Weekly Intelligence Report – 7 Aug 2026 | #ransomware | #cybercrime

Ransomware In Focus

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows OS

Introduction:
CYFIRMA Research and Advisory Team has found KansasGroup Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

KansasGroup Ransomware
KansasGroup is a ransomware variant that encrypts files and appends the .kansas4life extension to the affected filenames once executed on a compromised system. For example, a file such as report.docx may be renamed to report.docx.kansas4life following encryption. The malware targets various types of data, including documents, images, videos, and databases, making the affected files inaccessible to the victim. After completing the encryption process, it creates a ransom note named KANSASGROUP.txt to provide instructions to the victim.

Screenshot: File encrypted by the ransomware (Source: Surface Web)

The ransom note informs victims that their data has been encrypted and claims that recovery requires a private decryption key and corresponding software controlled by the attackers. It also warns against attempting manual recovery methods, stating that such actions could result in additional damage to the encrypted data. The note provides instructions for contacting the ransomware operators through a peer-to-peer communication platform and asks the victim to provide information about the affected organization. A unique recovery identifier is also assigned to the victim and is required during communication with the attackers. The analyzed note does not specify a fixed ransom demand or payment deadline.

Screenshot: The appearance of GINES’s Ransom Note (Source: Surface Web)

Based on the observed behavior, files encrypted by this ransomware cannot be reliably recovered through standard file restoration methods unless a compatible decryption solution becomes available. Removing the malicious software may prevent additional encryption but will not restore files that have already been affected. The most practical recovery option is to restore the original data from clean, unaffected backups. Maintaining backups separately from production systems, particularly on offline or isolated storage, can help reduce the risk of backup data being encrypted during a ransomware incident.

The following are the TTPs based on the MITRE Attack Framework

Relevancy and Insights:

• The ransomware primarily targets the Windows operating system, leveraging native Windows utilities, services, registry settings, and filesystem APIs to execute its malicious activities. Its behavior indicates compatibility with enterprise and personal Windows environments.
• Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user When such conditions are identified, the malicious program can modify its behavior, such as pausing execution, shutting down, or withholding key payload actions to avoid detection and make detailed analysis more difficult.
• The ransomware terminates processes such as exe Delete Shadows /all/ quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.
• Long Sleep: The ransomware uses a deliberate execution delay by invoking Start-Sleep -Seconds 2 before carrying out recovery-inhibition commands. This introduces a pause in execution and may help alter the malware’s runtime behavior or evade automated analysis that relies on short observation windows.

ETLM Assessment:

KansasGroup may evolve toward more sophisticated ransomware capabilities as its development progresses. Future variants could strengthen defense-evasion mechanisms by improving detection of sandboxes, virtualized environments, and debugging tools, allowing the malware to remain inactive or alter its execution when analysis conditions are detected. The existing use of execution delays and hidden PowerShell activity suggests that future versions may further refine techniques designed to reduce visibility and complicate automated behavioral analysis.

The ransomware may also expand its impact on recovery mechanisms by targeting additional backup solutions, recovery configurations, and security-related services. Beyond deleting shadow copies and disabling recovery features, future versions could potentially attempt to interfere with backup infrastructure, terminate security software, or disable monitoring services before initiating encryption. Such developments would increase the likelihood of successful encryption and make recovery more difficult for affected organizations.

Future iterations could also introduce stronger persistence and lateral-movement capabilities, enabling the ransomware to maintain access to compromised systems and potentially spread across connected environments. The observed use of native Windows utilities and system management components could provide a foundation for broader abuse of legitimate operating-system functionality. However, these developments are speculative and are not confirmed by the current sample. The most likely evolution is continued refinement of existing capabilities, particularly defense evasion, recovery inhibition, execution concealment, and broader disruption of enterprise environments.

Sigma rules:

title: Uncommon Svchost Command Line Parameter tags:
– attack.privilege-escalation
-attack.stealth
-attack.t1055

logsource:
category: process_creation product: windows
detection: selection:
# Example of command to simulate: “C:\Windows\System32\svchost.exe” calc.exe

Image|endswith: ‘\svchost.exe’
filter_main_flags:
CommandLine|re: ‘-k\s\w{1,64}(?:\s?(?:-p|-s))?’
filter_main_empty:
CommandLine: ”
filter_main_null:
CommandLine: null
filter_optional_defender:
ParentImage|endswith: ‘\MsMpEng.exe’
CommandLine|contains: ‘svchost.exe’

filter_optional_mrt:
ParentImage|endswith: ‘\MRT.exe’
CommandLine: ‘svchost.exe’
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives:
-Unlikely
level: high
(Source: Surface Web)

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

RECOMMENDATIONS

STRATEGIC RECOMMENDATIONS

• Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
• Ensure that backups of critical systems are maintained that can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATIONS

• A data breach prevention plan must be developed considering (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local
• Implement a zero-trust security model alongside multifactor authentication (MFA) to reduce the risk of credential compromise.
• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your

TACTICAL RECOMMENDATIONS

• Update all applications/software regularly with the latest versions and security patches alike.
• Add the Sigma rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious
• Establish and implement protective controls by actively monitoring and blocking identified indicators of compromise (IoCs) and reinforcing defensive measures based on the provided tactical intelligence.

Active Malware of the Week

Type: Backdoor |Objectives: Persistence | Target Technology: Windows | Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the Week
This week, “BlackSeeStealer” Malware is in focus.

Overview of Operation CNBackdoor Malware

CNBackdoor is a sophisticated Windows-based family designed to establish long-term unauthorized access while minimizing the likelihood of detection. The analyzed sample demonstrates a carefully orchestrated multi-stage infection process that prioritizes stealth, persistence, and operational resilience over immediate malicious activity. Rather than executing a single payload, the malware deploys multiple components that work together to maintain execution, evade security controls, and prepare the compromised system for subsequent attacker operations.

Malware employs several defense evasion techniques before activating its primary functionality. It attempts to weaken endpoint protection by modifying Microsoft Defender settings, deploys additional executable and script components into user-accessible directories, and creates scheduled tasks to ensure automatic re-execution after system restarts or user logins. These actions indicate that the malware is intended to survive remediation attempts and remain active on infected hosts for extended periods.

Behavior observed during analysis also suggests that the malware is designed to operate selectively within its target environment. It performs checks for virtualization platforms, debugging tools, and system characteristics before continuing execution, reducing the likelihood of exposure in automated malware analysis environments. The use of obfuscated code, indirect system interactions, and multiple execution stages further reflects an emphasis on remaining concealed while establishing a reliable foothold on victim systems.

Overall, the sample analyzed represents a capable backdoor that combines persistence, security bypass, and staged payload execution into a coordinated infection chain. Although the initial execution focuses primarily on preparing the environment rather than delivering destructive actions, the established access provides attackers with a platform for future malicious activities, including remote command execution, deployment of additional malware, credential theft, or broader compromise of the affected environment. Organizations should treat detections associated with this malware as indicators of a potentially serious intrusion requiring immediate investigation and containment.

Attack Method

The analyzed CNBackdoor sample follows a structured, multi-stage execution chain that begins with the execution of a seemingly legitimate installer (Installer_v3500_x64.exe). Immediately after launch, the malware creates multiple hidden PowerShell processes that operate in parallel to prepare the victim environment for compromise. One PowerShell instance modifies Microsoft Defender by adding exclusions for specific files, directories, and processes, effectively reducing the likelihood that the malware components will be scanned or quarantined. Simultaneously, another PowerShell process launches a secondary executable from the user’s roaming profile, transitioning the infection into its next operational stage.

Following   deployment,   the   malware   installs  additional components  within   the%AppData%\Roaming\ExtendedMonitor\ directory, including the                                                              executables InterPartHKIAsync.exe and ioextender.exe, along with a VBScript (PathMarker.vbs). Persistence is achieved through the creation of a scheduled task named “Extended API 0136301”, configured to execute the VBScript every 20 minutes with the highest available privileges. VBScript silently launches the primary payload, allowing the malware to restore execution even if one of its processes is terminated. Temporary batch scripts are also generated to coordinate execution timing and remove selected files, indicating efforts to manage the malware lifecycle and reduce forensic evidence. Malware incorporates multiple defense evasion techniques before enabling its core functionality. During execution, it checks for virtualization artifacts and registry entries associated with virtual machine environments, while also searching for window classes linked to common debugging and process monitoring utilities. The malware further attempts to conceal its execution by hiding threads from debuggers, employing runtime unpacking techniques, and utilizing indirect system calls that can bypass user-mode security monitoring. Memory analysis additionally identified characteristics consistent with .NET code injection and GenericBot behavior, suggesting that significant portions of the malicious functionality are unpacked and executed dynamically in memory rather than remaining visible within the original executable.

Once persistence is established, the malware performs reconnaissance of the compromised environment and prepares for external communication. It queries Windows regional settings, including country-specific registry values, indicating support for geographically aware execution logic. The malware also retrieves the victim’s public IP address through external web services before communicating with remote infrastructure, potentially to profile infected systems or register new victims. This staged execution model, combined with strong persistence, security bypass techniques, and controlled network communication, demonstrates that CNBackdoor is designed to provide attackers with a resilient foothold that can support follow-on activities such as remote command execution, additional payload deployment, and long-term access to compromised Windows systems.

The following are the TTPs based on the MITRE ATT&CK Enterprise framework

INSIGHTS

• The analyzed CNBackdoor sample demonstrates a clear emphasis on establishing reliable access before carrying out any broader malicious objectives. Instead of immediately performing destructive or highly visible actions, the malware dedicates considerable effort to preparing the compromised environment, ensuring that its components remain operational while reducing the chances of early discovery. This execution pattern reflects a deliberate design philosophy focused on maintaining stable access rather than creating an immediate operational impact.
• Another notable characteristic is the modular organization of malware. Rather than relying on a single executable, the infection chain distributes responsibilities across multiple files, scripts, and processes that interact with one another throughout execution. This layered architecture complicates analysis because individual components appear to perform limited functions independently, while collectively they enable a more capable backdoor operation. Such separation of functionality also allows the malware to continue operating even if one component is interrupted or removed.
• The overall behavior indicates that the malware was engineered with operational discipline rather than opportunistic execution. It performs environmental validation, selectively activates specific functions, and coordinates multiple persistence and execution mechanisms without generating unnecessary system activity. This measured approach distinguishes the sample from commodity malware that prioritizes rapid execution, instead highlighting an implementation that values controlling deployment and sustained presence within the compromised system.

ETLM ASSESSMENT

From an ETLM perspective, the behaviors exhibited by CNBackdoor suggest that future threat campaigns are likely to place greater emphasis on maintaining persistent, low-profile access within enterprise environments rather than pursuing immediate disruptive outcomes. As malware continues to incorporate layered execution, selective activation, and stealth-oriented operational models, organizations may experience longer attacker dwell times, making early detection increasingly challenging. Employees are also expected to remain a primary entry point through trusted software and installer-based delivery methods, increasing the likelihood of compromise through seemingly legitimate applications. Collectively, these trends indicate that future intrusion campaigns will become more patient, adaptive, and difficult to distinguish from routine system activity, allowing attackers to sustain access and expand their operational objectives over extended periods.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)

YARA Rules
rule CNBackdoor_Installer_v3500_x64
{meta: description = “Detects CNBackdoor based on observed artifacts and network communication” author = “CYFIRMA” date = “2026-08-03”

strings:

/* SHA-256 IOC */

$sha256 = “1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48”

/* C2 / Network Communication */

$domain1 = “tommysbakescodes.ws”

$url1  =  “https://tommysbakescodes.ws/mnlinmwv/insris.php”

$url2  =  “https://tommysbakescodes.ws/mnlinmwv/insirs.php”

$ipcheck1 = “api.ipify.org”

$ipcheck2 = “ipv4.icanhazip.com”

$ipcheck3 = “v4.ident.me”

/* Dropped Files */

$file1 = “InterPartHKIAsync.exe”

$file2 = “ioextender.exe”

$file3 = “PathMarker.vbs”

$file4 = “ExtendedMonitor”

/* Persistence */

$task = “Extended API 0136301”

$vbs = “CreateObject(\”WScript.Shell\”)”

$run = “ioextender.exe”

/* Defender Evasion */

$ps1 = “Add-MpPreference”

$ps2 = “WindowStyle Hidden”

$ps3 = “powershell.exe”

condition:

uint16(0) == 0x5A4D and

$sha256 and (

2 of ($domain*, $url*, $ipcheck*) or 4 of ($file*, $task, $vbs, $run, $ps*)

)

}

Recommendations

Strategic Recommendations

• Strengthen application control policies by allowing execution only from trusted and digitally signed software sources to reduce the risk of installer-based malware
• Implement a defense-in-depth security architecture that combines Endpoint Detection and Response (EDR), network monitoring, and threat intelligence to detect stealthy, multi-stage malware activity.
• Establish continuous threat hunting focused on persistence mechanisms, unauthorized scheduled tasks, and abnormal PowerShell activity to identify advanced backdoor infections at an early stage.
• Maintain a structured vulnerability and patch management program to minimize opportunities for malware to exploit outdated software and operating systems.

Management Recommendations

• Restrict administrative privileges by enforcing the principle of least privilege and limiting the ability of users to modify security settings or install unauthorized
• Develop and periodically test incident response procedures for malware infections, ensuring rapid isolation, forensic investigation, and recovery of compromised endpoints.
• Enhance employee security awareness training to discourage downloading or executing software installers from untrusted or unofficial
• Maintain centralized logging and asset visibility to improve monitoring of endpoint activities, scheduled tasks, and security configuration changes across the

Tactical Recommendations

• Monitor for PowerShell commands that modify Microsoft Defender preferences or create security exclusions, as these behaviors may indicate attempts to evade endpoint protection.
• Detect and investigate the creation of unauthorized scheduled tasks, VBScript execution, and  unexpected  files  within  user  profile  directories  such  as %AppData%\Roaming\ExtendedMonitor\.

• Block or alert on outbound connections to known malicious domains and suspicious IP discovery services observed during malware execution and regularly update network security controls with the latest threat
• Perform proactive threat hunting for malware artifacts, including the dropped executables (InterPartHKIAsync.exe, ioextender.exe), associated scripts, and related IOCs identified during the analysis to identify additional compromised systems.

CYFIRMA’s Weekly Insights

1. Weekly Attack Types and Trends

Key Intelligence Signals:

• Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains,
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware – Gunra Ransomware, The Gentlemen Ransomware| Malware –CNBackdoor
• Gunra Ransomware– One of the ransomware
• The Gentlemen Ransomware – One of the ransomware groups.

Please refer to the trending malware advisory for details on the following:

• Malware – CNBackdoor
• Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

Lazarus Group: Evolution of Software Supply Chain Tradecraft

• Threat Actor: Lazarus Group aka (SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, Alluring Pisces)
• Attack Type: Botnet Operations, Malware Implant, DLL Injection Attacks, Direct IP-based C2 Communication, Impersonation, Obfuscation, Open Proxy Usage, Credential Stealing, Social Engineering Attack, Supply Chain Attacks, Ransomware Attacks, Cryptocurrency theft, Exploitation of
• Objective: Information theft, Espionage, Financial Gains, Credential
• Suspected Target Technology: Windows, macOS, Linux, SAP Systems, Cryptocurrency Exchanges, Financial Platforms (including SWIFT), JetBrains TeamCity, Oracle Products, Dell Systems, Atlassian Confluence, Citrix NetScaler ADC/Gateway, GitHub and GitLab repositories, Microsoft Visual Studio Code.
• Suspected Target Geography: Australia, Brazil, Brunei, Canada, Chile, China, Darussalam, Democratic People’s Republic of Korea, France, Germany, Guatemala, Hong Kong, India, Indonesia, Islamic Republic of Iran, Japan, Myanmar, Philippines, Poland, Republic of Korea, Russia, Thailand, United Kingdom, United States, Vietnam, Bangladesh.
• Suspected Target Industries: Aerospace & Defense, Capital Markets, Consumer Finance, Cryptocurrency, Defense, Diversified Financial Services, Energy, Entertainment, Government, Hotels, Investment Trusts (REITs), Media, NGO, Real Estate, Restaurants & Leisure, Technology, Telecommunications, Thrifts and Mortgage, Banks,
• Business Impact: Financial Loss, Data Theft, Operational Disruption, Reputational

About the Threat Actor

Lazarus Group is a highly sophisticated North Korea-linked threat actor that has been active since at least 2009 and is widely assessed to operate in support of the DPRK’s strategic and intelligence objectives. Also tracked by the U.S. government as Hidden Cobra, the group is associated with Lab 110, an entity linked to North Korean military intelligence. Lazarus maintains advanced malware development capabilities, enabling it to rapidly evolve its toolsets, adapt existing exploits, and develop new offensive capabilities to evade detection.

The group has conducted a wide range of cyber espionage, disruptive, and financially motivated operations, with recent campaigns increasingly focusing on cryptocurrency organizations to generate revenue and support state objectives. Historically, Lazarus has been linked to high-profile operations including the Sony Pictures attack, Bangladesh Bank SWIFT heist, WannaCry ransomware, Operation Troy, DarkSeoul, and several long-running espionage campaigns. The group is believed to comprise multiple operational subgroups, including Andariel, which primarily targets South Korean interests, and Bluenoroff, which specializes in financially motivated operations and global espionage. Additionally, UNC1069 has been assessed to share infrastructure overlaps with Bluenoroff, indicating operational coordination within the broader Lazarus ecosystem.

Details on Exploited Vulnerabilities

TTPs based on the MITRE ATT&CK Framework

Latest Developments Observed

The threat actor is suspected of conducting coordinated software supply chain attacks by compromising trusted NPM package maintainer accounts and trojanizing widely used open-source libraries, including Axios, Debug, Chalk, and Typo-Crypto. The campaign appears to leverage social engineering and malicious package updates to compromise downstream developer environments, with the primary objective of gaining large-scale access for financially motivated operations and sensitive information theft.

ETLM Insights

Lazarus Group continues to demonstrate a mature and adaptive operational model centered on exploiting trusted software development ecosystems to support strategic intelligence collection and financially motivated operations. The group’s evolving tradecraft reflects a deliberate emphasis on compromising trusted software maintainers and open-source supply chains to achieve large-scale downstream access while maintaining operational stealth, scalability, and long-term resilience.

The threat actor’s operations reflect:

• Strategic exploitation   of   trusted  software   development  and open-source ecosystems to maximize downstream operational reach.
• Sustained access   through  compromise  of  legitimate developer identities, maintainer accounts, and trusted software distribution channels.
• Adaptive malware    delivery   supported by modular payloads,layered obfuscation, and evolving defense-evasion techniques.
• Scalable compromise of interconnected software supply chains to facilitate intelligence collection and financially motivated operations.

Looking ahead, Lazarus Group is expected to further strengthen its software supply chain capabilities by expanding abuse of trusted developer ecosystems, integrating AI-assisted development and social engineering techniques, and refining stealth-oriented intrusion methodologies. This continued evolution reinforces the group’s ability to conduct large-scale downstream compromises through trusted software dependencies, posing a sustained threat to organizations that rely on open-source software, modern DevOps environments, and interconnected software supply chains.

YARA Rules

rule Lazarus_SupplyChain_IOC_Hunting

{

meta:

author = “CYFIRMA”

description = “Detects Lazarus-related supply chain campaign artifacts based on observed IOCs”

date = “2026-08-03”

actor = “Lazarus Group” tlp = “TLP:CLEAR”

strings:

/* Domains */

$domain1 = “zmail.vetstarts.com” ascii nocase

$domain2 = “zimbra.planetink.com” ascii nocase

$domain3 = “www2.planetink.com” ascii nocase

$domain4 = “www1.planetink.com” ascii nocase

$domain5 = “www.vetstarts.com” ascii nocase

/* Installer / Payload names */

$file1 = “telloo trader.msi” ascii nocase

$file2 = “c:\\windows\\installer\\5fd39b9.msi” ascii nocase

$file3 = “c:\\windows\\installer\\505df9.msi” ascii nocase

$file4 = “c:\\windows\\installer\\3f217f.msi” ascii nocase

$file5 = “c:\\windows\\installer\\4059ff.msi” ascii nocase

/* CVE References */

$cve1 = “CVE-2023-22518” ascii

$cve2 = “CVE-2022-41082” ascii

$cve3 = “CVE-2022-41040” ascii

$cve4 = “CVE-2021-26855” ascii

$cve5 = “CVE-2021-34523” ascii

/* Infrastructure */

$ip1 = “91.132.144.59” ascii

$ip2 = “104.239.66.201” ascii

$ip3 = “73.158.81.165” ascii

$ip4 = “76.229.204.88” ascii

$ip5 = “68.183.59.139” ascii condition:

3 of ($domain*) or 3 of ($file*) or

3 of ($ip*) or

(2 of ($domain*) and 2 of ($file*)) or (2 of ($domain*) and 2 of ($ip*)) or (2 of ($file*) and 2 of ($ip*)) or

any of ($cve*)

}

Recommendations

Strategic Recommendations

• Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
• Establish comprehensive identification and prioritization of cyber risks associated with third-party vendors and services through periodic risk assessments, vulnerability assessments, and system
• Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more, by identifying such patterns.

Management Recommendations

• Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation Reinforce this training with context-aware banners and in-line prompts to help educate users.
• Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.
• Strengthen boundary defense such as network segmentation and have a strong access management capability in line with the Principle of Least Privilege (POLP) that can assist in mitigating cyberattacks.

Tactical Recommendations

• For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
• Use a software development lifecycle (SDLC) and incorporate secure software development practices throughout all lifecycle phases.
• Apply security measures to detect unauthorized activities, protect sensitive production and process control systems from cyberattacks.
• Add the YARA rule for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

Iran likely behind a coordinated cyberattack on water systems in Minnesota

U.S. intelligence agencies assess that Iran was likely responsible for a coordinated cyberattack targeting over 30 municipal water systems in Minnesota. The FBI is actively investigating the intrusion, which briefly took at least one system offline while disrupting remote sensors on another and forcing workers to switch to manual operations. Minnesota IT Services confirmed that state and federal authorities are collaborating on threat intelligence and remediation, emphasizing that residents currently do not need to modify their drinking water usage.

The breach marks the latest in a series of digital intrusions striking American critical infrastructure since military conflict broke out on February 28. Federal cybersecurity officials have repeatedly warned that Iranian actors are actively targeting internet-exposed operational controls across the water, wastewater, and energy sectors. According to threat research experts, these ongoing disruptions represent a significant escalation in non-kinetic warfare, with Iranian-linked groups consistently probing vulnerable municipal networks nationwide.

ETLM Assessment:

Iran has been quietly carrying out cyberattacks against the U.S. since a conflict began on February 28. Cybersecurity experts point out that these attacks mostly focus on easy targets, such as small utility companies that use internet-connected controllers with default passwords. Similar incidents occurred in late 2023, when a group linked to Iran’s Islamic Revolutionary Guard Corps targeted water infrastructure using programmable logic controllers (PLCs) across multiple countries.

According to threat intelligence specialists, the main goals of these attacks are psychological rather than destructive; shifting American sentiment by trying to make people feel anxious about the costs of the war and demonstrating capability to influence the American public to domestic audiences, both writ large and to appear useful to Iran’s leadership. Government agencies, including the Cybersecurity and Infrastructure Agency (CISA), have issued warnings about these threats and urged organizations to disconnect vulnerable controllers from the internet and update default passwords immediately.

Russian hackers hijack Wi-Fi in hotels

Microsoft has officially attributed a widespread Wi-Fi hijacking campaign targeting routers at hotels and hospitality venues to Storm-2945, a subgroup of the Russian cyberespionage actor Midnight Blizzard. The operation compromises network routers to redirect unsuspecting travelers to malicious phishing portals designed to steal credentials and launch ClickFix social engineering attacks. In light of these findings, researchers advise travelers to avoid public hotel, conference, and airport networks whenever possible, recommending private connectivity options such as mobile hotspots, satellite links, or cellular eSIMs instead.

ETLM Assessment:

Storm-2945, also widely known by security researchers as APT29 or Cozy Bear, is an elite cyberespionage group tied directly to Russia’s Foreign Intelligence Service (SVR). They are the same group historically responsible for high-profile operations like the SolarWinds supply chain attack and breaches of major technology and government organizations worldwide.

Hotels, conference centers, and business lounges frequently host foreign diplomats, government officials, corporate executives, defense contractors, and journalists. Hijacking the Wi-Fi at these venues creates a digital dragnet to identify and target specific high-value individuals while they are away from their secure office networks. Stolen credentials from traveling executives allow Russian intelligence to bypass perimeter defenses and quietly infiltrate sensitive corporate or government networks back in the targets’ home countries, where Russia intends to gather intelligence of strategic value.

4. Rise in Malware/Ransomware and Phishing

Gunra Ransomware Impacts a Manufacturing Company from Thailand

• Attack Type: Ransomware
• Target Industry: Manufacturing
• Target Geography: Thailand
• Ransomware: Gunra Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:

CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Thailand was compromised by Gunra Ransomware. The Compromised company is a Thailand-based chemical manufacturer. The company specializes in the production and supply of plastic additives, particularly PVC stabilizers, serving customers across Thailand and the ASEAN region. According to the leak site, the ransomware incident appears to involve the compromise of technical data stored within an internal repository. Based on the available evidence, the exposed information may include engineering documentation, technical files, system configurations, project-related data, infrastructure information, source materials, and other proprietary technical assets. The total size of compromised data is approximately 100GB.

Source : Dark Web

Relevancy & Insights:

• Gunra is a highly sophisticated double-extortion ransomware group that emerged in April 2025, leveraging leaked Conti ransomware code and operating with advanced encryption and evasion capabilities.
• The Gunra Ransomware group primarily targets countries such as the United States of America, Spain, Thailand, Brazil, and
• The Gunra Ransomware group primarily targets industries, including Professional Goods & Services, Real Estate & Construction, Materials, Healthcare, and Transportation &
• Based on the Gunra Ransomware victims list from 1stJan 2026 to 04th August 2026, the top 5 Target Countries are as follows:

• The Top 10 Industries most affected by the Gunra Ransomware group victims list from 1st Jan 2026 to 04th August 2026 are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, Gunra Ransomware is a financially motivated ransomware group that emerged in April 2025, rapidly establishing itself as a significant threat within the evolving ransomware landscape. Leveraging a double-extortion model, Gunra encrypts victim data while simultaneously exfiltrating sensitive information to pressure organizations into paying ransom demands.

The Gentlemen Ransomware Impacts a Banking and Financial Services Company from the Philippines

• Attack Type: Ransomware
• Target Industry: Banking and Financial Services
• Target Geography: Philippines
• Ransomware: The Gentlemen Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:

CYFIRMA observed on a ransomware data leak site (DLS) in the dark web that a company from the Philippines was compromised by The Gentlemen Ransomware. The compromised company is one of the Philippines’ leading savings banks, established in 1960. The bank offers a comprehensive range of retail banking products and services, including savings and checking accounts, time deposits, consumer loans, home loans, auto loans, SME financing, digital banking, and payment solutions. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

• The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
• The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Germany.
• The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
• Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 04th August 2026, the top 5 Target Countries are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploit

Vulnerability in JetBrains TeamCit

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Continuous Integration / Continuous Delivery (CI/CD) Server
• Vulnerability: CVE-2026-63077
• CVSS Base Score: 8 Source
• Vulnerability Type: Remote Code Execution (RCE)
• Summary: The vulnerability allows a remote attacker to execute arbitrary

Relevancy & Insights:
The vulnerability exists due to improper input validation in fastjson type resolution logic when parsing user-supplied JSON input.

Impact:
A remote attacker can send a specially crafted JSON payload to execute arbitrary code.
Exploitation requires the application to run as a Spring Boot executable fat-jar under the default configuration with AutoType disabled and SafeMode disabled.

Affected Products:
https[:]//fearsoff[.]org/research/fastjson-1-2-83-rce

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK

This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment

The vulnerability in JetBrains TeamCity presents a significant security risk to organizations that rely on TeamCity On-Premises for software build automation and Continuous Integration/Continuous Delivery (CI/CD) operations. As TeamCity commonly manages source code, build pipelines, deployment workflows, credentials, and software artifacts, successful exploitation of this unauthenticated remote code execution vulnerability could allow threat actors to gain control of the TeamCity server without requiring valid credentials. Such access may expose sensitive source code, configuration files, stored secrets, build artifacts, and deployment pipelines while enabling attackers to manipulate software development processes or introduce malicious code into enterprise environments. Because CI/CD platforms often serve as critical components within software supply chains, compromise of TeamCity can have cascading effects across multiple production systems and downstream applications. Organizations using TeamCity On-Premises should immediately apply the latest security updates or vendor-provided security patch plugin, restrict access to trusted networks, implement strong monitoring for anomalous server and agent activity, and review system logs for indicators of compromise. Prompt remediation and continuous monitoring are essential to protecting enterprise software development infrastructure and reducing the risk of supply chain compromise resulting from exploitation of this critical vulnerability.

6. Latest Cyber-Attacks, Incidents, and Breaches

Krybit Ransomware attacked and published the data of a Construction and Engineering company from Thailand

• Threat Actor: Krybit Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Construction and Engineering
• Target Geography: Thailand
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, we observed that Krybit Ransomware attacked and published the data of a Construction and Engineering company from Thailand on its dark web website. The Compromised company is the second-largest construction and engineering company in Thailand. The company provides comprehensive construction services across two core segments: Construction and Related Services (mass rapid transit systems, airports, roads and expressways, energy projects, water supply, harbour projects, and buildings); and Investment in Infrastructure Business (toll roads, MRT operations, hydropower, and water supply businesses). Notable completed projects include Bangkok’s MRT Blue Line, MRT Purple Line, BTS Skytrain extensions, Xayaburi Dam (Laos), Nam Ngum 2 Hydroelectric Power Plant (Laos), Royal Thai Police Headquarters, Phuket wastewater system, and Thai Airways International cargo maintenance area. The compromised data includes confidential and sensitive information belonging to the organization. The Total size of data compromised is approximately 103.01 GB.

Source: Dark Web

Relevancy & Insights:

• Krybit Ransomware is a financially motivated cybercriminal group that operates a dedicated data leak site (DLS) to extort victims by encrypting systems and threatening to publish stolen data unless a ransom is
• The Krybit Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Government & Civic, Consumer Goods & Services, and Information Technology.

ETLM Assessment:

According to CYFIRMA’s assessment, Krybit represents a persistent, financially motivated Ransomware-as-a-Service (RaaS) and data extortion threat that leverages an opportunistic affiliate-driven operational model to maximize pressure on victims. Although the group functions via external threat actors incentivized by lucrative profit-sharing structures, its targeted deployment of custom malware suites across corporate environments highlights the critical importance of robust identity security, continuous network monitoring, timely vulnerability remediation, and rigorous data loss prevention measures to detect, contain, and mitigate potential ransomware extortion attacks.

7. Data Leaks

Unauthorized Manufacturing Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Automotive Parts Manufacturing
• Target Geography: South Korea
• Objective: Financial Gain
• Business Impact: Exposure of Personally Identifiable Information (PII), Customer Privacy Risks, Credential Disclosure, Business Information Exposure, Regulatory Compliance Concerns, Financial Loss, Reputational Damage

Summary:

The CYFIRMA research team identified a post on a dark web forum advertising the sale of a large database allegedly originating from a South Korean automotive parts manufacturing organization. According to the advertisement, the seller claims to possess complete database dumps extracted from the organization’s infrastructure, including information related to employees, manufacturing operations, customers, suppliers, business partners, and vehicle parts. The advertisement further states that the data is offered in CSV format and includes hundreds of database tables containing millions of records. Sample data has reportedly been shared as proof of possession, while the complete dataset is being offered for sale through a cybercrime marketplace. According to the forum advertisement, the complete database is being offered for sale at an asking price of USD 40,000

Based on the information shared in the forum advertisement, the allegedly exposed data may include:

• Employee information
• Manufacturing records
• Customer information
• Supplier and partner details
• Vehicle parts information
• Enterprise database tables
• CSV-formatted database exports
• Internal business records
• Organizational operational data
• Structured database records
• Additional enterprise information associated with business operations

The authenticity of the advertised dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and has not been independently confirmed.

Source: Underground Forums

Unauthorized Recruitment Platform Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: Human Resources
• Target Geography: Japan
• Objective: Financial Gain
• Business Impact: Exposure of Sensitive Corporate Data, Intellectual Property Risks, Operational Information Disclosure, Regulatory Compliance Concerns, Financial Loss, Reputational Damage.

Summary:
The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of a database allegedly obtained from a Japanese online recruitment platform. According to the forum advertisement, the dataset reportedly contains approximately 320,000 records in CSV format, with the seller offering the complete database for sale and publishing sample records as proof of possession. The advertisement claims the database contains personal information associated with platform users, including identity, contact, and profile-related data. The authenticity of these claims has not been independently verified. According to the forum advertisement, the complete database is being offered for sale at an asking price of USD 7000.

Based on the information shared in the forum post, the allegedly exposed dataset may include:

• User identification numbers
• Full names
• First and last names
• Name representations (Kana)
• Email addresses
• Passwords (or password-related data)
• Gender
• Date of birth
• Postal codes
• Prefecture and district information
• Residential addresses
• House numbers
• Contact numbers
• Educational institution details
• Account creation timestamps
• Last login information
• Additional user profile information

Potential Impact

If verified, exposure of this information could pose significant risks to affected individuals and the organization. Cybercriminals may exploit the leaked data to conduct:

• Identity theft
• Credential stuffing attacks
• Account takeover attempts
• Targeted phishing campaigns
• Social engineering attacks
• Business Email Compromise (BEC)
• Financial fraud
• Spam and scam campaigns
• Unauthorized access to user accounts
• Follow-on cyberattacks using harvested personal information

The disclosure of user credentials and personal information may further enable attackers to correlate identities across multiple online services, increasing the likelihood of broader compromise where users have reused passwords or similar account information.

At the time of reporting, the authenticity of the alleged dataset remains unverified. This assessment is based solely on information published in the cybercrime forum advertisement and the accompanying sample screenshots. No independent verification has been performed regarding the origin, completeness, or legitimacy of the advertised data.

Source: Underground Forums

Relevancy & Insights:

Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:

The threat actor is assessed as an active and capable entity primarily engaged in data-leak operations, with multiple credible indications linking them to incidents involving unauthorized system access and the dissemination or sale of stolen data on dark web forums. These activities underscore the growing sophistication of cyber threats driven by organized underground networks and highlight the urgent need for organizations to enhance their cybersecurity posture through continuous monitoring, improved threat intelligence, and proactive defensive measures to protect sensitive information and critical infrastructure.

Recommendations: Enhance the cybersecurity posture by:

1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being
2. Ensure proper database configuration to mitigate the risk of database-related
3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a post on a dark web forum advertising a database allegedly originating from a telecommunications value-added services (VAS) provider operating in the Middle East. According to the advertisement, the dataset contains information associated with approximately 59,903 Saudi mobile subscribers and includes over 88,000 transaction events. The forum post claims that the leaked data includes subscriber information, transaction history, billing-related records, and technical service metadata. The dataset is reportedly being offered as a free download, accompanied by sample records intended to demonstrate possession of the data. The authenticity of the advertised dataset has not been independently verified. The reporting structure follows the format of the uploaded document.

Based on the information shared in the forum advertisement, the allegedly exposed data may include:

• Mobile phone numbers (MSISDN)
• Transaction timestamps
• Device model information
• Mobile operating system versions
• Mobile carrier information
• IP addresses
• Approximate location information
• Transaction response codes
• Internal API endpoint references
• Billing API credentials
• Affiliate and tracking identifiers
• Pixel identifiers
• Advertising values
• Server IP addresses
• User IP addresses
• Fraud status indicators
• PIN codes
• Billing types
• Service identifiers
• Subscriber transaction history
• Technical service metadata

Potential Impact

If verified, exposure of this information could pose significant risks to affected subscribers and the service provider. Cybercriminals could exploit the leaked data to conduct targeted phishing campaigns, SIM swap attacks, identity theft, social engineering, credential stuffing, business email compromise (BEC), fraudulent subscription activities, and unauthorized account access. The availability of transaction history, technical metadata, and billing-related information may further facilitate financial fraud, abuse of telecommunications services, and additional attacks against associated platforms and subscribers.

The authenticity of the alleged dataset remains unverified at the time of reporting. This assessment is based solely on information published in the dark web forum advertisement and has not been independently confirmed.

Source: Underground Forums

RECOMMENDATIONS

STRATEGIC RECOMMENDATIONS

• Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATIONS

• Take advantage of global Cyber Intelligence, providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions, remediations, and lessons learned.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM
• Ensure that detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies should be continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATIONS

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Consider using security automation to speed up threat detection, improved incident response, increased the visibility of security metrics, and rapid execution of security checklists.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence provided.
• Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security controls, such as reCAPTCHA (completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.