Published On : 2026-10-16
Ransomware In Focus
CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.
Type: RansomwareTarget Technologies: Windows OSTargeted countries: Colombia, India, Thailand, France, Portugal, Italy, United States, Germany, Switzerland, Lithuania, ChileTargeted industries: Retail, E-commerce, Restaurants/Food Services, Food & Beverage, Healthcare/Diagnostics, Jewelry, Manufacturing, Construction, Biotechnology, Technology/Services, Automotive/Transportation
Introduction:
CYFIRMA Research and Advisory Team has found Majin Ransomware while monitoring various underground forums as part of our Threat Discovery Process.
Majin Ransomware
MAJIN ransomware is a malicious program designed to compromise systems, encrypt files, and exfiltrate sensitive information for financial extortion. Once executed, it encrypts files and appends the .majin extension to their filenames, rendering them inaccessible without the appropriate decryption key. Following encryption, it creates a ransom note named README.txt containing instructions for contacting the attackers. The malware employs a double-extortion strategy, combining file encryption with data theft to increase pressure on affected organizations. This approach allows the attackers to threaten the public disclosure of confidential information even if the victim restores its systems from backups. The combination of data encryption and exfiltration increases the potential impact of the attack by affecting both data availability and confidentiality.
Screenshot: File encrypted by the ransomware (Source: Surface Web)
The ransom note claims that the victim’s infrastructure has been compromised, servers have been encrypted, and sensitive data has been transferred outside the organization’s network. It imposes a seven-day deadline for initiating contact and threatens to publish the stolen information alongside the victim’s identity on a Tor-based data leak site (DLS) if negotiations are not initiated. Such sites operate through the Tor network, helping attackers conceal their server locations while publicly exposing information about targeted organizations to intensify extortion pressure. The note provides a unique victim identifier and directs the recipient to communicate through an encrypted peer-to-peer messaging protocol. It does not specify a ransom amount, instead emphasizing the consequences of data disclosure and the difficulty of recovering encrypted files. These statements reflect the attackers’ claims and threats; the actual extent of data exfiltration cannot be established from the ransom note alone.
Screenshot: The appearance of Majin’s ransom note (README.txt) (Source: Surface Web)
Screenshot: The appearance of Majin’s Tor-based DLS Site (Source: Surface Web)
The following are the TTPs based on the MITRE ATT&CK framework
Tactic
Technique ID
Technique Name
Execution
T1047
Windows Management Instrumentation
Execution
T1129
Shared Modules
Execution
T1574
Hijack Execution Flow
Persistence
T1542.003
Pre-OS Boot: Bootkit
Persistence
T1543.003
Create or Modify System Process: Windows Service
Privilege Escalation
T1543.003
Create or Modify System Process: Windows Service
Discovery
T1033
System Owner/User Discovery
Discovery
T1057
Process Discovery
Discovery
T1082
System Information Discovery
Discovery
T1083
File and Directory Discovery
Discovery
T1614.001
System Location Discovery: System Language Discovery
Command and Control
T1071
Application Layer Protocol
Command and Control
T1090
Proxy
Impact
T1486
Data Encrypted for Impact
Stealth
T1027.005
Obfuscated Files or Information: Indicator Removal from Tools
Stealth
T1036
Masquerading
Stealth
T1070.004
Indicator Removal: File Deletion
Stealth
T1542.003
Pre-OS Boot: Bootkit
Stealth
T1574
Hijack Execution Flow
Defense Impairment
T1553.002
Subvert Trust Controls: Code Signing
Relevancy and Insights:
The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition
The ransomware terminates processes such as exe Delete Shadows /all/quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.
Persistence: The ransomware exhibits continuity mechanisms to ensure its survival and ongoing vicious conditioning within the compromised terrain. This could involve creating autostart entries or modifying system settings to maintain a base and grease unborn attacks.
calls-wmi: The ransomware leverages Windows Management Instrumentation (WMI), a versatile Windows feature that enables it to discreetly collect system information, control processes, or execute commands. This technique is commonly used to avoid detection and carry out reconnaissance activities within the system.
ETLM Assessment:
MAJIN ransomware may evolve by adopting more sophisticated techniques to improve its ability to infiltrate networks, evade security controls, and disrupt organizational operations. Future variants could incorporate enhanced obfuscation, polymorphic code, and anti-analysis mechanisms to make detection and reverse engineering more difficult. The malware may also expand its use of stolen credentials, remote administration utilities, and legitimate system processes to move laterally across compromised environments and identify high-value data before encryption. In addition, its operators could refine data exfiltration methods and automate the identification of sensitive files, enabling more targeted attacks against enterprise networks. These developments are potential trends based on broader ransomware activity and should not be interpreted as confirmed capabilities of existing MAJIN variants.
The ransomware’s extortion strategy may also become more aggressive through expanded use of double or multiple extortion techniques. In future campaigns, attackers could place greater emphasis on threatening to publish confidential information through Tor-based data leak sites (DLS), using public leak announcements and reputational pressure to encourage victims to pay. They may also introduce shorter negotiation deadlines, more targeted communications, or threats involving customers, business partners, and regulatory consequences. Additionally, future versions could exploit vulnerabilities in backup infrastructure and virtualization platforms to hinder recovery and increase operational disruption. However, the actual evolution of MAJIN will depend on the activities of its operators, changes in defensive technologies, and the effectiveness of law enforcement efforts; these possibilities represent informed projections rather than verified developments.
Sigma rules:
title: Fsutil Suspicious Invocation tags:
impact
stealth
t1070
t1485 logsource:
category: process_creation product: windowsdetection: selection_img:
Image|endswith: ‘\fsutil.exe’
OriginalFileName: ‘fsutil.exe’ selection_cli:
CommandLine|contains:
‘deletejournal’ # usn deletejournal ==> generally ransomware or attacker
‘createjournal’ # usn createjournal ==> can modify config to set it to a tiny
size
‘setZeroData’ # file setZeroData ==> empties a file with zeroes
condition: all of selection_* falsepositives:
Admin activity
Scripts and administrative tools used in the monitored environment level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_fsutil_usage/info.y ml
(Source: Surface Web)
IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)
RECOMMENDATIONS
STRATEGIC RECOMMENDATIONS
Implement competent security protocols and encryption, authentication, or access credential configurations to access critical systems in your cloud and local
Ensure that backups of critical systems are maintained, which can be used to restore data in case a need arises.
MANAGEMENT RECOMMENDATIONS
A data breach prevention plan must be developed considering (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
Implement a zero-trust security model alongside multifactor authentication (MFA) to reduce the risk of credential compromise.
Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.
TACTICAL RECOMMENDATIONS
Update all applications/software regularly with the latest versions and security patches.
Add the Sigma rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.
Establish and implement protective controls by actively monitoring and blocking identified indicators of compromise (IoCs) and reinforcing defensive measures based on the provided tactical intelligence.
Active Malware of the Week
Type: Backdoor / RAT | Objectives: Remote Control, Persistence and Data Exfiltration | Target Technology: Windows | Target Geography: Global
CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.
Active Malware of the Week
This week, RuRAT Malware is in focus.
Overview of Operation RuRAT Malware
The sample analyzed, referred to here as “RuRAT”, is not a benign program. Once it gains a foothold on a machine, it begins to carry out a defined set of actions, and the way it behaves reveals a clear purpose that goes beyond anything an ordinary application would do. It is built to maintain interactive, ongoing control of the machine under the direction of a remote operator, also harvest stored credentials and other sensitive data as a payoff, and maintain a standing channel back to the infrastructure the operator controls. The result is sustained remote control rather than a one-off theft, with the machine kept quietly available to whoever placed the implant.
Observed activity supports the capacity to carry out further actions under a remote operator’s direction, an eye for usable credentials, so access can be turned into data too, and a standing channel back to the operator that keeps control current. For a manager, the key point is that this is not a one-off data grab; it is a remote-control tool whose real value is continued access, with the collection of sensitive information sitting alongside, instead of that ability to act on the machine.
To ensure persistence, the sample arranges to start again on a routine or scheduled basis, making use of scheduled tasks that set it to run again on a fixed timetable, letting the operating system start it automatically at every log-on and registers as a service that the operating system treats as a normal background program, while it also goes to some lengths to avoid being noticed, including efforts to hide what its deeper routines are doing. The value of these measures is that the compromise endures quietly, so the operator keeps a usable foothold without repeated effort.
Looking at the wider picture, this sample is not built for one isolated action alone: it keeps in contact with outside infrastructure the operator controls, which gives whoever placed it a channel back to the machine and to whatever it collects. From a business perspective, this means its presence should be treated as a genuine security concern, since it reveals an actor with a clear interest in the affected systems and the information they hold.
Attack Method
When executed on a Windows host, the sample first registers the mutex madExceptSettingsMtx$133c and _MSIExecute to guarantee only one instance runs at a time, dropping out of any attempt to start a second copy. Only basic environment details are gathered at this stage, enough for the component to orient itself but not enough to betray a heavy information-gathering routine of its own. These structures (reflective, memory-based execution) degrade static inspection and push defenders toward live behavioral observation. Memory- and thread-level manipulation consistent with code injection is also present, letting the implant run inside the context of a trusted process and slide past application-whitelisting controls. Taken together, this opening phase secures a working run on the machine, confirms the environment is suitable, and sets up the persistence and data-handling routines that follow.
A core functional objective is to survive reboots and log-ons. The implant achieves this through three main mechanisms: scheduled-task creation to re-launch the payload at defined intervals or system start-up, autostart persistence via a Windows registry to ensure execution at user log-on; and registration of a Windows service (notably Agent and RManService) for system-level/restart survival. To keep that hold, it conceals payload structures (reflective, memory-based execution), letting the sample continue while remaining difficult for the user and signature controls to notice.
A defining functional characteristic of this sample is remote control rather than one-way theft: it reads stored credential material for later use, and it can run further commands or code on request. This is not a one-shot stealer: whatever it gathers is a by-product of the access it keeps, not the objective. Over this same channel, the operator reaches back in to drive the host, and the external endpoint maintains contact and carries both instructions and any data routed out.
The following are the TTPs based on the MITRE ATT&CK Framework for Enterprise
INSIGHTS
In practical terms, RuRAT is defined by its purpose: the sample grants an unseen operator a standing seat at the table. Rather than a one-off theft, it permits repeated quiet interaction with the machine, turning a single infection into an ongoing window into the That objective colors every other behavior the sample displays, giving the whole component a coherent focus that is easy to lose when it is examined piece by piece.
This is not a crude or experimental piece of The sequence of actions it takes once running, how carefully it hides and how it sustains itself, all suggest a builder who thought deliberately about how the sample should operate inside a network. That self-discipline is evident across several behaviors: its use of more than one way of keeping itself resident reflects a concern for survival that only mature operators exhibit, and its readiness to lean on more than one communication channel suggests an operation that is actively maintained rather than abandoned. Overall, the components work in harmony in a way that speaks to a threat sharpened by repeated real-world use rather than assembled carelessly.
Behind the technical mechanics, the sample’s interaction with its victim reveals a clear strategy: the emphasis on credential material indicates the operator values accounts over specific files, which points toward theft that can be resold or reused later. Taken together, this points to an operation that rewards not just access but the right access, with the sample shaped to serve that preference.
ETLM ASSESSMENT
Looking ahead under the ETLM lens, the kind of activity RuRAT demonstrates sits squarely in a trend toward more automated and more persistent intrusions, and its future impact on organizations and employees should not be underestimated: interactive remote access is trending toward a standing foothold that operators will hold for extended periods, so future incidents are likely to unfold lazily across weeks, with access quietly maintained long after the initial infection moment is forgotten. As these tools and their successors evolve, the incidents organizations face will push further into everyday operations, and employees will remain the main point of human exposure, their routine actions quietly sustaining the economy these implanted programs feed. The cumulative consequence may therefore be felt most in how organizations absorb exposure over time: as intrusions of this class become more common, the overall effect could reach well beyond any single machine into broader operational disruption that is difficult to isolate and even harder to unwind.
IOCs:
Kindly refer to the IOCs below to exercise controls on your security systems. (Source: Open Surface)
YARA Rules
rule RuRAT_Malware
{
meta:
description = “Detection rule for the analyzed malware sample” author = “Threat Research”
strings:
$hash1 = “becef815900330a003675673d1b0bdc907d8c2ab3d6779079a3ad246ad6125c2”
$hash2 = “ff49a673aac7c53a31e5aec7c6ea3f6aac010b05”
$hash3 = “d1ae811c82f2ecc7d3ca7cb7fbbcd13b”
$s1 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\common\\srvinst.exe\” uninstall”
$s2 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\common\\srvinst.exe uninstall”
$s3 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\x64\\setupdrv.exe\” uninstall”
$s4 = “C:\\Program Files (x86)\\Remote Utilities – Host\\Printer\\x64\\setupdrv.exe uninstall”
$s5 = “C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding”
$s6 = “C:\\Windows\\system32\\msiexec.exe /V”
$s7 = “C:\\Windows\\System32\\svchost.exe -k netsvcs -p”
$s8 = “C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\” /svc”
$s9 = “C:\\Windows\\System32\\svchost.exe -k NetworkService -p”
$s10 = “C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup”
$s11 = “C:\\Windows\\system32\\sppsvc.exe”
$s12 = “C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc”
$s13 = “C:\\Windows\\system32\\lsass.exe”
$s14 = “C:\\Windows\\system32\\svchost.exe -k LocalService -s W32Time”
$s15 = “C:\\Windows\\syswow64\\MsiExec.exe -Embedding
07A0B8A102D781B0459FF77892C69F91”
$s16 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rfusclient.exe\” -msi_copy
\”C:\\Users\\\\Desktop\\database.msi”
$s17 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rutserv.exe\” /silentinstall”
$s18 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rutserv.exe\” -firewall”
$s19 = “C:\\Program Files (x86)\\Remote Utilities – Host\\rutserv.exe\” /printerinstall”
$s20 = “madExceptSettingsMtx$133c”
$s21 = “_MSIExecute”
$s22 = “madExceptSettingsMtx$534”
$s23 = “madExceptSettingsMtx$a20”
$s24 = “RuRAT”
condition:
any of ($hash*) or 2 of ($s*)
}
Recommendations
Strategic Recommendations
Establish an organization-wide endpoint security strategy covering malware prevention, detection, and response.
Prioritize protection of sensitive credentials and business information stored or accessed from employee endpoints.
Adopt layered security controls so that a single compromised endpoint does not provide prolonged access to organizational resources.
Conduct periodic threat assessments to identify exposure to multi-purpose malware and similar information-stealing threats.
Management Recommendations
Direct affected users to rotate passwords and confirm multi-factor enrolment as part of the response checklist.
Ensure endpoint protection and security monitoring capabilities are consistently deployed across employee systems.
Establish clear incident-response procedures for suspected malware infections, including isolation, investigation, and recovery.
Provide regular security-awareness training focused on suspicious files, links, downloads, and unexpected system activity.
Maintain appropriate controls over access to sensitive corporate information and user accounts.
Tactical Recommendations
Hunt endpoints for unauthorized scheduled-task creations and alert on schtasks /create activity.
Audit Run/RunOnce registry values and Startup-folder entries for unfamiliar items and remove anything created by this threat.
Review newly registered Windows services and disable any pointing to unsigned binaries in user-writable paths.
Force password resets and revoke active sessions for users on affected systems and verify MFA coverage to blunt harvested-credential replay.
Monitor endpoints for unusual PowerShell activity, unexpected process trees, and unauthorized changes to security settings.
Block and monitor the infrastructure listed in the IOC section at DNS, proxy, and perimeter controls.
Isolate confirmed cases promptly, then reset credentials and review autostart locations before restoration.
CYFIRMA’s Weekly Insights
1. Weekly Attack Types and Trends
Key Intelligence Signals:
Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data
Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains,
Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
Ransomware – Qilin Ransomware, The Gentlemen Ransomware| Malware – RuRAT
Qilin Ransomware– One of the ransomware
The Gentlemen Ransomware – One of the ransomware.Please refer to the trending malware advisory for details on the following:
Malware – RuRAT
Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.
2. Threat Actor in Focus
ShinyHunters: Evolving Tactics for Enterprise Data Theft and Extortion
Threat Actor: ShinyHunters aka UNC6240
Attack Type: Abuse of legitimate access privileges, Compromised OAuth Tokens, Connection Proxy, Credential Dumping, Living-off-the-land, Ransomware Attacks, Social Engineering, Stolen Credentials, Vishing, Vulnerabilities and Exploits
Objective: Information theft, Financial Gains
Suspected Target Technology: SAP, Office Suites Software, Operating Systems, Web Applications
Suspected Target Geography: US, Australia, Germany, India, Japan, UK
Suspected Target Industries: Hotels, Restaurants & Leisure, Airlines, Automobiles, Banks, Education Services, IT Services, Construction & Engineering, Diversified Financial Services, Internet & Direct Marketing Retail, Professional Services, Financials, Health Care, Hospitals, Information Technology, Insurance, Media, Retail, Legal Services, Other Personal Services, Entertainment, Public Administration, Road & Rail, Software, Telecommunications
Business Impact: Financial Loss, Data Theft, Operational Disruption, Reputational Damage
About the Threat Actor
ShinyHunters is a financially motivated cybercriminal group linked to multiple high-profile data breaches involving the theft and unauthorized exposure of sensitive information. The group is known for monetizing stolen data through underground cybercriminal marketplaces and dark web forums.
ShinyHunters members have operated jointly with Scattered Spider and LAPSUS$ members under the “Scattered LAPSUS$ Hunters” persona since August 2025, and all three are associated with the cybercriminal network known as The Com (high confidence). The degree of coordination between individual intrusion clusters using the brand is unclear; Mandiant tracks them separately.
Details on Exploited Vulnerabilities
CVE ID
Affected Products
CVSS Score
Exploit Links
CVE-2025-10725
Red Hat OpenShift AI
9.9
–
CVE-2025-23297
NVIDIA Installer for NvAPP for Windows
7.8
–
CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM)
9.8
–
CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM)
9.8
–
TTPs based on the MITRE ATT&CK Framework
Tactic
ID
Technique
Reconnaissance
T1595.002
Active Scanning: Vulnerability Scanning
Reconnaissance
T1589.001
Gather Victim Identity Information: Credentials
Reconnaissance
T1598
Phishing for Information
Reconnaissance
T1598.003
Phishing for Information: Spear phishing Link
Reconnaissance
T1593.003
Search Open Websites/Domains: Code Repositories
Resource Development
T1583.001
Acquire Infrastructure: Domains
Resource Development
T1583.004
Acquire Infrastructure: Server
Resource Development
T1587.004
Develop Capabilities: Exploits
Resource Development
T1585.002
Establish Accounts: Email Accounts
Resource Development
T1588.007
Obtain Capabilities: Artificial Intelligence
Resource Development
T1588.002
Obtain Capabilities: Tool
Initial Access
T1190
Exploit Public-Facing Application
Initial Access
T1195.001
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Initial Access
T1078
Valid Accounts
Initial Access
T1078.004
Valid Accounts: Cloud Accounts
Initial Access
T1078.002
Valid Accounts: Domain Accounts
Execution
T1059.009
Command and Scripting Interpreter: Cloud API
Execution
T1059.007
Command and Scripting Interpreter: JavaScript
Execution
T1203
Exploitation for Client Execution
Execution
T1072
Software Deployment Tools
Persistence
T1098.001
Account Manipulation: Additional Cloud Credentials
Persistence
T1078
Valid Accounts
Persistence
T1078.004
Valid Accounts: Cloud Accounts
Persistence
T1078.002
Valid Accounts: Domain Accounts
Privilege Escalation
T1078
Valid Accounts
Privilege Escalation
T1078.004
Valid Accounts: Cloud Accounts
Privilege Escalation
T1078.002
Valid Accounts: Domain Accounts
Stealth
T1078
Valid Accounts
Stealth
T1078.004
Valid Accounts: Cloud Accounts
Stealth
T1078.002
Valid Accounts: Domain Accounts
Stealth
T1036.005
Masquerading: Match Legitimate Resource Name or Location
Stealth
T1684
Social Engineering
Credential Access
T1528
Steal Application Access Token
Credential Access
T1552.001
Unsecured Credentials: Credentials In Files
Credential Access
T1110
Brute Force
Discovery
T1580
Cloud Infrastructure Discovery
Discovery
T1619
Cloud Storage Object Discovery
Discovery
T1083
File and Directory Discovery
Discovery
T1069.003
Permission Groups Discovery: Cloud Groups
Discovery
T1018
Remote System Discovery
Discovery
T1082
System Information Discovery
Discovery
T1016
System Network Configuration Discovery
Lateral Movement
T1550.001
Use Alternate Authentication Material: Application Access Token
Lateral Movement
T1210
Exploitation of Remote Services
Lateral Movement
T1072
Software Deployment Tools
Collection
T1213.003
Data from Information Repositories: Code Repositories
Collection
T1530
Data from Cloud Storage
Collection
T1560.002
Archive Collected Data: Archive via Library
Collection
T1213.006
Data from Information Repositories: Databases
Command and Control
T1573.002
Encrypted Channel: Asymmetric Cryptography
Command and Control
T1105
Ingress Tool Transfer
Command and Control
T1090.003
Proxy: Multi-hop Proxy
Command and Control
T1219
Remote Access Tools
Exfiltration
T1567
Exfiltration Over Web Service
Impact
T1485
Data Destruction
Impact
T1491.001
Defacement: Internal Defacement
Impact
T1657
Financial Theft
Latest Developments Observed
ShinyHunters, a financially motivated data theft and extortion group, continued its operations despite recent arrests, with its leak site reportedly listing new claimed victims on October 1, 2026. Dutch police arrested a 24-year-old Amsterdam man on September
15 on suspicion of involvement in the group, while a second suspect was reportedly detained in Jordan on September 29. The FBI announced a further arrest of a suspected co-conspirator on October 9 and alleged that the group and its co-conspirators had breached more than 140 organizations and obtained at least $70 million in extortion payments. The group’s recent operations have involved help desk voice phishing, credential theft, unauthorized MFA registration, SaaS data exfiltration, and exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273. However, no public charges had been announced for the 2026 arrests, and the FBI had not publicly tied any arrest to the group’s claimed FBI breach, although the New York Times reported that the October 9 arrest was of a suspected co-conspirator in that intrusion.
ETLM Insights
ShinyHunters continues to demonstrate an adaptive, financially motivated operational model centered on identity compromise, large-scale data theft, and extortion. Its recent activity highlights a strong reliance on help desk impersonation, voice phishing, and abuse of SSO and SaaS authentication workflows, alongside the exploitation of vulnerable internet-facing systems. The continued use of the ShinyHunters brand despite arrests indicates the potential for its operations to persist beyond individual disruptions.
The threat actor’s activities demonstrate:
Identity-based initial access through help desk impersonation, voice phishing, and manipulation of authentication workflows.
Large-scale data theft through unauthorized access to enterprise SaaS platforms and cloud environments.
Exploit-driven access demonstrated by the exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273.
Extortion-focused monetization through threats to publish stolen data and pressure victims into payment.
Looking ahead, ShinyHunters is likely to further refine social engineering and identity-based intrusion techniques while continuing to target enterprise authentication workflows and SaaS environments. The combination of data theft, extortion, and a persistent group brand may enable ShinyHunters-associated operations to continue despite disruptions to individual members.
YARA Rules
import “hash”
rule WEBSHELL_JSP_UNC6240_PeopleSoft_UJSP_Stager
{
meta:
description = “Detects the u.jsp chunked upload and execution stager used to build Ple64.exe after CVE-2026-35273 exploitation (UNC6240 / ShinyHunters)”
note = “May also match the u2.jsp offset-based variant; its code was not published, so this is untested”
author = “CYFIRMA” date = “2026-10-13”
reference = “https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft”
hash =
“2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7”strings:
$jsp = “<%@ page import=” ascii
$w = “out.print(\”W:\” + b.length)” ascii
$s1 = “out.print(\”X:\” + e)” ascii
$s2 = “out.print(\”E:\” + e)” ascii
$s3 = “java.util.Base64.getDecoder().decode(a)” ascii
$s4 = “new java.io.FileOutputStream(n, true)” ascii
$s5 = “request.getParameter(\”x\”)” asciicondition:
filesize < 20KB and $jsp and $w and 2 of ($s*)
}rule WEBSHELL_JSP_UNC6240_PeopleSoft_XJSP
{
meta:
description = “Detects the x.jsp command web shell dropped under PSEMHUB.war after exploitation of Oracle PeopleSoft CVE-2026-35273 (UNC6240 / ShinyHunters)”
author = “CYFIRMA” date = “2026-10-13”
reference = “https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft”
hash =
“48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494” note = “Published hash varies with line endings; strings below survive that”
scan_path =
“/webserv//applications/peoplesoft/PSEMHUB.war/ and PORTAL.war/”
strings:
$jsp = “<%@ page import=” ascii
$s1 = “new char[]{47,98,105,110,47,115,104}” ascii // “/bin/sh” built from char codes
$s2 = /Integer\.parseInt\(h\.substring\(i,\s*i\s*\+\s*2\),\s*16\)/ // hex-decodes the command in parameter c
$s3 = “out.print(\”R:\” + sb.toString())” ascii
$s4 = “request.getParameter(\”c\”)” ascii
condition:
filesize < 20KB and $jsp and $s1 and 2 of ($s2, $s3, $s4)
}
Recommendations
Strategic Recommendations
Treat the help desk and identity provider as primary attack surface. Require verified identity (for example, a video call with ID, or a callback to a number already on file) before any password reset or MFA re-enrollment.
Deploy a Zero Trust Policy that leverages tools like security information management, advanced security analytics platforms, security user behaviour analytics, and other analytics systems to help the organization’s security personnel observe in real time what is happening within their networks so they can orient defences more intelligently.
Block exploit-like behaviour. Monitor endpoint memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more by identifying such patterns.
Management Recommendations
Look for email security solutions that use ML- and AI-based anti-phishing technology for BEC protection to analyze conversation history to detect anomalies, as well as computer vision to analyze suspect links within emails.
Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation Reinforce this training with context-aware banners and in-line prompts to help educate users.
Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.
Tactical Recommendations
For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat
Protect accounts with multi-factor Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
Apply security measures to detect unauthorized activities, protect sensitive production, and process control systems from cyberattacks.
Add the YARA rules for threat detection and monitoring, which will help detect anomalies in log events and identify and monitor suspicious
Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.
3. Major Geopolitical Developments in Cybersecurity
US Disrupts China-linked Hacking Tools
The U.S. Department of Justice and the FBI announced the seizure of domains operated by China-aligned threat group Flax Typhoon to run two malicious hacking tools, “Microscan” and “FishHub.” Authorities linked the state-sponsored actor to Beijing-based cybersecurity firm Integrity Technology Group, a known contractor for the Chinese government.
Microscan, a vulnerability scanner distributed through a Mirai botnet variant, targeted critical infrastructure and organizations globally, including a U.S. power company, a multinational NGO, airports in Japan and Poland, and energy entities in Taiwan. Meanwhile, the FishHub spear-phishing platform facilitated network breaches across roughly 20 Taiwanese universities.
ETLM Assessment:
Flax Typhoon (also tracked as Ethereal Panda or Storm-0919) is a state-sponsored Chinese cyber espionage cluster active since at least 2021, primarily focused on establishing long-term, covert persistence within critical infrastructure, government agencies, and education sectors across Taiwan and allied nations. Unlike threat actors that deploy noisy custom malware, Flax Typhoon relies heavily on “living-off-the-land” (LotL) techniques – exploiting known vulnerabilities in public-facing servers to deploy web shells, leveraging built-in Windows administration tools, and installing legitimate VPN software to maintain stealthy remote access. Tied directly to Beijing-based contractor Integrity Technology Group, the group’s infrastructure has been the target of major U.S. law enforcement takedowns, including a September 2024 operation that dismantled its 250,000-device Mirai-based botnet. The recent domain seizures of its “Microscan” vulnerability scanner and “FishHub” spear-phishing platforms sever critical command-and-control capabilities for a group whose primary mission remains pre-positioning and intelligence gathering against Western and Taiwanese targets.
Wave of Cyberattacks Targeting Japan
A recent wave of cyberattacks has struck Japanese organizations, prompting the government to urge widespread security reviews as artificial intelligence lowers the threshold for sophisticated hacking. Researchers’ data revealed a sharp spike in breaches through September – including a single-day peak of 13 incidents – hitting prominent entities such as SoftBank unit IDC Frontier, Daiwa Securities, and the Japan Atomic Energy Agency. The fallout has been substantial, with car-rental operator Times exposing 6.6 million member records and cloud provider Rakuten Drive suffering unauthorized access to 15,000 accounts. In response, the Finance Ministry and the Financial Services Agency directed financial institutions to audit third-party risks and bolster identity verification protocols.
ETLM Assessment:
The escalating threats coincide with the rapid proliferation and commodification of AI-driven cybercrime tools. Security experts highlight that accessible open-weight models and low-cost tools enable even inexperienced actors to execute complex operations, using automated AI agents to handle tedious tasks like managing attack tools and probing for system vulnerabilities. Analysts warning of future trajectory note that while recent intrusions primarily focused on data theft, ransomware, and supply-chain disruption, foreign threat actors may be actively probing the boundaries of Japan’s active cyber defense capabilities – laying the groundwork for far more destructive future campaigns.
4. Rise in Malware/Ransomware and Phishing
Qilin Ransomware Impacts a Construction Company from Japan
Attack Type: Ransomware
Target Industry: Construction
Target Geography: Japan
Ransomware: Qilin Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by Qilin Ransomware. The compromised company is a Japanese construction-materials and logistics group based in Saitama, Japan. The ransomware attack has resulted in the exposure or compromise of sensitive corporate information, including internal business documents, operational records, financial data, employee information, customer and supplier details, and confidential project-related files.
Source: Dark Web
Relevancy & Insights:
The Qilin Ransomware group operates a Ransomware-as-a-Service (RaaS) model, allowing affiliates to carry out attacks while Qilin provides infrastructure and malware
The Qilin Ransomware group primarily targets countries such as the United States of America, Canada, Germany, the United Kingdom, and France.
The Qilin Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Real Estate & Construction, Consumer Goods & Services, and Healthcare.
Based on the Qilin Ransomware victims list from 1st Jan 2026 to 13th October 2026, the top 5 Target Countries are as follows:
The Top 10 Industries most affected by the Qilin Ransomware group victims list from 1st Jan 2026 to 13th October 2026 are as follows:
ETLM Assessment:
According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and a focus on speed and evasion, make it a particularly dangerous actor.
The Gentlemen Ransomware Impacts a Manufacturing Company from Taiwan
Attack Type: Ransomware
Target Industry: Manufacturing
Target Geography: Taiwan
Ransomware: The Gentlemen Ransomware
Objective: Data Theft, Data Encryption, Financial Gains
Business Impact: Financial Loss, Data Loss, Reputational Damage
Summary:
CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Taiwan was compromised by The Gentlemen Ransomware. The compromised company is a Taiwan-based ODM/OEM manufacturer founded in 1965, headquartered in New Taipei City, and one of the world’s leading producers of digital imaging and optical camera products. The company designs and manufactures camera modules, action cameras, Edge AI webcams, automotive cameras, and security/surveillance systems for global brands, with factories in Taiwan, China (Dongguan), and Vietnam. Roughly half of its workforce is in R&D, and the company holds 42 patents from the last three years, focusing on AI vision, 3D ToF, and robotics. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.
Source: Dark Web
Relevancy & Insights:
The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Italy.
The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Real Estate & Construction.
Based on the Gentlemen Ransomware victims list from 1st Jan 2026 to 13th October 2026, the top 5 Target Countries are as follows:
The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2026 to 13th October 2026 are as follows:
ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.
5. Vulnerabilities and Exploits
Vulnerability in Openfind SecuShare Pro
Attack Type: Vulnerabilities & Exploits
Target Technology: Enterprise File Sharing Platform
Vulnerability: CVE-2026-107459
CVSS Base Score: 8 Source
Vulnerability Type: OS Command Injection (CWE-78)
Summary: A critical vulnerability in Openfind SecuShare Pro v4 allows an unauthenticated remote attacker to inject and execute arbitrary operating system commands on the affected server.
Relevancy & Insights:
The flaw affects the SecuShare Pro server, where an unauthenticated attacker may execute operating system commands remotely. Internet-accessible deployments could face elevated exposure.
Impact:
Successful exploitation could allow an unauthenticated attacker to execute commands on the server, potentially resulting in data exposure, unauthorized system changes, or disruption of file-sharing services.
Affected Products:
https[:]//www[.]twcert[.]org[.]tw/en/cp-139-11255-bce41-html
Recommendations:
Monitoring and Detection: Monitor application and operating system logs for suspicious commands. Cloud editions have been updated; Standard and Customized edition customers should contact Openfind for the applicable security update or version-specific patch.
TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.
ETLM Assessment:
The vulnerability in Openfind SecuShare Pro v4 presents a critical security risk to organizations using the affected enterprise file-sharing platform. The OS command injection flaw allows a network-reachable unauthenticated attacker to execute arbitrary commands on the server, potentially compromising sensitive information, altering system configuration, or disrupting services. Although the reviewed advisory does not confirm active exploitation, the lack of authentication requirements increases the risk to exposed deployments. Organizations using affected versions should prioritize applying the appropriate vendor-provided security updates, restrict unnecessary external access to vulnerable services, and monitor server and application logs for suspicious activity. Prompt remediation and continuous monitoring are recommended to reduce the risk of unauthorized command execution, data compromise, and disruption of business operations.
6. Latest Cyber-Attacks, Incidents, and Breaches
Krybit Ransomware attacked and published the data of a Manufacturing company from India
Threat Actor: Krybit Ransomware
Attack Type: Ransomware
Objective: Data Leak, Financial Gains
Target Technology: Web Applications
Target Industry: Manufacturing
Target Geography: India
Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage
Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a Manufacturing company from India on its dark web website. The compromised company is a leading Indian public limited company incorporated on May 9, 1988, headquartered in Ahmedabad, Gujarat, India, specializing in the manufacturing and export of high-quality stainless steel and nickel alloy wires, bright bars, TIG/MIG welding wires, reinforcement bars, and profiles. With over 30 years of experience and an annual production capacity exceeding 42,000 tonnes, it exports 75% of its production to more than 60 countries worldwide, with a global presence across the USA, Canada, Italy, Germany, the UK, Indonesia, South Korea, and China. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of the compromised data is approximately 203.54 GB.
Source: Dark Web
Relevancy & Insights:
Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is paid.
The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Government & Civic, Consumer Goods & Services, and Information Technology.
ETLM Assessment:
According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.
7. Data Leaks
Alleged Corporate Data Advertised on a Leak Site
Attack Type: Data Leak
Target Industry: Diversified Business Services
Target Geography: Saudi Arabia
Objective: Financial Gains
Business Impact: Exposure of Personally Identifiable Information (PII), Identity Theft Risks, Credential Compromise, Financial Fraud, Regulatory Compliance Concerns, Financial Loss, and Reputational Damage.
Summary
The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of a large volume of data allegedly associated with a major corporate group based in Saudi Arabia. According to the forum advertisement, the seller claims to possess approximately 310 GB of data comprising more than 320,000 files, reportedly covering multiple business activities and internal organizational records.
Based on the information presented in the advertisement, the allegedly exposed dataset may contain the following information:
Identity Documents: Approximately 522,662 passport, residence permit, and national identity-related context patterns.
Contact Information: Approximately 78,365 phone number-related context patterns and 47,248 email address patterns.
Financial Information: 188 IBAN-format values reportedly passing checksum Validation.
Credential-Related Data: Approximately 22,763 credential-like assignments, potentially indicating exposed authentication-related information.
The claims regarding the dataset size, contents, and availability are based on the information presented in the cybercrime forum advertisement. The authenticity of the data, the validity of the reported records, and the extent of any compromise have not been independently verified.
Source: Underground Forums
Alleged 75 GB Corporate Data Advertised on a Leak Site
Attack Type: Data Leak
Target Industry: Automotive Manufacturing and Automotive Components
Target Geography: India
Objective: Financial Gains
Business Impact: Potential Exposure of Sensitive Corporate Information, Intellectual Property Risks, Operational Disruption, Supply Chain Security Risks, Financial Loss, and Reputational Damage.
Summary:
The CYFIRMA research team identified a post on a cybercrime forum advertising an alleged data leak involving an Indian automotive manufacturing organization. According to the forum post, approximately 75 GB of data has reportedly been leaked. The advertisement includes a reference to the automotive manufacturing sector and claims an association with the organization’s corporate domain. However, the post does not disclose the specific categories of compromised data, the number of affected records, or the method through which the data was allegedly obtained.
Based on the available information, the following observations can be made:
Alleged Data Exposure: Approximately 75 GB of data is claimed to have been leaked.
Potential Data Categories: The advertisement does not specify whether the dataset contains customer records, employee information, financial documents, intellectual property, internal communications, or operational records.
Evidence of Compromise: The visible forum post does not provide sufficient details to independently establish the contents or authenticity of the alleged dataset.
Potential Business Relevance: Given the automotive manufacturing context, a confirmed compromise could affect corporate information, manufacturing operations, business partners, or supply chain-related information, depending on the actual data exposed.
The reported 75 GB data leak is based on the visible cybercrime forum advertisement. The authenticity of the dataset, the nature of the allegedly compromised information, and the extent of any security incident have not been independently verified. The specific data categories and attack methods remain undetermined based on the available evidence.
Source: Underground Forums
Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.
ETLM Assessment:
The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure.
Recommendations:
Enhance the cybersecurity posture by:
Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
Ensure proper database configuration to mitigate the risk of database-related attacks.
Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.
8. Other Observations
The CYFIRMA research team identified a post on a cybercrime forum advertising a large dataset allegedly containing sensitive financial, personal, and corporate information associated with organizations and individuals in the United Arab Emirates (UAE). The seller claims to possess approximately 65 GB of data, while the post title references 64 GB. According to the advertisement, the dataset reportedly includes banking credentials, government portal accounts, identity documents, employee information, financial records, and corporate administrative documents.
Based on the information presented in the forum post, the allegedly exposed data may include:
Government Portal Credentials: UAE Federal Tax Authority (FTA) portal accounts and Dubai Municipality (DMCC, as stated in the post) portal credentials, reportedly including usernames and passwords in plaintext.
Banking Information: Credentials associated with Emirates Islamic, ADBC, and Mashreq, along with other alleged system credentials and bank statements from multiple UAE banks.
Personal Identification Data: Passport details, Emirates ID information, and visa records belonging to multiple individuals.
Contact Information: Mobile phone numbers belonging to current and former staff members.
Corporate Financial Records: Full Tally accounting databases, payroll information, end-of-service benefits, and financial documentation.
Tax and Regulatory Documents: VAT returns, AFS/FS records, and other alleged tax-related information.
Corporate and Legal Documents: Trade licences, tenancy contracts, board resolutions, and other administrative records.
Customer and Ownership Information: Know Your Customer (KYC) and Anti-Money Laundering (AML) records, beneficial ownership information, and associated mobile numbers.
Email Data: Full .msg email
Business Directory Information: A client list reportedly covering UAE free zones.
Educational Records: Documents allegedly relating to children from a school in Manthena.
The forum post claims possession of the data and references sample material as evidence. However, the available screenshot does not independently establish the authenticity, completeness, or precise origin of the advertised dataset.
Potential Business Impact
Financial Fraud: Allegedly exposed banking credentials and financial statements could support fraudulent transactions or targeted financial scams.
Government Account Compromise: Valid government portal credentials could enable unauthorized access to tax or administrative services.
Identity Theft: Passport, Emirates ID, visa, and mobile number information could be used for impersonation and identity-based fraud.
Corporate Espionage: Accounting databases, customer lists, and internal email records could expose confidential business operations and financial activities.
Payroll and Employee Privacy Risks: Staff records, payroll data, and end-of-service benefit information could expose sensitive employee information.
Regulatory and Compliance Risks: A confirmed exposure involving financial, tax, or KYC/AML records could trigger investigation and applicable notification obligations.
Reputational Damage: Confirmed misuse of sensitive customer, employee, or corporate data could undermine trust in affected organizations.
This assessment is based on the information visible in the cybercrime forum advertisement. The reported dataset size, listed information categories, and claims of exposed credentials have not been independently verified. The actual number of affected individuals and organizations, the validity of the credentials, and the extent of any compromise remain undetermined.
Source: Underground Forums
RECOMMENDATIONS
STRATEGIC RECOMMENDATIONS
Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response plan.
Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.
MANAGEMENT RECOMMENDATIONS
Take advantage of global Cyber Intelligence, providing valuable insights on threat actor activity, detection, and mitigation techniques.
Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions, remediations, and lessons learned.
Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM solutions.
Ensure that detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies should be continuously evolved to keep up with refined ransomware threats.
TACTICAL RECOMMENDATIONS
Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
Consider using security automation to speed up threat detection, improved incident response, increased the visibility of security metrics, and rapid execution of security checklists.
Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence provided.
Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
Implement a combination of security controls, such as reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.
Situational Awareness – Cyber News
Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.
For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.
Click Here For The Original Source.
——————————————————–
