the traditional model of security awareness towards Improved Simulation and training exercises that mimic real attack scenarios, account for behaviors that lead to a compromise, and are measured against real attacks the organization receives.

Tactical Recommendations

• For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
• Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
• Set up DMARC (Domain-based Message Authentication Reporting & Conformance) to stop phishers from spoofing your domain (that is, making their emails look like they come from your organization).
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.
• Add the YARA rule for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

China-Linked Hackers Targeting NASA, DOJ, Fed and US Senate
US authorities have disrupted online infrastructure used by a Chinese state-sponsored hacking group targeting key American agencies and critical infrastructure. According to the Department of Justice, the FBI and partner agencies disabled two platforms – QScan and QTRouter – operated by QTFY, a contractor linked to Nanjing Xinjiuwei Network Technology. The group, which offers cyber operations to China’s Ministry of State Security and People’s Liberation Army, used the platforms to mask malicious traffic while targeting entities including NASA, the Department of Energy, the Federal Reserve, and the US Senate.

ETLM Assessment:
According to the statement, QScan scans and automatically infects thousands of [IoT] devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers. QTRouter then serves as an ‘obfuscation network’ – meaning it allows QTFY and other malicious cyber actors to conceal the PRC origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks. The campaign underscores what US officials describe as a sustained, strategic effort by Beijing to infiltrate key American networks and collect critical intelligence.

Iran Recruiting Thousands of Hacktivist Hackers
Ravin Academy, a US-sanctioned Iranian cybersecurity training firm, has announced its largest recruitment drive to date, offering up to 1,200 free scholarships despite federal efforts to shut it down. According to public reporting, the yearlong program recruits Iranians aged 17 to 30, drawing on unauthorized materials from major US tech firms and offering pathways to fulfill military service or work for Iran’s Ministry of Intelligence. While there is no direct evidence linking the academy to recent breaches – such as July cyberattacks on US water systems linked to Iranian-affiliated groups – analysts warn the expanding academy serves as a key feeder for Iran’s strategic cyberwarfare operations. The firm also maintains ties to Positive Technologies, a US-sanctioned Russian cybersecurity company linked to Russian intelligence.

ETLM Assessment:
Stripped of cash by US sanctions and facing targeted strikes on its state-run cyber command, Iran has adapted its defense doctrine to a distributed mosaic approach, relying on private academies and outsourced hacktivists to maintain its offensive posture on a budget.

This decentralized pipeline offers Tehran a low-cost, resilient engine to scale up proxy hacktivism and persistent nuisance attacks while navigating severe domestic financial constraints.

4. Rise in Malware/Ransomware and Phishing

Krybit Ransomware Impacts a Manufacturing Company from Thailand

• Attack Type: Ransomware
• Target Industry: Manufacturing
• Target Geography: Thailand
• Ransomware: Krybit Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Thailand was compromised by Krybit Ransomware. The compromised company is a Thai manufacturer and distributor of metal sheet products established in 2002 as a joint venture, providing high-quality metal roofing, siding, flooring, and ceiling solutions for factories, warehouses, and homes across Thailand. Products are crafted from premium materials like Zincalume and Colorbond from NS BlueScope Steel, ensuring durability, style, and cost-effectiveness. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.

The following screenshot was observed published on the dark web:

Source: Dark Web

Relevancy & Insights:

• Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is paid.
• The Krybit Ransomware group primarily targets countries such as India, Thailand, France, Brazil, and Taiwan.
• The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Healthcare, Real Estate & Construction, and Government & Civic.
• Based on the Krybit Ransomware victims list from 1st Jan 2026 to 01st September 2026, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the Krybit Ransomware group victims list from 1st Jan 2026 to 01st September 2026 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.

The Gentlemen Ransomware Impacts a Manufacturing Company from Japan

• Attack Type: Ransomware
• Target Industry: Manufacturing
• Target Geography: Japan
• Ransomware: The Gentlemen Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary: CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from Japan was compromised by The Gentlemen Ransomware. The compromised company is a Japanese manufacturing company based in Numazu, Shizuoka, established in 1971. They specialize in powder handling technology, providing comprehensive solutions for the storage, feeding, weighing, and transportation of bulk powders. The company designs and manufactures custom industrial equipment and container systems for various industries dealing with fine particulate materials. The compromised data includes confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

• The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
• The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Italy.
• The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
• Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 01st September 2026, the top 5 Target Countries are as follows:
  
• The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 01st September 2026 are as follows:
  

ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploits

Vulnerability in Spring Cloud Gateway

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Web Application
• Vulnerability: CVE-2026-47879
• CVSS Base Score: 7.7 Source
• Vulnerability Type: Improper Access Control
• Summary: The vulnerability allows a remote user to access native files and perform server-side request forgery.

Relevancy & Insights:
The vulnerability exists due to improper access control in JsonToGrpcGatewayFilterFactory when processing proto descriptor resource locations.

Impact :
A remote privileged user can specify an arbitrary Spring Resource location to access native files and perform server-side request forgery.

Affected Products:
https[:]//spring[.]io/security/cve-2026-47879

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED PRODUCTS OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment:
The vulnerability in Spring Cloud Gateway presents a significant security risk to organizations using the affected versions, particularly because successful exploitation can allow unauthorized access to native files and enable server-side request forgery. The JsonToGrpcGatewayFilterFactory, when processing proto descriptor resource locations, allows a remote privileged user to specify an arbitrary Spring Resource location. Successful exploitation could allow threat actors to access sensitive files from the underlying system, interact with unintended internal or external resources, disclose sensitive information, and potentially compromise the security of systems accessible from the affected Gateway instance. As exploitation requires privileged access, organizations should prioritize protecting administrative and configuration interfaces and limiting access to trusted users and networks. Organizations using affected versions of Spring Cloud Gateway should upgrade to the latest available security update and ensure that resource locations used for proto descriptors are restricted to trusted and permitted resource prefixes. In addition, organizations should monitor Gateway activity for anomalous resource requests, attempts to access native files, and suspicious server-side requests to unexpected destinations. Prompt remediation and continuous monitoring are recommended to reduce the risk of sensitive information disclosure and server-side request forgery resulting from exploitation of this vulnerability.

6. Latest Cyber-Attacks, Incidents, and Breaches

Settra Ransomware Attacked and Published the Data of a Real Estate Company from Japan

• Threat Actor: Settra Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Real Estate
• Target Geography: Japan
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, we observed that Settra Ransomware attacked and published the data of a Real Estate company from Japan on its dark web website. The compromised organisation is a Japanese real estate management group operating through several legal entities, including a real estate agency, a property management subsidiary, a holding division, and an investment arm. The group manages residential properties across Tokyo and Kanagawa through a network of offices, providing lease and property management services to both individual and corporate clients. The ransomware attack reportedly involved the exposure of approximately 437 GB of data, including internal corporate documents, a full VPN network diagram with public IP addresses, employee login credentials, 449 lease transaction files, background-check records, 363 active insurance policies, customer-portal credentials, banking IP-VPN configuration containing a pre-shared key, and an insurance payment database containing 833 transactions with recipient banking details. The exposed archive also reportedly includes investment-related documents concerning participation as a shareholder in a blockchain company, along with lease agreements, insurance-related records, financial documents, invoices, and other sensitive business information.

Source: Dark Web

Relevancy & Insights:

• Settra Ransomware is an emerging financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to pressure victims by encrypting systems and/or threatening to publish stolen data unless a ransom is paid. The group was first publicly observed in June 2026.
• The Settra Ransomware group demonstrates opportunistic targeting across multiple industries, with reported victims spanning Technology, Manufacturing, Professional Services, Consumer Services, Transportation & Logistics, Agriculture & Food Production, Construction, Hospitality, and Financial Services. This indicates that the group does not appear to be restricted to a single industry vertical.

ETLM Assessment:
According to CYFIRMA’s assessment, Settra represents an emerging, financially motivated ransomware and data-extortion threat that relies on data theft and public exposure to increase pressure on victims. The group maintains a leak site and has demonstrated an opportunistic targeting strategy across multiple industries and countries. Although Settra has been associated with ransomware-style encryption and double-extortion activity, its technical attribution and operational structure remain under assessment due to its recent emergence in 2026. Organizations should therefore prioritize strong identity and access controls, protection of VPN and privileged credentials, continuous network monitoring, endpoint detection, data-loss prevention, and resilient offline backups to detect and mitigate potential Settra-related intrusions.

7. Data Leaks

Thailand-Based Healthcare Technology Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Healthcare Technology / Healthcare Services
• Target Geography: Thailand
• Objective: Financial Gains
• Reported Data Volume: 24 GB
• Business Impact: Potential Data Loss, Privacy Exposure, Reputational Damage

Summary: The CYFIRMA research team identified a post observed on a dark web leak platform that claims the exposure of approximately 24 GB of database data belonging to a Thailand-based healthcare technology organization. The organization develops technology solutions for hospitals and healthcare providers, with services reportedly including custom software and hardware, Electronic Health Record (EHR) systems, telemedicine platforms, healthcare consulting, and research and development (R&D). The post identifies the database as a leaked dataset and lists a dump date of 29 August 2026.

Organization Profile
According to the information displayed in the post, the affected organization operates in the healthcare technology sector and provides technology-driven solutions intended to support hospitals and healthcare organizations.

Its reported areas of operation include:

• Custom healthcare software and hardware
• Electronic Health Record (EHR) systems
• Telemedicine platforms
• Healthcare consulting
• Research and Development (R&D)
• Technology solutions designed to improve healthcare efficiency and patient care

Leaked Data
The post claims that approximately 24 GB of database information has been leaked. However, the provided image cuts off immediately after the statement “In this leak, the database contains:” and does not display the specific categories of records contained in the database.

Therefore, the following cannot be reliably confirmed from the supplied evidence:

• Specific database tables
• Patient records
• Personally identifiable information (PII)
• Medical records
• Credentials or authentication information
• Financial information
• Employee information
• Internal documents
• Exact number of records
• Database format or file types

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

A major Vietnamese food and consumer-goods group Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Food Manufacturing / Vegetable Oil and Consumer Foods
• Target Geography: Vietnam
• Objective: Financial Gains
• Reported Data Volume: 3.5 Terabytes
• Business Impact: Potential Data Loss, Confidentiality Breach, Operational and Reputational Risks

Summary: The CYFIRMA research team identified a post on a dark web forum claiming that approximately 3.5 TB of corporate data belonging to a Vietnam-based organization has been compromised and is being offered through an exclusive bidding process. The advertised dataset reportedly consists of fully structured files, unredacted corporate documents, and raw database dumps. The post claims access to multiple repositories across the organization’s corporate network, including communication archives, SharePoint databases, central file-server repositories, and human-resources-related information.

Allegedly Exposed Data
According to the post, the compromised data reportedly includes:

Executive Communication Hub

• Full email archives
• Contact archives
• Corporate communications

SharePoint Production & Legal Databases

• Structured SQL/MDF database dumps
• Production-related information
• Legal and corporate records

Central File Server Repositories & Databases

• Corporate files and documents
• Database repositories
• Internal organizational information

Human Resources Profiles & Asset Transfer Vault

• HR-related profiles
• Employee information
• Asset-transfer records and associated documentation

Data Characteristics
The advertisement describes the dataset as containing:

• Approximately 3.5 TB of data
• Fully structured files
• Unredacted corporate documents
• Raw database dumps
• Corporate communication archives
• Internal databases and file repositories

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

Relevancy & Insights:
Financially motivated cybercriminals are continuously scouring for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to illicitly gain access and steal valuable data. Subsequently, the pilfered data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:
The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure

Recommendations: Enhance the cybersecurity posture by

• Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
• Ensure proper database configuration to mitigate the risk of database-related attacks.
• Establish robust password management policies, incorporating multi-factor authentication and role-based access, to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a post observed on a dark web forum claiming that a Qatar-based organization has been breached. The post includes a sample of allegedly compromised database records and identifies an associated IP address. The displayed sample contains database fields related to user accounts, including identifiers, names, email addresses, partner information, roles, account status, and creation and update timestamps.

Allegedly Exposed Data
The sample displayed in the post contains database fields including:

• User/account identifiers
• Names
• Email addresses
• Partner IDs
• Store IDs
• User roles
• Account status
• Account creation timestamps
• Account update timestamps
• Token-related information
• Token status and expiration details
• Version information

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground forums

STRATEGIC RECOMMENDATION

• Attack Surface Management should be adopted by organizations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, active network monitoring, through next generation security solutions and ready to go incident response plan.
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATION

• Take advantage of global Cyber Intelligence providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied and the proper implementation of security technologies, followed by corrective actions remediations, and lessons learned.
• Move beyond the traditional model of security awareness towards improved simulation and training exercises that mimic real attack scenarios, account for behaviours that lead to a compromised, and, are measured against real attacks the organization receives.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcoming of EDR and SIEM solutions.
• Detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies and continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATION

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthen defences based on tactical intelligence provided.
• Deploy detection technologies that are behavioural anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security control such as reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

Geography-Wise Graph

Industry-Wise Graph

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, technology, please access DeCYFIR.