Weekly Intelligence Report – 23 Oct 2026

Ransomware In Focus

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple industries, geographies, and technologies that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows OS

Introduction:

CYFIRMA Research and Advisory Team has found SAMURAI-SEC Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

SAMURAI-SEC Ransomware

SAMURAI-SEC is a ransomware variant derived from the Chaos ransomware family that employs file encryption and data exfiltration to conduct a double-extortion attack. Once executed on a compromised system, it encrypts accessible files and modifies their filenames by appending either a randomly generated four-character extension or the .samurai extension, depending on the variant. The malware also creates a ransom note in a text file, using either READ_ME.txt or read_it.txt. In addition to disrupting access to local data, the ransomware reportedly exfiltrates sensitive information to attacker-controlled infrastructure, enabling the operators to threaten data disclosure even when victims can restore files from backups. Removing the malware may prevent further malicious activity, but it does not automatically decrypt files that have already been encrypted.

Screenshot: File encrypted by the ransomware

The ransom note claims that the victim’s sensitive data has been encrypted and transferred to attacker-controlled systems. It instructs victims to establish contact through an encrypted messaging service and provides an email address as an alternative if no response is received within 24 hours. The attackers impose a 48-hour deadline, threatening to publish the allegedly stolen information if contact is not established within that period. The note also states that the ransom amount is negotiable based on the victim’s response time and warns against modifying encrypted files, interrupting the encryption process, or using third-party recovery tools. Additionally, it discourages victims from seeking professional cybersecurity assistance. These statements serve as coercive social-engineering tactics designed to increase urgency, discourage independent recovery efforts, and pressure victims into negotiating with the attackers.

Screenshot: The appearance of Samurai-Sec’s note (README.txt)

The following are the TTPs based on the MITRE ATT&CK framework

Tactic	Technique ID	Technique Name
Execution	T1129	Shared Modules
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Discovery	T1012	Query Registry
Discovery	T1033	System Owner/User Discovery
Discovery	T1057	Process Discovery
Discovery	T1083	File and Directory Discovery
Discovery	T1087	Account Discovery
Discovery	T1518	Software Discovery
Collection	T1115	Clipboard Data
Commandand Control	T1071	Application Layer Protocol
Impact	T1490	Inhibit System Recovery
Stealth	T1027	Obfuscated Files or Information
Stealth	T1036	Masquerading
Stealth	T1070.004	Indicator Removal: File Deletion
Stealth	T1140	Deobfuscate/Decode Files or Information
Defense Impairment	T1222	File and Directory Permissions Modification
Defense Impairment	T1553.002	Subvert Trust Controls: Code Signing

• The ransomware primarily targets Windows environments, utilizing Windows services, command-line utilities, registry configurations, system APIs, and filesystem operations to perform encryption, system modification, and recovery-inhibition activities.
• The ransomware terminates processes such as vssadmin.exe Delete Shadows /all/quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By removing these shadow copies, the malware ensures that victims cannot recover their files via system restore points or backup utilities.
• Assembly: The ransomware is identified as a compiled executable containing assembly-level instructions that are processed by the system’s processor. These instructions define the program’s execution flow, including malicious operations such as file encryption, process manipulation, system modification, and payload execution. Analyzing the assembly code can help identify the ransomware’s underlying functionality, encryption routines, API calls, and other malicious activities. However, the presence of the assembly tag alone does not confirm malicious behaviour, as it is a general file classification used to identify files associated with assembly code.

ETLM Assessment:

SAMURAI-SEC may evolve through improvements in encryption routines, persistence mechanisms, and execution techniques designed to increase its effectiveness against compromised systems. Future variants could adopt more sophisticated methods for identifying valuable files, targeting network-shared resources, and disrupting backup and recovery mechanisms. The malware may also incorporate enhanced defense-evasion capabilities, such as code obfuscation, process injection, and modifications to its execution behavior, to reduce the likelihood of detection by security mechanisms. In addition, its data exfiltration component could become more selective and automated, enabling attackers to prioritize sensitive documents, business records, and other high-value information before initiating file encryption. These developments are potential evolutionary pathways rather than confirmed capabilities of existing variants.

Future versions of SAMURAI-SEC may increasingly rely on multi-stage extortion strategies that combine file encryption, confidential data theft, and threats of public disclosure. Attackers could introduce automated victim profiling, customized ransom demands, and more structured communication channels to increase financial pressure on affected organizations. The malware may also be adapted to target enterprise environments, exploit weaknesses in remote access infrastructure, or spread laterally across interconnected systems when suitable vulnerabilities or credentials are available. As defensive technologies improve, its operators may attempt to modify malware signatures, encryption workflows, and command-and-control communication patterns to evade detection. However, the extent to which SAMURAI-SEC adopts these techniques will depend on future modifications by its developers, and these possibilities should not be interpreted as verified features of current samples.

Sigma rules:

title: Suspicious Process Masquerading As SvcHost.EXE tags:

– attack.stealth

– attack.t1036 logsource:

category: process_creation product: windows

detection: selection:

Image|endswith: ‘svchost.exe’ filter_main_img_location:

Image:

– ‘C:WindowsSystem32svchost.exe’

– ‘C:WindowsSysWOW64svchost.exe’ filter_main_ofn:

OriginalFileName: ‘svchost.exe’

condition: selection and not 1 of filter_main_* falsepositives:

– Unlikely level: high

regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masq ueraded_execution/info.yml

(Source: Surface Web)

IOCs:

Kindly refer to the IOCs section to exercise control of your security systems

RECOMMENDATIONS

• Implement competent security protocols and encryption, authentication, or access credential configurations to access critical systems in your cloud and local environments.
• Ensure that backups of critical systems are maintained, which can be used to restore data in case a need arises.

• A data breach prevention plan must be developed considering (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
• Implement a zero-trust security model alongside multifactor authentication (MFA) to reduce the risk of credential compromise.
• Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

• Update all applications/software regularly with the latest versions and security patches alike.
• Add the Sigma rules for threat detection and monitoring, which will help to detect anomalies in log events and identify and monitor suspicious activities.
• Establish and implement protective controls by actively monitoring and blocking identified indicators of compromise (IoCs) and reinforcing defensive measures based on the provided tactical intelligence.

Active Malware of the Week

Type: Backdoor / RAT | Objectives: Remote Control, Persistence and Data Exfiltration | Target Technology: Windows | Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malwares that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the Week
This week, IronRAT Malware is in focus.

Overview of Operation IronRAT Malware

IronRAT is a remote access threat that enables attackers to retain control over compromised Windows systems while gathering sensitive information from affected users. Its functionality allows remote operators to observe user activity, capture information handled on the device, and obtain credentials that may provide access to additional resources. This combination of surveillance and information theft increases the potential consequences of an infection.

Beyond information collection, the malware supports continued interaction with the compromised endpoint. An attacker may use the established access to inspect the victim’s activities, issue further commands, and exploit information obtained during the intrusion. This creates a risk that extends beyond the initial compromise, particularly when sensitive business information or account credentials are exposed.

The malware incorporates mechanisms that allow it to remain active across system restarts and subsequent user logins. Its ability to resume execution automatically, alongside reported concealment and trace-removal activities, may allow malicious operations to continue while making the compromise more difficult to identify and investigate.

The combined capabilities of persistent access, user monitoring, credential theft, and remote command execution make IronRAT a significant threat to organizational security. An infected endpoint may become a continuinglicious activity, increasing the potential impact on both individual users and the wider organization

Attack Method

Upon execution on a Windows system, IronRAT checks for mutex objects, including IR_agent_single and OneSettingQueryMutex+compat+encapsulation, to determine whether an instance is already active and help prevent duplicate execution. It performs preliminary environment checks before initiating subsequent operations. The sample also demonstrates reflective, memory-based execution and memory- and thread-level manipulation consistent with code injection, potentially enabling malicious routines to operate within legitimate process contexts and reducing their visibility during conventional inspection.

The malware establishes several persistence mechanisms to support execution across system restarts and user logins. These include creating scheduled tasks, modifying the Windows Run registry key, and placing its payload in the per-user Startup folder. By using multiple automatic execution paths, the malware can restore its activity under different system and session conditions. It also employs concealment techniques targeting payload structures and reportedly removes selected artifacts and event logs, potentially limiting the forensic evidence available for investigation.

Its principal functionality combines interactive remote access with surveillance and credential collection. IronRAT can capture screenshots of the active desktop, record keystrokes, monitor copied text, and retrieve stored credentials. In addition, its ability to execute commands or code supplied by a remote operator allows the attacker to perform further actions on the infected host. These capabilities provide visibility into user activity while supporting the collection of authentication data and continued manipulation of the compromised system.

For external communication, IronRAT establishes a channel with operator-controlled infrastructure to facilitate the delivery of remote instructions and the transmission of information collected from the affected host. Combined with its persistence mechanisms, process-level manipulation, surveillance functions, and command execution capabilities, this communication channel supports sustained remote operations and enables the compromised Windows system to remain under an external operator’s control.

The following are the TTPs based on the MITRE ATT&CK Framework for Enterprises

Tactic	Technique	Technique Name
Execution	T1053.005	Scheduled Task/Job: Scheduled Task
T1129	Shared Modules
T1574	Hijack Execution Flow
Persistence	T1112	Modify Registry
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Stealth	T1027.002	Obfuscated Files or Information : Software Packing
T1027.005	Obfuscated Files or Information: Indicator Removal from Tools
T1036	Masquerading
T1070.004	Indicator Removal: File Deletion
T1140	Deobfuscate/Decode Files or Information
T1202	Indirect Command Execution
T1497	Virtualization/Sandbox Evasion
T1564.003	Hide Artifacts: Hidden Window
Credential Access	T1056.001	Input Capture: Keylogging
	T1012	Query Registry
	T1033	System Owner/User Discovery
	T1057	Process Discovery
	T1082	System Information Discovery
	T1083	File and Directory Discovery
Discovery	T1087	Account Discovery
	T1120	Peripheral Device Discovery
	T1518	Software Discovery
	T1614	System Location Discovery
	T1113	Screen Capture
Collection	T1115 T1213	Clipboard Data Data from Information Repositories
Command and control	T1071	Application Layer Protocol

• IronRAT highlights how the compromise of a single endpoint can undermine the trust placed in everyday digital interactions. Activities such as accessing business applications, reviewing documents, and using online services may expose information beyond what is stored locally on the device. The significance of the threat lies in how ordinary user workflows can become a source of intelligence for an unauthorized party, without requiring a separate interaction for every piece of information obtained.
• The threat also illustrates the importance of the relationship between a user’s digital identity and the resources available through that identity. Information obtained from an affected system may reveal how a user interacts with different services and handles sensitive work-related material. Consequently, the impact of the compromise is not limited to the individual endpoint; it may extend to the broader digital environment associated with the victim’s activities and privileges.
• A further concern is the difficulty of distinguishing legitimate system use from activity occurring without the user’s knowledge. When a device continues to function normally from the user’s perspective, unauthorized access may coexist with routine work, leaving the individual unaware of the extent of the compromise. This gap between perceived system integrity and actual control makes the incident particularly significant from an organizational trust and information confidentiality perspective.

ETLM ASSESSMENT

From an ETLM perspective, IronRAT-like threats may increasingly influence how organizations experience and manage the consequences of cyber intrusions, particularly as unauthorized access becomes harder to distinguish from legitimate user activity. Future incidents could place greater pressure on business continuity, workforce productivity, and confidence in the integrity of internal information, especially where compromised employee accounts intersect with sensitive corporate operations. Employees may face more complex consequences, including misuse of their digital identities, exposure of work-related communications, and disruption to responsibilities that depend on trusted access to organizational resources. Over time, the broader impact may extend beyond direct financial losses to include prolonged incident recovery, weakened stakeholder confidence, and greater uncertainty surrounding the reliability of routine business activities.

IOCs:

Kindly refer to the IOCs below to exercise controls on your security systems.

YARA Rules

rule IronRAT_Malware

{

meta:

description = “Detection rule for the analyzed malware sample” author = “CYFIRMA Research”

strings:

$hash1 = “47a9e572a1062abd16b0a0df256ba0c4b6b4660125844ca8ddbf22714f6beb30”

$hash2 = “0921c29f459c03aa2ad7ac9b4482e7bf4c84214d”

$hash3 = “069f2134a0ef7d7c30b1c607d2386c19”

$s1 = “cmd /c schtasks /Create /TN ”MicrosoftEdgeUpdateTaskMachineCore” /TR

”\”C:\Users\<USER>\Desktop\executable.exe\”” /SC ONLOGON /RL HIGHEST /F”

$s2 = “wmic /NAMESPACE:”\\root\subscription” PATH EventFilter CREATE EventName=”IRFilter”, QueryLanguage=”WQL”, Query=”SELECT * FROM

InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ‘Win32_PerfFormattedData_PerfOS_System”

$s3 = “wmic /NAMESPACE:”\\root\subscription” PATH CommandLineEventConsumer CREATE Name=”IRConsumer”, CommandLineTemplate=”C:\Users\<USER>\Desktop\executable.exe”

$s4 = “wmic /NAMESPACE:”\\root\subscription” PATH

FilterToConsumerBinding CREATE Filter=” EventFilter.Name=’IRFilter’”, Consumer=”CommandLineEventConsumer.Name=’IRConsumer”

$s5 = “schtasks /Create /TN ”MicrosoftEdgeUpdateTaskMachineCore” /TR

”\”C:\Users\<USER>\Desktop\executable.exe\”” /SC ONLOGON /RL HIGHEST /F”

$s6 = “C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe” /svc”

$s7 = “C:\Windows\System32\svchost.exe -k NetworkService -p”

$s8 = “C:\Windows\system32\svchost.exe -k UnistackSvcGroup”

$s9 = “C:\Windows\system32\sppsvc.exe”

$s10 = “C:\Windows\system32\svchost.exe -k LocalService -s W32Time”

$s11 = “C:\Windows\system32\lsass.exe”

$s12 = “C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost”

$s13 = “C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p”

$s14 = “schtasks /create /tn ”MicrosoftEdgeUpdateTaskMachineCore”

$s15 = “IR_agent_single”

$s16 = “OneSettingQueryMutex+compat+encapsulation”

$s17 = “C:\Users\<USER>\AppData\Local\Temp\ir.log”

$s18 = “ir.log”

$s19 = “C:\Users\<USER>\AppData\Roaming\Microsoft\WindowsUpdate\wu_svc.exe ”

$s20 = “wu_svc.exe”

$s21 = “C:\Users\<USER>\AppData\Local\Temp\svchost_update.exe”

$s22 = “svchost_update.exe”

$s23 = “C:\ProgramData\win_services.exe”

$s24 = “IronRAT”

condition:

any of ($hash*) or 2 of ($s*)

}

Recommendations

• Establish an organization-wide endpoint security strategy covering malware prevention, detection, and response.
• Prioritize protection of sensitive credentials and business information stored or accessed from employee endpoints.
• Adopt layered security controls so that a single compromised endpoint does not provide prolonged access to organizational resources.
• Conduct periodic threat assessments to identify exposure to multi-purpose malware and similar information-stealing threats.

• Direct affected users to rotate passwords and confirm multi-factor enrollment as part of the response checklist.
• Ensure endpoint protection and security monitoring capabilities are consistently deployed across employee systems.
• Establish clear incident-response procedures for suspected malware infections, including isolation, investigation, and recovery.
• Provide regular security-awareness training focused on suspicious files, links, downloads, and unexpected system activity.
• Maintain appropriate controls over access to sensitive corporate information and user accounts.

• Hunt endpoints for unauthorized scheduled-task creations and alert on schtasks /create activity.
• Audit Run/RunOnce registry values and Startup-folder entries for unfamiliar items and remove anything created by this threat.
• Block delivery infrastructure such as ‘rat.ironrat.de5.net’ at DNS, proxy, and firewall level, and inspect egress logs for prior retrievals.
• Force password resets and revoke active sessions for users on affected systems; verify MFA coverage to blunt harvested-credential replay.
• Monitor endpoints for unusual PowerShell activity, unexpected process trees, and unauthorized changes to security settings.
• Block and monitor the infrastructure listed in the IOC section at DNS, proxy, and perimeter controls.
• Isolate confirmed cases promptly, then reset credentials and review autostart locations before restoration.

CYFIRMA’s Weekly Insights

1. Weekly Attack Types and Trends

• Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
• Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
• Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
• Ransomware – Qilin Ransomware, The Gentlemen Ransomware| Malware – IronRAT
• Qilin Ransomware– One of the ransomware groups.
• The Gentlemen Ransomware – One of the ransomware groups.
  Please refer to the trending malware advisory for details on the following:
• Malware – IronRAT
  Behavior – Most of these malwares use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

Lazarus Group Advances Social Engineering and macOS Malware Capabilities

• Threat Actor: Lazarus Group
• Attack Type: Botnet Operations, Malware Implant, DLL Injection Attacks, Direct IP-based C2 Communication, Impersonation, Obfuscation, Open Proxy Usage, Credential Stealing, Social Engineering Attack, Supply Chain Attacks, Ransomware Attacks, Cryptocurrency Theft, Exploitation of Vulnerabilities.
• Objective: Information theft, Cyber Espionage, Financial Gains, Credential Theft, Sabotage/Destruction.
• Suspected Target Technology: Windows, macOS, Linux, SAP Systems, Cryptocurrency Exchanges, Financial Platforms (including SWIFT), JetBrains TeamCity, Oracle Products, Dell Systems, Atlassian Confluence, Citrix NetScaler ADC/Gateway, GitHub and GitLab repositories, Microsoft Visual Studio Code.
• Suspected Target Geography: Argentina, Australia, Bangladesh, Belgium, Brazil, Brunei, Canada, Chile, China, Cyprus, Darussalam, Denmark, Ecuador, Estonia, France, Germany, Guatemala, Hong Kong, Hungary, India, Indonesia, Iran, Iraq, Ireland, Israel, Italy, Japan, Luxembourg, Malaysia, Malta, Mexico, Myanmar, Netherlands, New Zealand, Panama, Philippines, Poland, Romania, Russia, Saudi Arabia, Seychelles, Singapore, Slovenia, South Africa, South Korea, Spain, Sri Lanka, Sweden, Switzerland, Taiwan, Thailand, Turkey, Türkiye, Ukraine, United Arab Emirates, United Kingdom, United States, Vietnam
• Suspected Target Industries: Advertising Agencies, Aerospace & Defense, Air Transportation, Banking, Capital Markets, Communication Services, Computer Systems Design & Related Services, Cryptocurrency, Data Processing & Hosting, Defense, Diversified Financial Services, Educational Services, Energy, Entertainment, Financials, Government & Public Sector / Critical Infrastructure, Health Care, Information Services, Information Technology, Insurance, Media, Motor Vehicle Manufacturing, National Security, Public Administration, Software, Software Publishers, Space & Defense, Telecommunications, Utilities, Travel Agencies.
• Business Impact: Financial Loss, Data Theft, Operational Disruption, Reputational Damage.

About the Threat Actor

Lazarus Group is a highly sophisticated cyber threat actor assessed to be affiliated with the North Korean government and observed since at least 2009. The group is known as Hidden Cobra by the U.S. government, and its operators have been linked to Lab 110, a component of North Korea’s military intelligence apparatus, according to available reporting.

Lazarus Group is known for its ability to rapidly develop, modify, and evolve existing exploits and malware. Its operations have targeted a range of sectors, including cryptocurrency exchanges, with financial gains and cyber espionage among its suspected objectives.

The group’s historical targets include South Korean government and politically significant organizations, Bangladesh Bank, Sony Pictures Entertainment, and other U.S. organizations. Lazarus Group is also believed to encompass several subgroups, including Andariel, which primarily focuses on South Korean government and organizations, and Bluenoroff, which has been associated with financial theft and global espionage campaigns. Notable operations attributed to Lazarus Group include Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, Ten Days of Rain, the Sony Pictures Entertainment attack, SWIFT-related bank heists, and the WannaCry ransomware campaign.

UNC1069 is suspected of having infrastructure overlaps with Bluenoroff, a subgroup associated with Lazarus Group.

Details on Exploited Vulnerabilities

TTPs based on MITRE ATT&CK Framework

Tactic	ID	Technique
Reconnaissance	T1591	Gather Victim Org Information
Reconnaissance	T1591.004	Gather Victim Org Information: Identify Roles
Reconnaissance	T1589.002	Gather Victim Identity Information: Email Addresses
Reconnaissance	T1589	Gather Victim Identity Information
Reconnaissance	T1593.001	Search Open Websites/Domains: Social Media
Resource Development	T1587.001	Develop Capabilities: Malware
Resource Development	T1587.002	Develop Capabilities: Code Signing Certificates
Resource Development	T1583.001	Acquire Infrastructure: Domains
Resource Development	T1583.004	Acquire Infrastructure: Server
Resource Development	T1583.006	Acquire Infrastructure: Web Services
Resource Development	T1584.001	Compromise Infrastructure: Domains
Resource Development	T1584.004	Compromise Infrastructure: Server
Resource Development	T1585.001	Establish Accounts: Social Media Accounts
Resource Development	T1585.002	Establish Accounts: Email Accounts
Resource Development	T1588.002	Obtain Capabilities: Tool
Resource Development	T1588.003	Obtain Capabilities: Code Signing Certificates
Resource Development	T1588.004	Obtain Capabilities: Digital Certificates
Resource Development	T1608.001	Stage Capabilities: Upload Malware
Resource Development	T1608.002	Stage Capabilities: Upload Tool
Initial Access	T1189	Drive-by Compromise
Initial Access	T1566.001	Phishing: Spear phishing Attachment
Initial Access	T1566.002	Phishing: Spear phishing Link
Initial Access	T1078	Valid Accounts
Initial Access	T1566.003	Phishing: Spear phishing via Service
Execution	T1059.001	Command and Scripting Interpreter: PowerShell
Execution	T1053.005	Scheduled Task/Job: Scheduled Task
Execution	T1106	Native API
Execution	T1204.001	User Execution: Malicious Link
Execution	T1204.002	User Execution: Malicious File
Execution	T1203	Exploitation for Client Execution
Execution	T1059.003	Command and Scripting Interpreter: Windows Command Shell
Execution	T1047	Windows Management Instrumentation
Execution	T1059.005	Command and Scripting Interpreter: Visual Basic
Execution	T1574.001	Hijack Execution Flow: DLL
Execution	T1574.013	Hijack Execution Flow: KernelCallbackTable
Persistence	T1505.004	Server Software Component: IIS Components
Persistence	T1542.003	Pre-OS Boot: Bootkit
Persistence	T1543.003	Create or Modify System Process: Windows Service
Persistence	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Persistence	T1078	Valid Accounts
Persistence	T1098	Account Manipulation
Persistence	T1547.009	Boot or Logon Autostart Execution: Shortcut Modification
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1053.005	Scheduled Task/Job: Scheduled Task
Privilege Escalation	T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	T1098	Account Manipulation
Privilege Escalation	T1547.009	Boot or Logon Autostart Execution: Shortcut Modification
Privilege Escalation	T1543.003	Create or Modify System Process: Windows Service
Privilege Escalation	T1055.001	Process Injection: Dynamic-link Library Injection
Privilege Escalation	T1078	Valid Accounts
Privilege Escalation	T1134.002	Access Token Manipulation: Create Process with Token
Stealth	T1134.002	Access Token Manipulation: Create Process with Token
Stealth	T1542.003	Pre-OS Boot: Bootkit
Stealth	T1218	System Binary Proxy Execution
Stealth	T1218.005	System Binary Proxy Execution: Mshta
Stealth	T1218.010	System Binary Proxy Execution: Regsvr32
Stealth	T1218.011	System Binary Proxy Execution: Rundll32
Stealth	T1620	Reflective Code Loading
Stealth	T1070	Indicator Removal
Stealth	T1070.003	Indicator Removal: Clear Command History
Stealth	T1070.004	Indicator Removal: File Deletion
Stealth	T1202	Indirect Command Execution
Stealth	T1036.003	Masquerading: Rename Legitimate Utilities
Stealth	T1036.004	Masquerading: Masquerade Task or Service
Stealth	T1036.005	Masquerading: Match Legitimate Resource Name or Location
Stealth	T1036.008	Masquerading: Masquerade File Type
Stealth	T1027.002	Obfuscated Files or Information: Software Packing
Stealth	T1027.007	Obfuscated Files or Information: Dynamic API Resolution
Stealth	T1027.009	Obfuscated Files or Information: Embedded Payloads
Stealth	T1027.013	Obfuscated Files or Information: Encrypted/Encoded File
Stealth	T1220	XSL Script Processing
Stealth	T1497.003	Virtualization/Sandbox Evasion: Time Based Evasion
Stealth	T1622	Debugger Evasion
Stealth	T1140	Deobfuscate/Decode Files or Information
Stealth	T1055.001	Process Injection: Dynamic-link Library Injection
Stealth	T1564.001	Hide Artifacts: Hidden Files and Directories
Stealth	T1070.006	Indicator Removal: Timestomp
Stealth	T1684.001	Social Engineering: Impersonation
Stealth	T1221	Template Injection Authentication Process: Conditional Access Policies
Stealth	T1574.001	Hijack Execution Flow: DLL
Stealth	T1574.013	Hijack Execution Flow: KernelCallbackTable
Stealth	T1497.001	Virtualization/Sandbox Evasion: System Checks
Stealth	T1078	Valid Accounts
Defense Impairment	T1686.003	Disable or Modify System Firewall: Windows Host Firewall
Defense Impairment	T1685	Disable or Modify Tools
Defense Impairment	T1553.002	Subvert Trust Controls: Code Signing
Credential Access	T1056.001	Input Capture: Keylogging
Credential Access	T1110.003	Brute Force: Password Spraying
Credential Access	T1110	Brute Force
Credential Access	T1557.001	Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay
Discovery	T1083	File and Directory Discovery
Discovery	T1057	Process Discovery
Discovery	T1497.001	Virtualization/Sandbox Evasion: System Checks
Discovery	T1497.003	Virtualization/Sandbox Evasion: Time Based Evasion
Discovery	T1087.002	Account Discovery: Domain Account
Discovery	T1010	Application Window Discovery
Discovery	T1046	Network Service Discovery
Discovery	T1622	Debugger Evasion
Discovery	T1082	System Information Discovery
Discovery	T1012	Query Registry
Discovery	T1614.001	System Location Discovery: System Language Discovery
Discovery	T1016	System Network Configuration Discovery
Discovery	T1049	System Network Connections Discovery
Discovery	T1033	System Owner/User Discovery
Discovery	T1680	Local Storage Discovery
Discovery	T1124	System Time Discovery
Lateral Movement	T1021.002	Remote Services: SMB/Windows Admin Shares
Lateral Movement	T1021.001	Remote Services: Remote Desktop Protocol
Lateral Movement	T1021.004	Remote Services: SSH
Lateral Movement	T1534	Internal Spear Phishing
Collection	T1056.001	Input Capture: Keylogging
Collection	T1560	Archive Collected Data
Collection	T1560.001	Archive Collected Data: Archive via Utility
Collection	T1560.002	Archive Collected Data: Archive via Library
Collection	T1056.001	Input Capture: Keylogging
Collection	T1005	Data from Local System
Collection	T1074.001	Data Staged: Local Data Staging
Command and Control	T1071.001	Application Layer Protocol: Web Protocols
Command and Control	T1571	Non-Standard Port
Command and Control	T1132.001	Data Encoding: Standard Encoding
Command and Control	T1001.003	Data Obfuscation: Protocol or Service Impersonation
Command and Control	T1573.001	Encrypted Channel: Symmetric Cryptography
Command and Control	T1090.001	Proxy: Internal Proxy
Command and Control	T1090.002	Proxy: External Proxy
Command and Control	T1104	Multi-Stage Channels
Command and Control	T1008	Fallback Channels
Command and Control	T1105	Ingress Tool Transfer
Command and Control	T1102.002	Web Service: Bidirectional Communication
Exfiltration	T1041	Exfiltration Over C2 Channel
Exfiltration	T1567.002	Exfiltration Over Web Service: Exfiltration to Cloud Storage
Exfiltration	T1048.003	Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
Impact	T1561.001	Disk Wipe: Disk Content Wipe
Impact	T1561.002	Disk Wipe: Disk Structure Wipe
Impact	T1489	Service Stop
Impact	T1485	Data Destruction
Impact	T1529	System Shutdown/Reboot
Impact	T1491.001	Defacement: Internal Defacement

Latest Developments Observed

The threat actor is suspected of targeting job seekers in the cryptocurrency and technology sectors through a fake job description impersonating a prominent organization. The campaign leverages a PDF-disguised Mach-O executable to infect macOS systems running on both Intel and Apple Silicon architectures. The malware initiates a multi-stage infection involving the FinderFontsUpdater process and the safarifontsagent installer, which connects to a remote server to retrieve additional malicious files. The activity appears aimed at gaining access to targeted systems and potentially compromising sensitive information through social engineering.

ETLM Insights

Lazarus Group continues to demonstrate an adaptive and financially motivated operational model, leveraging targeted social engineering and evolving malware capabilities to compromise individuals and organizations across the cryptocurrency and technology sectors. Its recent macOS-targeted campaign highlights the use of deceptive job offers, executable files disguised as legitimate documents, and multi-stage infection mechanisms to facilitate initial access and potentially compromise sensitive information.

Looking ahead, Lazarus Group is likely to continue refining its social engineering techniques and macOS-targeted malware capabilities to improve initial access and expand opportunities for sensitive information theft. The continued use of trusted job-related lures and multi-stage infection mechanisms may enable the group to reach specialized professionals and maintain effective access to targeted environments.

YARA Rules

rule ETLM_Suspicious_Infrastructure_And_Malware_Indicators

{

meta:

description = “Detects files containing supplied suspicious infrastructure, CVE, and malware-related indicators”

author = “CYFIRMA” date = “2026-10-20”

category = “Threat Intelligence” reference = “Supplied ETLM indicators”

confidence = “Indicator-based; requires validation”

strings:

// Exploit hosting infrastructure

$ip1 = “51.81.171.234” ascii

$ip2 = “142.44.247.41” ascii

$ip3 = “35.179.229.71” ascii

$ip4 = “154.37.213.27” ascii

$ip5 = “170.231.237.214” ascii

$ip6 = “196.189.236.67” ascii

// Suspected domains

$domain1 = “img.worksongo.store” ascii nocase

$domain2 = “img.socialteams.store” ascii nocase

$domain3 = “img.responsive.pstatic.autos” ascii nocase

$domain4 = “img.darklights.store” ascii nocase

$domain5 = “img.smartnords.site” ascii nocase

$domain6 = “img.monderhouse.space” ascii nocase

// CVE references

$cve1 = “CVE-2022-22965” ascii nocase

$cve2 = “CVE-2021-44228” ascii nocase

// File and malware-related indicators

$type1 = “win32 dll” ascii nocase

$type2 = “win32 exe” ascii nocase

$type3 = “office open xml spreadsheet” ascii nocase

$path1 = “c:\windows\wn4c3x.exe” ascii nocase

condition:

any of ($ip*) or

any of ($domain*) or any of ($cve*) or any of ($type*) or

$path1

}

Recommendations

• Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
• Establish comprehensive identification and prioritization of cyber risks associated with third-party vendors and services through periodic risk assessments, vulnerability assessments, and system reviews.
• Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more by identifying such patterns.

• Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in-line prompts to help educate users.
• Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.
• Strengthen boundary defense such as network segmentation and have a strong access management capability in line with the Principle of Least Privilege (POLP) that can assist in mitigating cyberattacks.

• For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
• Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
• Apply security measures to detect unauthorized activities, protect sensitive production, and process control systems from cyberattacks.
• Add the YARA rules for threat detection and monitoring, which will help detect anomalies in log events and identify and monitor suspicious activities.

3. Major Geopolitical Developments in Cybersecurity

Sabotage of French supermarket cold chains

On the night of 11 October, a coordinated cyberattack hijacked internet-connected refrigeration controllers across hundreds of French supermarkets, forcing fridges and freezers into a continuous defrost cycle that pushed internal temperatures as high as 50°C for roughly six hours. Les Mousquetaires (Intermarché and Netto), Coopérative U, Carrefour Market, Monoprix and E.Leclerc all reported affected stores – estimates range from 250 to over 400 outlets – with Intermarché instructing its stores to discard all affected fresh and frozen stock. Electronic shelf labels and deliveries were also disrupted, and at least one fire was reported.

Prime Minister Sébastien Lecornu tasked ANSSI with the investigation and with coordinating with other European governments, while the Paris prosecutor’s office opened a criminal inquiry. Investigators identified legacy Danfoss AK-SM 800 and AK-SC 355 refrigeration managers as the common attack surface; Danfoss stated that the compromised units were running outdated firmware it no longer supports. Claroty’s Team82 had disclosed exploitable flaws in the AK-SM 800A line in 2025, and CISA issued its own advisory on the product family. No group has claimed responsibility and no ransom demand has been made.

ETLM Assessment:

This is the most significant cyber-physical attack on European civilian infrastructure this year, and the absence of extortion or data theft is the tell. Pure destruction with no financial motive, synchronised across competing retailers via a shared OT vendor, is the hallmark of state-directed hybrid warfare rather than cybercrime – the same supply-chain logic the Russian GRU applied in the 2017 NotPetya campaign and that Russian-aligned hacktivists have used against water and energy OT in Poland, Denmark and the US since 2022. France remains the Western European state most consistently singled out for Russian hybrid activity (train sabotage before the 2024 Olympics, disinformation on Moldova and the Sahel, and the Dutch and German expulsions of Russian intelligence officers this year). The attack is also a proof of concept with transferable lessons: legacy, internet-exposed OT controllers managed by third-party contractors rather than the end customer sit beneath every commercial cold chain, hospital pharmacy, and food-distribution network in Europe. Expect ANSSI and ENISA to push OT exposure mandates under NIS2, and expect copycat attempts against the same Danfoss and Copeland product families elsewhere.

US dismantles North Korean laptop farms in Texas

The US Department of Justice announced charges against 14 individuals – two Americans and ten Chinese nationals among them – and the seizure of roughly 187 laptops and KVM devices in its latest action against North Korea’s fraudulent remote IT worker programme. Under “Operation Lonestar Roundup”, the FBI searched more than

40 residences across Texas between 21 and 25 September that were known or suspected to be “laptop farms”, where US-based facilitators host employer-issued computers so DPRK operatives can work them remotely while appearing to be inside the United States.

A separate indictment unsealed in the Northern District of Ohio describes a scheme running from 2019 to July 2025 that placed North Korean workers at more than 70 US companies in healthcare, telecoms, retail and manufacturing across 17 states, generating around $3 million that was routed to sanctioned DPRK entities. Michael James Bostelle of Philadelphia and Juan Cecilio Pena Carrillo of San Juan, Texas, were arrested on wire fraud, money laundering, and identity theft charges. CrowdStrike, which assisted the investigation, tracks the network as Famous Chollima.

ETLM Assessment:

Famous Chollima (also tracked as WageMole, PurpleDelta and Jasper Sleet) is a revenue-generation arm of the DPRK’s Reconnaissance General Bureau and Munitions Industry Department that has shifted from a side-hustle into one of Pyongyang’s most reliable hard-currency streams: US Treasury estimates it moved more than $800 million to the regime in fiscal year 2024, with 85–90% of salaries remitted directly to the state. The strategic point is that the threat is now dual-use. What began as sanctions evasion to fund the missile programme increasingly provides persistent insider access to Western corporate networks, and CrowdStrike attributes roughly half of all hands-on-keyboard intrusions it documented over the past year to DPRK actors, with extortion of former employers a growing pattern. This week’s action is the fifth under DOJ’s “DPRK RevGen: Domestic Enabler” initiative since June 2025, and the operational detail matters: the workers now pay Americans to front for them, subcontract real coding work to freelancers in South Asia and West Africa, and have begun spoofing device hardware hashes to mask KVM-over-IP tools. Disruptions of individual farms are temporary – the model is cheap to rebuild – but prosecuting the domestic facilitators raises the cost of the one element Pyongyang cannot supply itself: a trustworthy US address and identity.

Kazakhstan-linked hackers target Russian refinery and city government

A joint report from Cisco Talos and Recorded Future’s Insikt Group attributes the Central Asian espionage cluster “Silent Lynx” (also UAT-6275 / TAG-193) to operators likely based in Kazakhstan, assessed at medium confidence. Earlier this year, the group targeted the Orsknefteorgsintez oil refinery in southern Russia – roughly 25 km from the Kazakh border and taken offline for months by Ukrainian drone strikes in August – and compromised the municipal network of Nizhny Novgorod. Researchers also found a Tajik government agency beaconing to Silent Lynx infrastructure as Kazakhstan’s parliament ratified an allied-relations treaty with Tajikistan, and a Belarusian agency compromised ahead of April talks between Belarusian and Kazakh diplomats.

Attribution rests on malware samples uploaded from Kazakhstan within seconds of compilation, administration of command-and-control servers from Kazakh-geolocated VPN exits exclusively during local weekday office hours, and a targeting pattern that consistently aligns with Astana’s diplomatic and economic calendar. The group relies on spear-phishing from hijacked official email accounts, lures impersonating regional energy firms, and increasingly sophisticated custom tooling. None of the governments involved responded to requests for comment.

ETLM Assessment:

Silent Lynx is a rare, documented case of a post-Soviet state – and a nominal Russian treaty ally in the CSTO and EAEU – running offensive cyber collection against Moscow, and it reflects how Russia’s war in Ukraine has reshaped Central Asian threat perceptions. Kazakhstan has visibly hedged since 2022, refusing to recognise the annexed Ukrainian territories, enforcing some Western sanctions and diversifying export routes away from Russian pipelines; the refinery targeting follows directly from Moscow’s requests to tap Kazakh refining capacity to cover drone-induced shortfalls, and Nizhny Novgorod’s position on the Volga touches on water security for the Caspian basin that Kazakhstan depends on. The broader signal is the democratisation of state cyber espionage: middle powers with modest budgets can now field credible APT capabilities, and the previous assumption that the CRINK bloc plus the Five Eyes defines the nation-state threat landscape no longer holds. For Russia, it adds a second front of intelligence pressure on energy infrastructure already under kinetic attack; for Western analysts, it is a reminder that attribution frameworks built around four adversaries will increasingly miss activity from aligned and non-aligned states pursuing their own interests.

4. Rise in Malware/Ransomware and Phishing

Qilin Ransomware Impacts a Business Services Company from Japan

• Attack Type: Ransomware
• Target Industry: Business Services
• Target Geography: Japan
• Ransomware: Qilin Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:

CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Japan was compromised by Qilin Ransomware. The compromised company is a Japanese real estate investment and asset management group established on February 4, 2004. The company operates through three principal business segments: investment banking, investment management, and facility operation, including hotels and traditional Japanese inns. Its investment activities also cover renewable energy, private equity, venture capital, and corporate advisory services. The compromised data appears to include confidential financial and business records, accounting spreadsheets, financial statements, transaction and payment records, invoices, expense details, and tabular financial reports. The exposed documents also appear to contain business correspondence, internal administrative records, and Japanese-language business documents that may include sensitive contractual or operational information. Several images show structured financial tables with numerical entries, dates, and other business-related details. The exposure of these records could potentially reveal financial performance, transaction history, internal business processes, and confidential commercial information.

• The Qilin Ransomware group operates a Ransomware-as-a-Service (RaaS) model, allowing affiliates to carry out attacks while Qilin provides infrastructure and malware tools.
• The Qilin Ransomware group primarily targets countries such as the United States of America, Canada, Germany, the United Kingdom, and France.
• The Qilin Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Real Estate & Construction, Consumer Goods & Services, and Healthcare.
• Based on the Qilin Ransomware victims list from 1st Jan 2026 to 20th October 2026, the top 5 Target Countries are as follows:
• The Top 10 Industries most affected by the Qilin Ransomware group victims list from 1st Jan 2026 to 20th October 2026 are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and a focus on speed and evasion, make it a particularly dangerous actor.

The Gentlemen Ransomware Impacts a Manufacturing Company from Thailand

• Attack Type: Ransomware
• Target Industry: Manufacturing
• Target Geography: Thailand
• Ransomware: The Gentlemen Ransomware
• Objective: Data Theft, Data Encryption, Financial Gains
• Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary: CYFIRMA observed on a ransomware data leak site (DLS) on the dark web that a company from Thailand was compromised by The Gentlemen Ransomware. The compromised company is a Thai paper manufacturing and recycling company. The company’s operations include printing paper, newsprint, and sanitary tissue manufacturing, supported by a production facility in Sing Buri province. The data, which has been breached, has not yet appeared on the leak site, indicating that negotiations between the affected party and the ransomware group may be underway. The compromised data includes confidential and sensitive information belonging to the organization.

• The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
• The Gentlemen Ransomware group primarily targets countries such as the United States of America, France, Thailand, India, and Italy.
• The Gentlemen Ransomware group primarily targets industries, including Manufacturing, Professional Goods & Services, Consumer Goods & Services, Information Technology, and Healthcare.
• Based on the Gentlemen Ransomware victims list from 1st Jan 2026 to 20th October 2026, the top 5 Target Countries are as follows:
• The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2026 to 20th October 2026 are as follows:

ETLM Assessment:

According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploits

Vulnerability in BeyondTrust Remote Support

• Attack Type: Vulnerabilities & Exploits
• Target Technology: Remote Support Platform
• Vulnerability: CVE-2026-102764
• CVSS Base Score: 9.8 Source
• Vulnerability Type: Authentication Bypass by Spoofing
• Summary: The vulnerability allows a remote attacker to perform unauthorized file operations on an affected BeyondTrust Remote Support appliance.

Relevancy & Insights:

The vulnerability exists due to improper validation of message origins in the internal messaging components of BeyondTrust Remote Support when processing incoming messages.

Impact:

A remote attacker can spoof the origin of messages to perform unauthorized file operations on the appliance.

Note:

The vulnerability is being actively exploited in the wild.

Affected Products:

https[:]//www[.]beyondtrust[.]com/trust-center/security-advisories/bt26-05

Recommendations:

Monitoring and Detection: Monitor application and operating system logs for suspicious commands. Cloud editions have been updated; Standard and Customized edition customers should contact Openfind for the applicable security update or version-specific patch.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK

This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment:

The vulnerability in BeyondTrust Remote Support presents a critical security risk to organizations using the affected enterprise remote support platform. The improper origin validation flaw allows a remote unauthenticated attacker to perform unauthorized file operations, including arbitrary file uploads, potentially leading to system compromise, credential exposure, and unauthorized access to internal networks. Active exploitation has been confirmed, with the suspected China-linked threat actor ARMORY CASTLE (formerly UNC5221) reportedly exploiting the vulnerability as a zero-day to gain unauthorized access and establish persistent control over affected appliances. Organizations using vulnerable versions should prioritize applying the vendor-provided BT26-05-RS security patch, restrict unnecessary external access to remote support interfaces, and monitor appliance logs for suspicious activities. Prompt remediation and continuous monitoring are recommended to reduce the risk of unauthorized access, credential compromise, lateral movement, and disruption of business operations.

6. Latest Cyber-Attacks, Incidents, and Breaches

Orova Ransomware attacked and published the data of a Manufacturing company from Taiwan

• Threat Actor: Orova Ransomware
• Attack Type: Ransomware
• Objective: Data Leak, Financial Gains
• Target Technology: Web Applications
• Target Industry: Manufacturing
• Target Geography: Taiwan
• Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:

Recently, we observed that Orova Ransomware attacked and published the data of a Manufacturing company from Taiwan on its dark web website. The Taiwanese manufacturing company specializes in aluminum and magnesium alloy die-casting, precision tooling, and metal-component manufacturing. Its products serve automotive, computer hardware, telecommunications, and other industrial applications. The company also provides secondary manufacturing services, including CNC machining, drilling, surface finishing, coating, and related processing. The compromised data appears to include confidential manufacturing and engineering documents, technical drawings, mold and component design diagrams, aluminum and magnesium alloy casting specifications, production and assembly documentation, quality inspection records, and detailed manufacturing process sheets. The exposed files also appear to contain business correspondence, administrative documents, tabular records, and technical reports related to component development and production improvements. These materials could reveal proprietary engineering designs, manufacturing workflows, product specifications, quality-control procedures, and sensitive operational information. The Total size of the compromised data is approximately 108.86 GB.

• Orova Ransomware is an emerging, financially motivated cybercriminal operation that reportedly uses a dedicated data leak site (DLS) to pressure victims through data extortion and threats to publish stolen information. Its reported capabilities include encrypting files on Linux systems and targeting VMware ESXi hypervisors.
• The Orova Ransomware group has reportedly affected organizations across multiple countries and industries, including Manufacturing, Healthcare, Information Technology, Hospitality, Energy, and Professional Services. Its reported activities include virtual machine disruption and file encryption, while the extent of data theft and the initial access methods may vary between incidents.

ETLM Assessment:

According to CYFIRMA’s assessment, Orova represents an emerging, financially motivated ransomware and data-extortion threat that reportedly targets Linux environments and VMware ESXi hypervisors. The operation employs file-encryption capabilities and is associated with a data leak site used to pressure victims through threats of publishing stolen information. Its reported ability to disrupt virtual machines and encrypt critical data highlights the importance of securing hypervisor management interfaces, enforcing strong identity and access controls, maintaining immutable backups, continuously monitoring suspicious system activity, and promptly remediating vulnerabilities to detect, contain, and mitigate potential ransomware attacks. Further investigation is required to establish the group’s initial access methods, the extent of data exfiltration, and the technical details of individual incidents.

7. Data Leaks

Unauthorised E-Commerce Customer Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: E-Commerce / Retail
• Target Geography: Saudi Arabia, Kuwait, Qatar, Bahrain, and the United Arab Emirates (UAE)
• Objective: Financial Gains
• Business Impact: Exposure of Personally Identifiable Information (PII), Customer Privacy Risks, Identity Theft, Phishing and Social Engineering, Financial Fraud, Regulatory Compliance Concerns, Financial Loss, and Reputational Damage

Summary

The CYFIRMA research team identified a post on a cybercrime forum advertising the sale of a large customer database allegedly associated with a major Middle Eastern e-commerce platform. According to the forum advertisement, the seller claims to possess more than 27 million customer records spanning Saudi Arabia, Kuwait, Qatar, Bahrain, and the United Arab Emirates. The advertisement includes screenshots of an order-management interface as purported evidence of possession and offers the complete database for sale at an advertised price of USD 10,000.

Based on the information visible in the forum post and the accompanying screenshots, the allegedly exposed dataset may include:

• Customer names and full names
• Customer email addresses
• Mobile phone numbers
• Billing names and billing-related information
• Shipping addresses and geographical details
• Purchase dates and order-related timestamps
• E-commerce order and transaction records
• Customer account and order-management information
• Regional customer records associated with multiple Middle Eastern markets
• Additional customer and commercial information stored in the underlying database

The authenticity and provenance of the advertised dataset remain unverified at the time of reporting. This assessment is based solely on the information displayed in the cybercrime forum advertisement and its accompanying screenshots; the alleged compromise and the full scope of the exposed records have not been independently confirmed.

Unauthorised Online Marketplace Database Advertised on a Leak Site

• Attack Type: Data Leak
• Target Industry: E-commerce / Online Marketplace
• Target Geography: Japan
• Objective: Financial Gains
• Business Impact: Exposure of Personally Identifiable Information (PII), Account Privacy Risks, Fraud and Social Engineering, Financial Loss, Regulatory Compliance Concerns, and Reputational Damage.

Summary: The CYFIRMA research team identified a post on a cybercrime forum that advertises a database allegedly associated with a major Japanese consumer-to-consumer online marketplace. The listing presents sample records and describes the dataset as marketplace account and activity information. The post is dated 15 October 2026 and claims the data is available for sale. The advertised information appears to include customer or seller profile details, contact information, location fields, account status, and transaction-related activity. These claims have not been independently verified.

Based on the fields visible in the forum post, the allegedly exposed dataset may include:

• User or account identifiers
• Full names and email addresses
• Contact phone numbers
• Street addresses, cities, postal codes, and regional information
• Official city and town administrative fields
• Country and currency information
• Account status and account creation dates
• Snapshot dates and account activity start/end dates
• Listing counts, including active and withdrawn listings
• Pending, completed, and cancelled sales
• Seller fees and seller proceeds, represented as minor currency units
• Pending, completed, and cancelled purchases
• Purchase spending information
• Last-activity timestamps

The authenticity and completeness of the advertised dataset remain unverified at the time of reporting. This assessment is based on the information and sample fields visible in the forum advertisement and should not be interpreted as independent confirmation of a breach.

Relevancy & Insights:

Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:

The threat actor is assessed as an active and capable cybercriminal entity primarily involved in data-leak and information-extortion activities, with multiple indications of unauthorized access to systems and the subsequent dissemination or sale of compromised data through underground forums. Their activities demonstrate the evolving sophistication of organized cybercriminal networks and highlight the increasing risk of sensitive information being exploited for financial gain, fraud, and follow-on attacks. Organizations should strengthen their cybersecurity posture through continuous monitoring, proactive threat intelligence, robust access controls, enhanced data protection, and timely defensive measures to safeguard sensitive information and critical infrastructure.

Recommendations: Enhance the cybersecurity posture by:

1. Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.

2. Ensure proper database configuration to mitigate the risk of database-related attacks.

3. Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a post published on a cybercrime forum claiming that an unauthorized party has breached a major media and entertainment organization and obtained internal corporate information. The forum post advertises the alleged compromise and displays sample documents as proof of possession. The material shown in the screenshot appears to include film and television production records, tax-credit documentation, financial information, customer relationship management (CRM) data, and internal access or audit records. The claims and the extent of the alleged compromise have not been independently verified.

Based on the information visible in the forum post, the allegedly exposed data may include:

• Unannounced film projects, untitled pilots, and production slate information
• Locked production budgets and monthly cost worksheets
• Cost-per-episode (CPA) engagement letters and related production documentation
• Film tax-credit applications, certificates, eligibility records, and conditional approvals
• Budget sign-offs, approved budgets, and auditor reports relating to claims
• Tax returns, objections, refund confirmations, and wire confirmations
• Grant and loan agreements, including state and international filings
• CRM records, including accounts, contacts, leads, opportunities, cases, users, notes, tasks, and campaigns
• Legal entity records, talent roles, projects, seasons, series, deals, months, and quarters
• Production audit records, cost verification audits, PFE requests, IATSE prorations, and WBS elements
• PDF files, accounting spreadsheets, SAP general ledger exports, tax-credit ledgers, FX journals, ZIP archives, and Word documents
• Banking information, including IBANs, account numbers, and routing numbers reportedly present in email content
• SAP balance details, cost elements, and ledger records
• CPA fee ledgers, domestic and international tax-credit records, tax-credit attachment records, and year/quarter rollups
• Login records containing source IP addresses, administrator change logs, record history, group memberships, permission sets, and profiles

The screenshots included in the advertisement appear to show sample documentation associated with film commissions, tax-credit applications, production budgets, and related administrative or financial processes. The post claims that the displayed material demonstrates access to internal records; however, the screenshot alone does not establish the authenticity, completeness, or

If verified, exposure of this information could create significant risks for the organization and its business partners. Unreleased production details and project schedules could be used for unauthorized disclosure or competitive advantage. Financial, tax-credit, and banking records could support fraud, payment diversion, business email compromise (BEC), and targeted social engineering. CRM data and employee or talent-related records could enable spear-phishing and impersonation, while access logs, permission details, and configuration-related information could assist follow-on intrusion attempts. Exposure of production and contractual documentation may also create intellectual property, legal, and reputational consequences.

This assessment is based solely on the supplied screenshot of a cybercrime forum post. The allegations, data origin, volume of exposed information, and extent of any compromise remain unverified and have not been independently confirmed.

RECOMMENDATIONS

• Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
• Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
• Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
• Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response plan.
• Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

• Take advantage of global Cyber Intelligence, providing valuable insights on threat actor activity, detection, and mitigation techniques.
• Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions, remediations, and lessons learned.
• Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM solutions.
• Ensure that detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies should be continuously evolved to keep up with refined ransomware threats.

• Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
• Consider using security automation to speed up threat detection, improved incident response, increased visibility of security metrics, and rapid execution of security checklists.
• Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence provided.
• Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
• Implement a combination of security controls, such as reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
• Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.