CYFIRMA Research

Threat Research: Operation Tax Shadow Explore CYFIRMA's latest report regarding a tax-themed phishing campaign impersonating government tax authorities across multiple countries. • Multi-stage malware delivery via ZIP archive • DLL Search Order Hijacking for stealthy execution • API Hooking and Access Token Manipulation • COM Callback-based code execution to evade monitoring • Modified RC4 encryption protecting payloads • Reflective PE Loading enabling memory-r...

The CYFIRMA Research team has identified key security insights related to CVE-2026-34197, a high-severity remote code execution vulnerability affecting Apache ActiveMQ Classic deployments. The vulnerability arises from exposure of the Jolokia JMX-HTTP bridge, which allows authenticated attackers to invoke privileged broker management operations and abuse the addNetworkConnector() functionality to load attacker-controlled remote Spring XML configurations. Our research highlights the exploita...

The increasing digitalization of India’s education sector has created a growing attack surface for cybercriminals targeting student-related data. Our latest threat intelligence assessment explores how exposed or misused student information is being leveraged for phishing, social engineering, impersonation, credential theft, and financial fraud. The report highlights multiple observed cases involving fake university portals, insider misuse of student records, fraudulent fee collection s...

CYFIRMA – April 2026 Ransomware Threat Intelligence Briefing Ransomware activity reached 801 global incidents in April 2026, marking the highest April total in recent years and reinforcing the continued expansion of ransomware-as-a-service operations. In this episode, the CYFIRMA Research Team breaks down: • The most active ransomware groups driving April activity • Key sectors and countries under the highest threat • Emerging exploit-driven and stealth-focused attack trends • The evolution...

New Research: Trusted Infrastructure Phishing — The Attack That Lives Inside Your Security Stack Most phishing starts outside your perimeter. This one starts inside it. Trusted Infrastructure Phishing (TIP) is a threat class in which every phase of the attack chain — delivery, hosting, execution, authentication, and persistence — operates through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. No spoofed domains. No malicious IPs. No suspicious cer...

Taiwan Cyber Threat Landscape 2026 Taiwan remains at the forefront of global cyber conflict—driven by its semiconductor dominance, strategic geopolitical position, and deep international partnerships. 🔹 Relentless Pressure: ~2.63M daily cyber intrusion attempts in 2025 (+100% since 2023) 🔹 Primary Threat Actors: PRC-linked APT groups conducting espionage, IP theft, and infrastructure pre-positioning 🔹 Rising Risks: Supply chain attacks, credential theft, ransomware, and disinform...

Stay ahead with CYFIRMA’s Philippines Evolving Cyber Threat Landscape 2025–2026 Report. The Philippines is facing a sharp escalation in AI-driven and automated cyber threats. Q3 2025 recorded over 52 million exposed credentials, while ransomware operations increasingly targeted operational systems across healthcare, BFSI, and critical infrastructure. Identity compromise, vendor access abuse, and supply-chain pathways are now primary intrusion vectors. Geopolitical tensions are further ampli...

Operation PhantomCLR Our latest research uncovers a highly sophisticated post-exploitation framework that represents a significant shift in modern attacker tradecraft. The campaign leverages .NET AppDomainManager hijacking to abuse a legitimate, digitally signed Intel binary (IAStorHelp.exe), transforming it into a stealthy execution container without modifying the original file. This allows malicious code to execute within a trusted environment, effectively bypassing traditional EDR a...

The CYFIRMA Research team has identified critical security insights related to CVE-2026-1492, a high-severity authentication bypass and privilege escalation vulnerability affecting the WordPress User Registration & Membership plugin. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting improper server-side validation and weak authorization controls within the registration and membership workflow. Our research highlights the exploitation mechanis...

CrySome RAT – Advanced Threat Insight CrySome RAT is a sophisticated .NET-based remote access trojan engineered for long-term persistence and stealth on Windows systems. It extends beyond typical malware by maintaining execution even after system resets, leveraging recovery partition abuse and offline registry manipulation to ensure continued presence. Beyond persistence, it delivers a full post-exploitation toolkit. It supports remote command execution, file exfiltration, process manipulat...

Stay informed with CYFIRMA’s February 2026 Ransomware Threat Report. February continued to reflect a high-activity ransomware environment, with noticeable shifts in group dynamics and operational patterns. While Qilin sustained consistent activity levels, other actors showed mixed trends, with some groups scaling rapidly and others reducing operations, highlighting the constantly evolving nature of the ecosystem. The ransomware model continues to move toward access-led intrusions and extorti...

CYFIRMA Research uncovered a targeted Android spyware campaign, Operation False Siren, exploiting wartime urgency by weaponizing the trusted Israeli civil defense alert application. In this operation, threat actors distributed a trojanized version of the missile warning app via SMS phishing (smishing) campaigns, convincing victims to install what appeared to be a critical alert system update. Once installed, the application deployed a two-stage malware framework designed to silently establis...

New Research: Dead Infrastructure Hijacking — The Attack That Doesn't Need a Vulnerability Most breaches start with an exploit. This one starts with a domain registration. We've published a full threat intelligence report on Dead Infrastructure Hijacking (DIH) — a threat class that exploits residual trust relationships left behind when digital infrastructure is decommissioned, migrated, or abandoned. No intrusion. No CVE. No malware. The attacker simply owns an address that your systems ar...