CYFIRMA Research

#CYFIRMAResearch is thrilled to share insights on the active #APT Star Blizzard. Stay ahead with insights on Star Blizzard's motives, targeted industries, targeted countries, and TTPs. #StarBlizzard #CyberSecurity #CYFIRMA #threatintelligence #campaign #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/adversa…

In 2019, 40% of detections were malware-free. Today it’s 82%. #CYFIRMA predicted that fewer than 10–15% of cases will need malware reverse-engineering. 90%+ of attribution will come from identity, cloud, and infrastructure telemetry, and Malware becoming disposable loader logic. Prediction 7 of the CYFIRMA Threat Horizon Series Q3 says: 82% of detections were malware-free in the latest Global Threat Report; 52% of intrusions detected internally, up from 43% (CrowdStrike / M-Trends). AI-agent-triggered detection produced 2.5x more threat leads than manual hunting (CrowdStrike Threat Hunting Report, Aug ‘26). #ThreatIntelligence #IncidentResponse #DFIR #CloudSecurity #CyberSecurity #CISO #ThreatHorizonSeries cyfirma.com/research/threat-…

#CYFIRMA’s latest research examines the evolving #cyberthreat landscape affecting India’s #healthcare and #pharmaceutical ecosystem in 2026. Key findings include: 20 healthcare #ransomware victim entries recorded during January–August 2026. #Databreach and #dataleak observations were prominent in the monitored dataset. #APT-associated observations, #darkweb listings, and #Telegram claims highlight potential risks. #Thirdparty exposure, #vulnerability exploitation, #phishing, and potential #intellectualproperty theft remain important areas of concern. #ThreatIntelligence #CyberSecurity #HealthcareSecurity #PharmaSecurity #IndiaCyberSecurity #ThreatLandscape2026 cyfirma.com/research/india-h…

#AI is changing the financial fraud landscape, making #impersonation more convincing and #cyberthreats more difficult to detect. For #India’s #Banking, #FinancialServices and #Insurance (#BFSI) sector, the convergence of AI-enabled fraud and external cyber exposure presents growing challenges. #CYFIRMA #CyberSecurity #ThreatIntelligence #FinancialFraud #ArtificialIntelligence #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/ai-driv…

PHP2Shell update: the DPRK-nexus campaign has moved from planning to active scanning. CYFIRMA has issued Version 3 of its Early Warning advisory on PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS v4.0 9.2 — unauthenticated RCE in the PHP runtime itself). What’s new since our 22–23 October reporting: 🔴 The operators report a filtered target set of 216 internet-facing hosts that still advertise unpatched PHP — across the US, Japan, South Korea, Thailand, Indonesia, Taiwan, Australia, India, Singapore, UAE, Saudi Arabia and the EU, with government, financial services, logistics, aviation, manufacturing and online transaction platforms prioritised. 🔴 Active weakness checks are being run from a separate set of 21 compromised nodes, deliberately low-volume and paced to stay under rate-based alerting. Roughly a third of the target set had already been touched at the time of collection. 🔴 CYFIRMA observed the same 21 addresses performing web-shell tooling and upload-progress session-poisoning attempts in the hours before this update. They are now published as blocking indicators alongside the 17 source IPs from Version 2. What to do now: ✅ Patch to PHP 8.5.12+ / 8.4.27+ / 8.3.36+ / 8.2.35+ and restart every worker — a reload leaves the stale state in place. ✅ Hosts still bannering an older PHP version are exactly what the operators kept on their list. Isolate what you can’t patch within hours; Apache mod_php first. ✅ Hunt back to 17 October across extended time windows — this scanning is designed not to trip volume alerts. No launch date has been stated. The next adversary milestone is their shortlist of highest-confidence hosts. The channel remains under continuous monitoring, and the advisory will be re-issued on any launch statement or confirmed exploitation. #PHP2Shell #ThreatIntelligence #EarlyWarning #Lazarus #DPRK #CVE2026109618 #CVE2026109619 #CYFIRMA #DecodingThreats #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/cyfirma…

#PHP2Shell is about to go from opportunistic to targeted. #CYFIRMA has surfaced a #Korean-speaking threat actor, assessed with moderate confidence to be linked to the #Lazarus ecosystem, coordinating sector- and country-prioritised exploitation of the two critical #PHP runtime flaws known as PHP2Shell (#CVE2026109618 / #CVE2026109619, CVSS v4.0 9.2, unauthenticated #RCE). What makes this different from the scanning everyone is already seeing: ▪️ Deliberate targeting: government and financial institutions first, then logistics, ports, airports, and manufacturing ▪️ Priority geographies: US, Japan, Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU ▪️ Disciplined tradecraft: public PoCs ranked with a local AI model, lab-validated before use, no noisy scanning ▪️ 15 pieces of staging infrastructure already shared; first filtered target list due by 25 October The flaw sits in the PHP runtime itself, not in any CMS or framework, so updating WordPress, Drupal, Magento, or Laravel does not fix it. One multipart POST can reach code execution before any application code runs. What to do now: ✅ Patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart every worker (a reload is not enough) ✅ Isolate anything you cannot patch within hours; Apache mod_php first ✅ Hunt back to 17 October 2026 ✅ Deploy the IOCs, Sigma and YARA content in the report Full advisory (TLP: CLEAR) with 33 IOCs, detection rules, and interim controls. #CyberSecurity #ThreatIntelligence #DPRK #CYFIRMA #CYFIRMA #ExternalThreatLandscapeManagement #ETLM cyfirma.com/research/cyfirma…

In January, we said #AI would make attacks cheaper, faster, and more reliable. Nine months on, 82.6% of #phishing emails are written by a machine. Latest data from Prediction 6 of this #CYFIRMA Series says: AI-driven attacks up by 56% year on year; 1 in 4 organisations hit; roughly $1M added to the cost of a breach (IBM Cost of a Data Breach, Jul ‘26). The first in-the-wild zero-day exploit believed to be AI-developed (Google Threat Intelligence Group, May ‘25). #AISecurity #ThreatIntelligence #CyberSecurity #CISO cyfirma.com/research/crystal…

The next gap in your #AI agent’s security model may not be in its tool list. #CYFIRMA’s new report, “Shadow Channels,” examines three architectural gaps that reviews what declared tools and permissions can miss. 1. Trace Drain: Observability pipelines capture prompts, completions, and tool arguments as part of normal operation. Could a trusted telemetry path become a quieter route for data to leave? 2. Sleeper Context: Saved memories can outlive the conversations that created them, making it harder to trace a later behavior change back to its source. 3. The Sighted Adversary: Computer-use agents can remove the human-attention cost that many UI friction controls quietly relied on. #CyberSecurity #ThreatIntelligence #ArtificialIntelligence #AgenticAI #AISecurity #ThreatModeling #SupplyChainSecurity #InformationSecurity #RiskManagement #EnterpriseSecurity cyfirma.com/research/shadow-…

#CYFIRMAResearch Team just kicked off an #ExploitRadarSummary! Get the latest insights on Fortnightly #vulnerabilities, severity levels, industry-specific threats, current trends, and much more. Stay informed, stay secure! #CyberSecurity #VulnerabilitySummary #ExternalThreatLandscapeManagement #ETLM #CYFIRMA cyfirma.com/research/exploit…

New #CYFIRMA FIRST SIGHT report: N0n Extortion Group Targets Global Shipping. #N0n, a #datatheft #extortion group active since 18 September 2026, posted 38 port, terminal, #shipping and #logistics organisations to its leak site on 12 October, all within 23 minutes. The batch spans 18 countries and territories, with #SouthKorea the most affected. All 38 face a single publication deadline of 19 October. #CyberSecurity #ThreatIntelligence #CYFIRMAResearch #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/non-ext…

#CYFIRMAResearch - September 2026 #Ransomware #ThreatIntelligence Briefing. Ransomware activity in September 2026 settled at 862 publicly disclosed victims worldwide, down 26.3% from August's 1170, based on #CYFIRMA's final full-month leak-site tracker count. Affiliate tradecraft around RMM abuse, edge access, #BYOVD, and data extortion remained intact. #CyberSecurity #CyberThreats #RaaS #Qilin #ThreatLandscape #CyberDefense #DigitalRisk cyfirma.com/research/trackin…

#SAARC Telecom Threat Landscape | Apr–Sep 2026 Telecom infrastructure is becoming a bigger and more complex cyber target. #CYFIRMA's latest assessment highlights key trends across #darkweb exposure, #ransomware, #vulnerability exploitation, credential compromise, #APT activity, and emerging 5G/cloud/API risks. The key takeaway? Visibility is no longer optional. Protecting subscriber data, privileged access, network infrastructure, and third-party connections requires continuous monitoring and intelligence-led security. #CyberSecurity #TelecomSecurity #ThreatIntelligence #SAARC #Ransomware #APT #DarkWeb #5G #CyberThreats cyfirma.com/research/sector-…

Prediction 4 of this #CYFIRMA Series observes that 62% of organisations were hit by a #deepfake attack in the past 12 months (Gartner). What we expect to see: The first confirmed fraud using a real-time 3D executive persona in a spatial or AR/VR meeting. Liveness detection built on 2D cues fails as a control, and “presence verification” becomes a product category. Immersive synthetic personas used in state influence operations and recruitment fraud. EU AI Act Article 50 enforcement produces the first deepfake-labelling fines. Our trajectory metric: deepfake fraud attempts per day (Pindrop) — 0.03 in 2023, 7 in 2024, 18 in 2025. Our projection for 2027: 60 per day. #SyntheticMedia #IdentityVerification #ThreatIntelligence #CyberSecurity #CISO #ThreatHorizon2027 cyfirma.com/research/crystal…

#CYFIRMAResearch is thrilled to share the Adversary Unmasked APT Quarterly report for July 2026 to September 2026. Stay ahead with #Iranian, #Russian, #Chinese, and #NorthKorean #APT #ThreatActor Activities, covering techniques observed, targeted industries, countries, and technology. #CyberSecurity #CYFIRMA #ExternalThreatLandscapeManagement #ETLM cyfirma.com/research/adversa…

#CYFIRMAResearch presents #ExploitRadarSummary! Get the latest insights on Fortnightly #vulnerabilities, severity levels, industry-specific threats, current trends, and much more. #CyberSecurity #VulnerabilitySummary #ExternalThreatLandscapeManagemen #CYFIRMA cyfirma.com/research/exploit…

#CYFIRMA #EducationIndustry Report | Q2 2026 | Overall industry risk: 6.0/10 - ELEVATED. 85 #Ransomware victims across 28 countries, up 19.7% quarter-on-quarter. #Universities & #ResearchInstitutions accounted for almost half of all sector victims. 12 #APT campaigns touched education orgs, and the actor set was exclusively #statesponsored. #CyberSecurity #externalthreatlandscapemanagement #ThreatIntelligence #CYFIRMAResearch #CYFIRMAIndustryReport #Qilin #Thegentlemen cyfirma.com/research/62735/

Chokepoints aren't just physical straits: Our latest research shows how maritime corridors like Hormuz and Malacca now sit alongside financial, technological, digital, and logistics chokepoints, making them the new frontier in cyber conflict and the pressure points that state and non-state actors will increasingly target in tandem with kinetic action to put pressure on their adversaries. #HormuzStrait #USForeignPolicy #CyberWarfare #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #CYFIRMA #ExternalThreatLandscapeManagement cyfirma.com/research/chokepo…

Prediction 3 of the CYFIRMA Crystal Ball Series 2026. In January, we said "prevent before breach" would stop being a slogan and become the standard, with the majority of top organisations treating proactive security as the baseline, not the aspiration. The latest data says (Q3 2026): 87% of security leaders rate CTEM as important — but only 16% are running it operationally — Reflectiz, Feb '26. $248.9B global security spend forecast for 2026, up 12.7%, with securing #AI the fastest-growing line to 2030. Gartner 2Q26, Jun '26. Prediction tracking: VALIDATED — ON TRACK. #PreemptiveSecurity #ExposureManagement #CTEM #ThreatIntelligence #CyberSecurity #CISO #CYFIRMA #CrystalBallSeries2026 cyfirma.com/research/crystal…

#CYFIRMA Real Estate & Construction Industry Report | Q2 2026 | Overall industry risk: 6.9 / 10 - ELEVATED. 290 #Ransomware victims across 45 countries, up 42.9% quarter-on-quarter, a major increase. #Qilin went from one June victim to 25 in August, and Thegentlemen from zero to 18, together accounting for roughly a third of peak monthly volume. 37 #APT campaigns touched the sector across 47 countries, and this is the only sector this quarter where both absolute campaign presence and share of the campaign pool rose together. #Vulnerability disclosures were dominated almost entirely by #remotecodeexecution. What makes this sector different is that the biggest risks come from outside the company itself. #CyberSecurity #RealestateandConstructionIndustry #ETLM #externalthreatlandscapemanagement #ThreatIntelligence #CYFIRMAResearch #CYFIRMAIndustryReport cyfirma.com/research/real-es…

#CYFIRMAResearch has published #Australia & #NewZealand #CyberThreat Landscape, examining cyber threat activity across Mining, Financial Services, Manufacturing, and Banking from January 2025 onward. The research highlights a persistent identity- and access-driven threat landscape, with credential-based attacks, #ransomware, compromised access, and underground-market activity continuing to shape the regional risk environment. The report provides sector-specific threat assessments, key attack patterns, and strategic predictions for 2026–2027. #CYFIRMAResearch #CyberSecurity #ThreatIntelligence #CyberThreatLandscape #ANZ #ETLM #DarkWeb #CyberThreats #CyberRisk cyfirma.com/research/cyber-t…