Weekly Intelligence Report – 22 May 2026

Published On : 2026-05-22
Share :
Weekly Intelligence Report – 22 May 2026

Ransomware In Focus

CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various forums. This includes multiple – industries, geography, and technology that could be relevant to your organization.

Type: Ransomware
Target Technologies: Windows OS

Targeted Countries:
United States, Canada, Australia, Belgium, Maldives, France, Qatar, United Arab Emirates, Pakistan

Targeted Industries:
Manufacturing, Logistics, Energy, Real Estate, Legal, Hospitality, Construction, Healthcare, Engineering, Warehousing, Finance, Insurance, Industrial Services, Design.

Introduction:
CYFIRMA Research and Advisory Team has found Aur0ra Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

Aur0ra Ransomware
Researchers have identified Aur0ra as a ransomware strain designed to deny file access through encryption while also asserting that sensitive information was extracted from the affected system before encryption took place. Aur0ra ransomware encrypted files without changing their original names or adding new extensions. For instance, a file such as “1.jpg” retained its filename after encryption but was no longer accessible. This operational pattern reflects a dual-function approach that combines file encryption with claimed data exfiltration. Upon completing the encryption routine, Aur0ra created a ransom message in a text file named “!!!README!!!DO_NOT_DELETE.txt”.

Screenshot: File encrypted by the ransomware (No change in file name) (Source: Surface Web)

The message left by Aur0ra indicates that confidential files were allegedly downloaded from the affected system and confirms that local files have been encrypted. Victims are directed to establish communication through a Tor-based website provided in the note and are instructed to use a designated access key during the contact process. The communication contains only basic contact instructions and an access identifier, without disclosing ransom payment details, deadlines, or offering a test decryption feature.

Screenshot: The appearance of Aur0ra’s Ransom Note (Source: Surface Web)

Screenshot: The appearance of Aur0ra’s Data Leak Site (Source: Surface Web/ Darkweb)

The following are the TTPs based on the MITRE Attack Framework

Tactic Technique ID Technique Name
InitialAccess T1091 Replication Through Removable Media
Execution T1059 Command and Scripting Interpreter
Execution T1129 Shared Modules
Persistence T1546.011 Event Triggered Execution: Application Shimming

Privilege Escalation

 T1055 Process Injection

Privilege Escalation

 T1134 Access Token Manipulation

Privilege Escalation

 T1546.011 Event Triggered Execution: Application Shimming

Privilege Escalation

 T1548 Abuse Elevation Control Mechanism
Discovery T1012 Query Registry
Discovery T1057 Process Discovery
Discovery T1082 System Information Discovery
Discovery T1120 Peripheral Device Discovery
Discovery T1135 Network Share Discovery

Lateral Movement

 T1091 Replication Through Removable Media
Collection T1560 Archive Collected Data

Command and Control

 T1071 Application Layer Protocol

Command and Control

 T1090 Proxy
Impact T1490 Inhibit System Recovery
Stealth T1027.002

Obfuscated Files or Information: Software Packing

Stealth T1036 Masquerading
Stealth T1055 Process Injection
Stealth T1070.006 Indicator Removal: Timestomp
Stealth T1134 Access Token Manipulation
Stealth T1202 Indirect Command Execution
Stealth T1564.003 Hide Artifacts: Hidden Window

Relevancy and Insights:

  • The ransomware primarily affects the Windows operating system, which is commonly utilized in enterprise environments across multiple industries.
  • The ransomware executes commands such as vssadmin.exe Delete Shadows /all /quiet and wmic shadowcopy delete /nointeractive to delete Volume Shadow Copies, which are used by Windows for backup and restore. By deleting shadow copies, the malware prevents victims from restoring their data using built-in recovery features such as system restore points or local backup mechanisms.
  • The malware interacts with or queries the system’s USB bus to identify connected USB devices. This activity may involve enumerating removable storage hardware or gathering information about attached peripherals as part of its system reconnaissance and device-awareness routines.
  • Detect-debug-environment: The ransomware technique is used to determine if it is being monitored in environments such as sandboxes, virtual machines, or under debugging tools. To perform this check, the malware may look for specific processes, drivers, or artifacts linked to analysis tools, measure timing to spot inconsistencies, or scan for system traits uncommon in real user machines. When such conditions are identified, the malicious program can modify its behavior, such as pausing execution, shutting down, or withholding key payload actions, to avoid detection and make detailed analysis more difficult.

ETLM Assessment:
CYFIRMA’s analysis indicates that Aur0ra reflects a ransomware framework designed around both data encryption and claimed information exfiltration, aligning with the dual-extortion techniques increasingly observed across ransomware operations. Technical analysis shows that the malware encrypts files without altering their filenames or appending additional extensions, allowing encrypted data to remain visually unchanged while becoming inaccessible. The deployment of a dedicated ransom note, use of a Tor-based communication portal, and assignment of a victim-specific access key indicate a structured post- compromise communication mechanism intended to manage interactions with affected users. Additionally, behavioral indicators such as system and device- related checks suggest that Aur0ra may conduct environmental awareness or reconnaissance activities during execution to assess the infected environment.

The operational characteristics observed in Aur0ra suggest potential for continued technical development through incremental updates and feature expansion. Future variants may adopt stronger anti-analysis and evasion mechanisms, refined encryption workflows, and broader reconnaissance capabilities aimed at identifying valuable data repositories and connected resources. Its communication infrastructure may also evolve through modified Tor-based interaction methods or streamlined access procedures designed to support more organized post- compromise communication. As ransomware ecosystems continue to mature through iterative development cycles, Aur0ra may undergo further adaptation to improve deployment flexibility, persistence of operations, and compatibility with diverse target environments while maintaining its core encryption and extortion- oriented functionality.

Sigma rule:
title: Uncommon Svchost Command Line Parameter
description: Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
tags:
– attack.privilege-escalation
– attack.stealth
– attack.t1036
– attack.t1055
– attack.t1055 logsource:
category: process_creation product: windows
detection: selection:
# Example of command to simulate: “C:\Windows\System32\svchost.exe” calc.exe
Image|endswith: ‘\svchost.exe’ filter_main_flags:
CommandLine|re: ‘-k\s\w{1,64}(?:\s?(?:-p|-s))?’ filter_main_empty:
CommandLine: ” filter_main_null:
CommandLine: null filter_optional_defender:
ParentImage|endswith: ‘\MsMpEng.exe’ CommandLine|contains: ‘svchost.exe’
filter_optional_mrt: ParentImage|endswith: ‘\MRT.exe’ CommandLine: ‘svchost.exe’
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives:
– Unlikely level: high
(Source: Surface Web)

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

RECOMMENDATIONS

STRATEGIC RECOMMENDATIONS

  • Implement competent security protocols and encryption, authentication, or access credentials configurations to access critical systems in your cloud and local environments.
  • Ensure that backups of critical systems are maintained, which can be used to restore data in case a need arises.

MANAGEMENT RECOMMENDATIONS

  • A data breach prevention plan must be developed considering (a) the type of data being managed by the company; (b) the remediation process; (c) where and how the data is stored; (d) if there is an obligation to notify the local authority.
  • Implement a zero-trust security model alongside multifactor authentication (MFA) to reduce the risk of credential compromise.
  • Foster a culture of cybersecurity, where you encourage and invest in employee training so that security is an integral part of your organization.

TACTICAL RECOMMENDATIONS

  • Update all applications/software regularly with the latest versions and security patches alike.
  • Add the Sigma rule for threat detection and monitoring, which will help to detect anomalies in log events, and identify and monitor suspicious activities.
  • Establish and implement protective controls by actively monitoring and blocking identified indicators of compromise (IoCs) and reinforcing defensive measures based on the provided tactical intelligence.

Active Malware of the Week

Type: Information Stealer| Objectives: Data Exfiltration | Target Technology: Windows OS|
Target Geography: Global

CYFIRMA collects data from various forums based on which the trend is ascertained. We identified a few popular malware that were found to be distributed in the wild to launch cyberattacks on organizations or individuals.

Active Malware of the week
This week, “Remus Stealer” is in focus

Overview of Operation Remus Stealer Malware
Remus Stealer sample analysis reveals a sophisticated, multi-stage execution pattern designed to operate discreetly within a Windows environment. The activity begins with a user-level executable that deploys additional components from temporary locations, indicating a staged and controlled execution flow. The program relies on built-in Windows management features to collect essential system information and assess the operating environment before proceeding further. This initial profiling enables it to adapt its behavior while minimizing the risk of exposure.

The sample also demonstrates attempts to gain elevated privileges by leveraging legitimate system mechanisms and modifying normal execution pathways. It interacts with critical registry locations, system libraries, and configuration areas commonly associated with higher execution contexts. At the same time, it performs checks for security controls and monitoring tools, reflecting a deliberate effort to remain undetected by blending into routine system operations rather than triggering suspicious activity.

Several evasion techniques are evident in its design. The structure suggests the use of obfuscation and runtime decoding, allowing the core functionality to remain concealed during analysis. Indications of process manipulation imply that the program may shift its activity into trusted system processes, further masking its presence. Once stable, it appears to access user directories and application data, suggesting an intent to collect locally stored information of interest.

Network-related indicators reveal preparation for external communication through non- standard channels and concealed references to remote infrastructure. These observations suggest the use of covert methods for command exchange and data transmission. Overall, the behavior of the Remus Stealer sample reflects a carefully engineered malicious tool that prioritizes stealth, controlled execution, and discreet communication, characteristics commonly associated with advanced and purpose- built threats.

Attack Method
The attack method begins with a staged loader launched from a user directory, which immediately drops and executes a secondary component from the temporary path to separate the installer logic from the core payload. Very early in execution, the malware pivots Windows Management Instrumentation (WMI) by invoking wmiprvse.exe and wmiadap.exe to query classes under ROOT\CIMV2, specifically operating system and video controller details. This reconnaissance step allows the code to fingerprint the host, detect virtualized or sandboxed environments, and conditionally proceed only when the system appears suitable for continued activity. Parallel loading of libraries such as bcryptprimitives.dll, rpcrt4.dll, and SspiCli.dll indicates that cryptographic routines and RPC capabilities are initialized before any external communication is attempted.

Privilege elevation is achieved by manipulating execution flow through registry paths associated with the COM Elevation Moniker, notably the CLSID 4590F811-1D3A- 11D0891F-00AA004B2E24. By abusing auto-elevated COM handlers, the malware gains higher integrity execution without prompting the user, effectively blending malicious actions into trusted Windows components. Additional touches to amsi.dll, sysmain.sdb, and AppCompat-related keys suggest pre-emptive interference with security inspection and compatibility mechanisms that might otherwise expose abnormal behavior. Interaction with \Device\KsecDD further shows preparation for secure cryptographic operations at a low level before command exchange begins.

Evasion is sustained through layered obfuscation and in-memory reconstruction of the true payload. The sample appears to unpack or decode its functional code at runtime, leaving minimal static artifacts on disk. Process injection is then used to migrate execution into legitimate system processes, masking activity under trusted process names. During this phase, the malware probes user-accessible paths, including desktop locations and Outlook data folders, positioning itself to collect locally stored information once it has established a stable foothold within the system.

For command and control, malware relies on dynamically decoded network indicators rather than hard-coded strings. Memory traces reveal references to cheapoca.biz across unusual ports (500 and 5003–5007), while observed UDP traffic to 162.159.36.2:53 points toward DNS-based or covert application-layer communication. By keeping these indicators concealed until runtime, the malware reduces the likelihood of static detection. Overall, the attack method demonstrates a tightly coordinated sequence of environment profiling, privilege escalation, stealthy execution, and concealed communication designed to maintain control while remaining largely invisible to conventional defenses.

The following are the TTPs based on the MITRE Attack Framework for Enterprise

Tactic Technique ID Technique Name
Execution T1047 Windows Management Instrumentation
Execution T1129 Shared Modules
Privilege Escalation T1055 Process Injection
Stealth T1027 Obfuscated Files or Information
Stealth T1027:002 Obfuscated Files or Information: Software Packing
Stealth T1140 Deobfuscate/Decode Files or Information
Stealth T1497 Virtualization/Sandbox Evasion
Discovery T1518 Software Discovery
Discovery T1518.001 Software Discovery: Security Software Discovery
Discovery T1082 System Information Discovery
Discovery T1083 File and Directory Discovery
Collection T1005 Data from Local System
Command and control T1071 Application Layer Protocol

INSIGHTS

  • This malware illustrates how modern threats are engineered to behave patiently rather than aggressively. Instead of executing all actions immediately, it progresses in measured stages, verifying the system environment before revealing its true intent. This restrained behavior reflects a design philosophy focused on avoiding attention, where remaining unnoticed is more valuable than acting quickly. The sequence of actions shows careful timing and dependency on system conditions, indicating that the malware is built to operate reliably across varied environments without exposing itself prematurely.
  • Another notable aspect is the deliberate use of legitimate system components as part of its operational flow. Rather than introducing unfamiliar elements that might appear suspicious, the malware embeds itself within normal system activity. This blending strategy allows it to coexist with routine processes, making its presence difficult to distinguish from ordinary operations. Such an approach highlights how attackers increasingly rely on trust placed in operating system features to conceal malicious intent.
  • The overall structure also reveals a balance between concealment and purpose. While much effort is invested in hiding its activity, the malware still maintains a clear objective centered on accessing local information and maintaining communication pathways. This combination of subtlety and functional clarity demonstrates that the threat is not opportunistic but thoughtfully crafted, where each action contributes to a controlled and coherent workflow rather than random or noisy behavior.

ETLM ASSESSMENT
From an ETLM standpoint, the progression of threats that emphasize discretion and environmental alignment reflects a shift toward attack patterns that quietly adapt to routine organizational activity. Such threats are likely to blur the distinction between legitimate system operations and malicious intent, making it harder for both users and security teams to recognize early indicators of compromise. As employees continue to interact with everyday applications, files, and processes, these normal actions may unintentionally provide the conditions needed for such threats to remain active without drawing attention.

Over time, the growing similarity between ordinary workflows and concealed malicious behavior may contribute to a more uncertain operational landscape. This overlap is expected to complicate efforts to differentiate anomalies from routine events, increasing the difficulty of maintaining consistent visibility into system integrity. As a result, both organizational environments and individual user interactions may exist within a space where identifying subtle irregularities becomes progressively more challenging.

IOCs:
Kindly refer to the IOCs Section to exercise controls on your security systems. (Source: Surface Web)

YARA Rules
rule RemusStealer_String_Based_Detection
{
meta:
description = “Detects RemusStealer using distinctive behavioral, memory, and artifact strings”
author = “CYFIRMA” date = “2026-05-19”
strings:
$hash =
“48385492b6518cb2f3adcfd4a49c065ba960bdc617817068bd5faeb493d3f2db”
$s1 = “cheapoca.biz”
$s2 = “cheapoca.biz:5003”
$s3 = “cheapoca.biz:500”
$s4 = “wmiprvse.exe”
$s5 = “wmiadap.exe”
$s6 = “ROOT\\CIMV2”
$s7 = “Win32_OperatingSystem”
$s8 = “Win32_VideoController”
$s9 = “{4590F811-1D3A-11D0-891F-00AA004B2E24}”
$s10 = “\\Device\\KsecDD”
$s11 = “amsi.dll”
$s12 = “sysmain.sdb”
$s13 = “bcryptprimitives.dll”
$s14 = “rpcrt4.dll”
$s15 = “SspiCli.dll”
$s16 = “%TEMP%”
$s17 = “Outlook Files” condition:
10 of ($s*) or $hash
}

Recommendations

Strategic Recommendations

  • Establish a security posture that emphasizes behavior-based detection rather than relying only on signatures, as modern threats increasingly resemble normal system activity.
  • Integrate threat intelligence and continuous monitoring into organizational security strategy to identify subtle indicators of compromise.
  • Adopt a zero-trust mindset where every process, user action, and system interaction is verified, even if it originates from trusted components.
  • Ensure periodic security architecture reviews to evaluate how well existing controls can detect stealth-oriented and staged malware behaviors.

Management Recommendations

  • Promote regular security awareness training so employees understand the risks of executing unknown files and installers from user directories.
  • Implement strict software installation policies and restrict administrative privileges to reduce the risk of unauthorized execution.
  • Encourage coordination between IT, SOC, and management teams to ensure early reporting and rapid response to suspicious system behavior.
  • Maintain updated incident response plans that account for threats designed to remain undetected for extended periods.

Tactical Recommendations

  • Monitor WMI activity, process injection attempts, and unusual registry modifications associated with elevated execution paths.
  • Deploy endpoint detection tools capable of identifying in-memory execution, obfuscation, and runtime decoding behavior.
  • Inspect outbound network traffic for communication over non-standard ports and unusual DNS activity.
  • Regularly audit user directories, temporary folders, and application data paths for suspicious executables and artifacts.
  • Implement proactive security controls by monitoring and blocking identified IOCs, leveraging YARA rules for detection, and strengthening defenses based on actionable tactical intelligence.

CYFIRMA’s Weekly Insights

1. Weekly Attack Types and Trends

Key Intelligence Signals:

  • Attack Type: Ransomware Attacks, Vulnerabilities & Exploits, Data Leaks.
  • Objective: Unauthorized Access, Data Theft, Data Encryption, Financial Gains, Espionage.
  • Business Impact: Data Loss, Financial Loss, Reputational Damage, Loss of Intellectual Property, Operational Disruption.
  • Ransomware – Qilin Ransomware, The Gentlemen Ransomware| Malware – Remus Stealer
  • Qilin Ransomware – One of the ransomware groups.
  • The Gentlemen Ransomware – One of the ransomware groups. Please refer to the trending malware advisory for details on the following:
  • Malware – Remus Stealer
    Behavior – Most of these malware use phishing and social engineering techniques as their initial attack vectors. Apart from these techniques, exploitation of vulnerabilities, defense evasion, and persistence tactics are being observed.

2. Threat Actor in Focus

Kimsuky aka APT43: Expansion of digital footprints and arsenal

  • Threat Actor: Kimsuky aka APT43
  • Attack Type: Credential Harvesting, Vulnerabilities & Exploits, Social Engineering.
  • Objective: Information Gathering, Espionage.
  • Suspected Target Technology: Bandzip, Hangul Word Processor, Social Platforms, macOS, Windows.
  • Suspected Target Geography: Belgium, Bulgaria, Canada, Croatia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Lithuania, Luxembourg, Montenegro, North Macedonia, Norway, Poland, Portugal, Romania, Slovakia, Slovenia., the Czech Republic, the Netherlands, Albania, Brazil, Japan, South Korea, Thailand, USA, Vietnam.
  • Suspected Target Industries: Aerospace, Construction, Consulting, Defence, Education, Government, Hi-Tech, Manufacturing, Media & Entertainment, NGO, Pharmaceuticals, Professional Services, Research, Telecommunications, Think Tanks.
  • Business Impact: Financial Loss, Data Theft, Operational Disruption, Reputational Damage

About the Threat Actor
The latest advanced persistent threat actor suspected to be from North Korea supports the interests of the regime. The threat actor collection priorities align with the mission of the Reconnaissance General Bureau (RGB), North Korea’s main foreign intelligence service. The group has moderately sophisticated technical capabilities with aggressive social engineering tactics, focused on the Korean peninsula geopolitical issues. The threat actor funds itself through cybercrime operations to support its primary mission of collecting strategic intelligence in addition to espionage-related campaigns.

Details on Exploited Vulnerabilities

TTPs based on MITRE ATT&CK Framework

Tactic ID Technique
Reconnaissance T1591 Gather Victim Org Information
Reconnaissance T1589.004 Gather Victim Identity Information: Employee Names
Reconnaissance T1589.002 Gather Victim Identity Information: Email Addresses
Reconnaissance T1598 Phishing for Information
Reconnaissance T1598.003 Phishing for Information: Spear phishing Link
Reconnaissance T1682 Query Public AI Services
Reconnaissance T1596 Search Open Technical Databases
Reconnaissance T1593.001 Search Open Websites/Domains: Social Media
Reconnaissance T1593.002 Search Open Websites/Domains: Search Engines
Reconnaissance T1594 Search Victim-Owned Websites
ResourceDevelopment T1586.002 Compromise Accounts: Email Accounts
ResourceDevelopment T1608.001 Stage Capabilities: Upload Malware
ResourceDevelopment T1587.001 Develop Capabilities: Malware
ResourceDevelopment T1587 Develop Capabilities
ResourceDevelopment T1583 Acquire Infrastructure
Resource Development T1583.001 Acquire Infrastructure: Domains
Resource Development T1583.004 Acquire Infrastructure: Server
Resource Development T1583.006 Acquire Infrastructure: Web Services
Resource Development T1584.001 Compromise Infrastructure: Domains
Resource Development T1585 Establish Accounts
Resource Development T1585.001 Establish Accounts: Social Media Accounts
Resource Development T1585.002 Establish Accounts: Email Accounts
Resource Development T1588.002 Obtain Capabilities: Tool
Resource Development T1588.003 Obtain Capabilities: Code Signing Certificates
Resource Development T1588.005 Obtain Capabilities: Exploits
InitialAccess T1190 Exploit Public-Facing Application
Initial Access T1133 External Remote Services
Initial Access T1078.003 Valid Accounts: Local Accounts
Initial Access T1566.001 Phishing: Spear phishing Attachment
Initial Access T1566.002 Phishing: Spear phishing Link
Initial Access T1566 Phishing
Execution T1059.001 Command and Scripting Interpreter: PowerShell
Execution T1059.007 Command and Scripting Interpreter: JavaScript
Execution T1059.006 Command and Scripting Interpreter: Python
Execution T1059.005 Command and Scripting Interpreter: Visual Basic
Execution T1059.003 Command and Scripting Interpreter: Windows Command Shell
Execution T1053.005 Scheduled Task/Job: Scheduled Task
Execution T1106 Native API
Execution T1204.001 User Execution: Malicious Link
Execution T1204.002 User Execution: Malicious File
Execution T1204.004 User Execution: Malicious Copy and Paste
Execution T1559.001 Inter-Process Communication: Component Object Model
Persistence T1098.007 Account Manipulation: Additional Local or Domain Groups
Persistence T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Persistence T1136.001 Create Account: Local Account
Persistence T1543.003 Create or Modify System Process: Windows Service
Persistence T1546.001 Event Triggered Execution: Change Default File Association
Persistence T1133 External Remote Services
Persistence T1112 Modify Registry
Persistence T1053.005 Scheduled Task/Job: Scheduled Task
Persistence T1505.003 Server Software Component: Web Shell
Persistence T1176.001 Software Extensions: Browser Extensions
Persistence T1205 Traffic Signaling
Persistence T1078.003 Valid Accounts: Local Accounts
Privilege Escalation T1098.007 Account Manipulation: Additional Local or Domain Groups
Privilege Escalation T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation T1543.003 Create or Modify System Process: Windows Service
Privilege Escalation T1546.001 Event Triggered Execution: Change Default File Association
Privilege Escalation T1055.001 Process Injection: Dynamic-link Library Injection
Privilege Escalation T1055.012 Process Injection: Process Hollowing
Privilege Escalation T1053.005 Scheduled Task/Job: Scheduled Task
Privilege Escalation T1078.003 Valid Accounts: Local Accounts
Stealth T1678 Delay Execution
Stealth T1140 Deobfuscate/Decode Files or Information
Stealth T1480.002 Execution Guardrails: Mutual Exclusion
Stealth T1564.002 Hide Artifacts: Hidden Users
Stealth T1564.003 Hide Artifacts: Hidden Window
Stealth T1564.011 Hide Artifacts: Ignore Process Interrupts
Stealth T1070.004 Indicator Removal: File Deletion
Stealth T1070.006 Indicator Removal: Timestomp
Stealth T1036.004 Masquerading: Masquerade Task or Service
Stealth T1036.005 Masquerading: Match Legitimate Resource Name or Location
Stealth T1036.007 Masquerading: Double File Extension
Stealth T1027.001 Obfuscated Files or Information: Binary Padding
Stealth T1027.002 Obfuscated Files or Information: Software Packing
Stealth T1027.007 Obfuscated Files or Information: Dynamic API Resolution
Stealth T1027.010 Obfuscated Files or Information: Command Obfuscation
Stealth T1027.012 Obfuscated Files or Information: LNK Icon Smuggling
Stealth T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
Stealth T1027.015 Obfuscated Files or Information: Compression
Stealth T1027.016 Obfuscated Files or Information: Junk Code Insertion
Stealth T1027 Obfuscated Files or Information
Stealth T1055.001 Process Injection: Dynamic-link Library Injection
Stealth T1055.012 Process Injection: Process Hollowing
Stealth T1620 Reflective Code Loading
Stealth T1684.001 Social Engineering: Impersonation
Stealth T1218.005 System Binary Proxy Execution: Mshta
Stealth T1218.010 System Binary Proxy Execution: Regsvr32
Stealth T1218.011 System Binary Proxy Execution: Rundll32
Stealth T1205 Traffic Signaling
Stealth T1078.003 Valid Accounts: Local Accounts
Stealth T1497.001 Virtualization/Sandbox Evasion: System Checks
DefenseImpairment T1686 Disable or Modify System Firewall
DefenseImpairment T1685 Disable or Modify Tools
DefenseImpairment T1112 Modify Registry
DefenseImpairment T1553.002 Subvert Trust Controls: Code Signing
Credential Access T1557 Adversary-in-the-Middle
Credential Access T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Credential Access T1056.001 Input Capture: Keylogging
Credential Access T1056.003 Input Capture: Web Portal Capture
Credential Access T1111 Multi-Factor Authentication Interception
Credential Access T1040 Network Sniffing
Credential Access T1003.001 OS Credential Dumping: LSASS Memory
Credential Access T1539 Steal Web Session Cookie
Credential Access T1552.001 Unsecured Credentials: Credentials In Files
Credential Access T1552.004 Unsecured Credentials: Private Keys
Discovery T1217 Browser Information Discovery
Discovery T1083 File and Directory Discovery
Discovery T1680 Local Storage Discovery
Discovery T1040 Network Sniffing
Discovery T1057 Process Discovery
Discovery T1012 Query Registry
Discovery T1518.001 Software Discovery: Security Software Discovery
Discovery T1082 System Information Discovery
Discovery T1016 System Network Configuration Discovery
Discovery T1033 System Owner/User Discovery
Discovery T1007 System Service Discovery
Discovery T1124 System Time Discovery
Discovery T1497.001 Virtualization/Sandbox Evasion: System Checks
LateralMovement T1534 Internal Spear phishing
LateralMovement T1021.001 Remote Services: Remote Desktop Protocol
LateralMovement T1550.002 Use Alternate Authentication Material: Pass the Hash
Collection T1557 Adversary-in-the-Middle
Collection T1560.001 Archive Collected Data: Archive via Utility
Collection T1560.003 Archive Collected Data: Archive via Custom Method
Collection T1185 Browser Session Hijacking
Collection T1115 Clipboard Data
Collection T1005 Data from Local System
Collection T1074.001 Data Staged: Local Data Staging
Collection T1114.002 Email Collection: Remote Email Collection
Collection T1114.003 Email Collection: Email Forwarding Rule
Collection T1056.001 Input Capture: Keylogging
Collection T1056.003 Input Capture: Web Portal Capture
Collection T1113 Screen Capture
Command and Control T1071.001 Application Layer Protocol: Web Protocols
Command and Control T1071.002 Application Layer Protocol: File Transfer Protocols
Command and Control T1071.003 Application Layer Protocol: Mail Protocols
Command and Control T1568 Dynamic Resolution
Command and Control T1105 Ingress Tool Transfer
Command and Control T1132.002 Data Encoding: Non-Standard Encoding
Command and Control T1219.002 Remote Access Tools: Remote Desktop Software
Command and Control T1205 Traffic Signaling
Command and Control T1102.001 Web Service: Dead Drop Resolver
Command and Control T1102.002 Web Service: Bidirectional Communication
Exfiltration T1020 Automated Exfiltration
Exfiltration T1041 Exfiltration Over C2 Channel
Exfiltration T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Impact T1657 Financial Theft
Impact T1489 Service Stop

Latest Developments Observed
The threat actor is suspected of targeting the defense sector in South Korea, Brazil, and Germany using spear-phishing emails as initial access and deploying malware at a later stage. The intent appears to be exfiltration of sensitive information and intelligence gathering.

ETLM Insights
Kimsuky operates with a state-aligned intelligence collection mandate, prioritizing strategic espionage in support of DPRK foreign policy, sanctions evasion awareness, and geopolitical positioning. The group’s activity reflects a sustained focus on long- term access to information-bearing environments rather than financially motivated operations, with operations structured to enable prolonged visibility into diplomatic, policy, and defense-related communications.

Operations are increasingly multi-stage in nature, enabling both broad infiltration and highly targeted espionage objectives. The group’s heightened technical sophistication, including modular payloads, refined social engineering, vulnerabilities & exploits, malware attacks, and supply-chain compromise tactics, underscores an elevated threat profile to technology providers, open-source platforms, and high-value enterprises.

IOCs:
Kindly refer to the IOCs section to exercise control of your security systems. (Source: Surface Web)

YARA Rules
rule Kimsuky_APT_Generic_Detection
{
meta:
description = “Detects potential Kimsuky/APT43 related malware artifacts and behaviors”
author = “CYFIRMA” date = “2026-05-19”
threat_actor = “Kimsuky” severity = “high”
strings:
/* Common spear-phishing / lure indicators */
$s1 = “powershell -enc” nocase
$s2 = “cmd.exe /c” nocase
$s3 = “AppData\\Roaming” nocase
$s4 = “schtasks /create” nocase
$s5 = “reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run” nocase
/* Kimsuky infrastructure / tooling patterns observed historically */
$k1 = “mail.google.com” nocase
$k2 = “docs.google.com/forms” nocase
$k3 = “Dropbox” nocase
$k4 = “Mozilla/5.0 (Windows NT” nocase
/* Malware execution / persistence patterns */
$m1 = “.vbs”
$m2 = “.hta”
$m3 = “.ps1”
$m4 = “WScript.Shell” nocase
$m5 = “CreateObject” nocase
$m6 = “FromBase64String” nocase
/* Suspicious Korean-language spear-phishing themes */
$ph1 = “security update” nocase
$ph2 = “urgent document” nocase
$ph3 = “password expiration” nocase condition:
(
3 of ($s*) and 2 of ($m*)
)
or (
2 of ($k*) and 2 of ($m*)
)
or (
uint16(0) == 0x5A4D and 4 of them
)
}

Recommendations

Strategic Recommendations

  • Incorporate Digital Risk Protection (DRP) as part of the overall security posture to proactively defend against impersonations and phishing attacks.
  • Assess and deploy alternatives for an advanced endpoint protection solution that provides detection/prevention for malware and malicious activities that do not rely on signature-based detection methods.
  • Block exploit-like behaviour. Monitor endpoints memory to find behavioural patterns that are typically exploited, including unusual process handle requests. These patterns are features of most exploits, whether known or new. This will be able to provide effective protection against zero-day/critical exploits and more by identifying such patterns.

Management Recommendations

  • Invest in user education and implement standard operating procedures for the handling of financial and sensitive data transactions commonly targeted by impersonation attacks. Reinforce this training with context-aware banners and in- line prompts to help educate users.
  • Develop a cyber threat remediation program and encourage employee training to detect anomalies proactively.

Tactical Recommendations

  • For better protection coverage against email attacks (like spear phishing, business email compromise, or credential phishing attacks), organizations should augment built-in email security with layers that take a materially different approach to threat detection.
  • Protect accounts with multi-factor authentication. Exert caution when opening email attachments or clicking on embedded links supplied via email communications, SMS, or messaging.
  • Apply security measures to detect unauthorized activities, protect sensitive production, and process control systems from cyberattacks.
  • Add the YARA rules for threat detection and monitoring, which will help to detect anomalies in log events, identify, and monitor suspicious activities.
  • Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defence based on the tactical intelligence provided.

3. Major Geopolitical Developments in Cybersecurity

Chipmaker Foxconn Hit by a Disruptive Cyberattack as Ransomware Gang Claims Theft of Apple, Google, and Nvidia Data
Taiwanese electronics manufacturing giant Foxconn has confirmed a significant cyberattack that disrupted operations across multiple North American factories. Foxconn stated that the affected facilities are currently resuming normal production, though the company declined to specify which exact locations were compromised. Foxconn maintains a massive footprint in North America, with major manufacturing facilities operating in Ohio, Texas, Virginia, Indiana, Mexico, and Wisconsin.

Signs of the disruption first emerged late last week; the situation escalated on Monday when the Nitrogen ransomware gang publicly listed Foxconn as a victim on its extortion site. The cybercriminals claim to have exfiltrated a staggering eight terabytes of data from the manufacturer’s networks. The group alleges that the stolen cache contains highly sensitive information, including proprietary schematics and confidential project details.

Most concerning for the broader tech industry is the identity of the clients affected by the alleged data heist. The Nitrogen gang claims the stolen blueprints and project files belong to some of Foxconn’s highest-profile customers, specifically naming tech titans Apple, Google, Nvidia, and Dell. Foxconn has not yet confirmed the validity of the hackers’ data theft claims or commented on whether any third-party intellectual property was actually compromised.

ETLM Assessment:
Based on current threat intelligence, the Nitrogen ransomware gang appears to be a purely financially motivated cybercriminal syndicate, rather than a state-sponsored or government-connected advanced persistent threat (APT). While a massive attack on a supply-chain giant like Foxconn involving data from Apple, Google, and Nvidia has the hallmarks of high-level espionage, the evidence points firmly toward standard, albeit highly sophisticated, cybercrime. The cyberattack landing concurrently with heightened geopolitical tension surrounding the Trump-Xi summit – sharply underscores Taiwan’s precarious yet utterly vital position in the global tech hierarchy. While Taiwan commands over 60% of the world’s semiconductor manufacturing and upwards of 90% of advanced microchip production, its corporate titans like Foxconn serve as the critical bridge transforming those chips into consumer hardware. With the Nitrogen group alleging the theft of eight terabytes of proprietary schematics belonging to giants like Nvidia, Apple, and Google, the breach transitions from a localized corporate extortion attempt into a glaring national security vulnerability. Against the backdrop of the summit, where tech supremacy, supply-chain independence, and the sovereignty of Taiwan are central flashpoints, the incident vividly illustrates that the physical defense of the Taiwan Strait is only one theater of conflict. In a hyper- connected world, the intellectual property fueling Western artificial intelligence and infrastructure is constantly caught in the crosshairs of asymmetric digital warfare.

Chinese hackers target Azerbaijan
As Middle Eastern and Eastern European energy supplies face ongoing disruptions, China-linked cyber espionage groups are following the economic ripples into new territories. According to new research, the China-aligned group FamousSparrow recently targeted an oil-and-gas company in Azerbaijan. This marks the first time a Chinese state-sponsored actor has been detected targeting industries in the South Caucasus – a vital European Union energy corridor that has historically fallen under Russia’s geopolitical sphere of influence.

Operating between December and February, the attackers used a sophisticated, two- stage DLL sideloading technique to evade detection and deploy the modified “Deed RAT” remote access tool. By splitting the malicious payload into seemingly harmless, separate components that only trigger when executed in a specific sequence, the group successfully bypassed standard sandbox analysis. While Russian threat groups frequently deploy cyber operations to exert influence in the region, this shift indicates that Beijing is actively expanding its own intelligence-gathering footprint into the strategic energy sector.

ETLM Assessment:
FamousSparrow was first identified in 2021, targeting government agencies globally, and has noticeably shared loose tactical overlaps with other notorious Chinese groups like Salt Typhoon. However, experts believe these similarities point to a shared “digital quartermaster” or centralized government repository where Chinese advanced persistent threats (APTs) share and copy successful tools, rather than the groups being identical. Ultimately, the breach was enabled by poor cyber hygiene; the Azerbaijani firm cleared infected workstations but failed to patch the initial entry point – a vulnerable Microsoft Exchange server – allowing FamousSparrow to launch two subsequent attacks. China is likely targeting Azerbaijan now to secure intelligence on a critical European energy corridor as global supply disruptions reshape the geopolitical landscape.

4. Rise in Malware/Ransomware and Phishing

Qilin Ransomware Impacts PNSB Insurance Brokers Sdn Bhd

  • Attack Type: Ransomware
  • Target Industry: Insurance and Financial Services
  • Target Geography: Malaysia
  • Ransomware: Qilin Ransomware
  • Objective: Data Theft, Data Encryption, Financial Gains
  • Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
CYFIRMA observed in an underground forum that a company from Malaysia, PNSB Insurance Brokers Sdn Bhd (https[:]//www[.]pnsbinsbrokers[.]com/), was compromised by Qilin Ransomware. PNSB Insurance Brokers Sdn Bhd is a Malaysia-based insurance and takaful brokerage company. The company operates in the insurance brokerage sector and provides insurance and Shariah-compliant takaful brokerage services for corporate and institutional clients. The ransomware attack targeting PNSB Insurance Brokers appears to have compromised multiple categories of sensitive business and financial data, based on the leaked preview images shared on the ransomware leak site. The exposed information seemingly includes internal financial spreadsheets, invoice records, insurance and brokerage documents, payment details, account statements, customer or client-related records, business correspondence, operational reports, and potentially confidential corporate documentation containing transaction data, policy-related information, and administrative records.

Source: Dark Web

Relevancy & Insights:

  • The Qilin Ransomware group operates a Ransomware-as-a-Service (RaaS) model, allowing affiliates to carry out attacks while Qilin provides infrastructure and malware tools.
  • The Qilin Ransomware group primarily targets countries such as the United States of America, Canada, France, the United Kingdom, and Italy.
  • The Qilin Ransomware group primarily targets industries, including Professional Goods & Services, Manufacturing, Consumer Goods & Services, Real Estate & Construction, and Healthcare.
  • Based on the Qilin Ransomware victims list from 1st Jan 2025 to 19th May 2026, the top 5 Target Countries are as follows:
  • The Top 10 Industries most affected by the Qilin Ransomware victims list from 1st Jan 2025 to 19th May 2026 are as follows:

ETLM Assessment:
According to CYFIRMA’s assessment, Qilin ransomware poses a significant threat to organizations of all sizes. Its evolving tactics, including double extortion (data encryption and leak threats), cross-platform capabilities (Windows and Linux, including VMware ESXi), and a focus on speed and evasion, make it a particularly dangerous actor.

The Gentlemen Ransomware Impacts Nostrum Corporation

  • Attack Type: Ransomware
  • Target Industry: Information Technology (IT)
  • Target Geography: Japan
  • Ransomware: The Gentlemen Ransomware
  • Objective: Data Theft, Data Encryption, Financial Gains
  • Business Impact: Financial Loss, Data Loss, Reputational Damage

Summary:
CYFIRMA observed in an underground forum that a company from Japan, Nostrum Corporation(https[:]//nostrum[.]co[.]jp/), was compromised by The Gentlemen Ransomware. Nostrum Corporation, based in Japan, was founded in 1991 and specializes in smartphone app development, web system development, and website construction. The compromised data includes confidential and sensitive information belonging to the organization.

Source: Dark Web

Relevancy & Insights:

  • The Gentlemen is a relatively highly sophisticated ransomware-as-a-service (RaaS) group that emerged in mid-2025.
  • The Gentlemen Ransomware group primarily targets countries such as the United States of America, Thailand, France, Brazil, and India.
  • The Gentlemen Ransomware group primarily targets industries, including Consumer Goods & Services, Professional Goods & Services, Materials, Manufacturing, and Information Technology.
  • Based on the Gentlemen Ransomware victims list from 1st Jan 2025 to 19th May 2026, the top 5 Target Countries are as follows:
  • The Top 10 Industries most affected by the Gentlemen Ransomware victims list from 1st Jan 2025 to 19th May 2026 are as follows:

ETLM Assessment:
According to CYFIRMA’s assessment, the Gentlemen Ransomware is a highly adaptive and globally active threat that leverages dual-extortion tactics, combining data theft with file encryption. The group employs advanced evasion and persistence techniques, supports cross-platform and scalable ransomware deployment, and conducts targeted attacks across multiple industries and geographic regions. This combination of capabilities makes it a significant risk to enterprise cybersecurity defenses, particularly for organizations with limited detection and incident-response maturity.

5. Vulnerabilities and Exploits

Vulnerability in VMware Fusion

  • Attack Type: Vulnerabilities & Exploits
  • Target Technology: Virtualization / Desktop Hypervisor
  • Vulnerability: CVE-2026-41702
  • CVSS Base Score: 7.8 Source
  • Vulnerability Type: Privilege Escalation
  • Summary: The vulnerability allows a local user to escalate privileges to root.

Relevancy & Insights:
The vulnerability exists due to a time-of-check time-of-use race condition in a SETUID binary when performing an operation.

Impact:
A local user can exploit the race condition to escalate privileges to root.

Affected Products:
https[:]//support[.]broadcom[.]com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454

Recommendations:
Monitoring and Detection: Implement monitoring and detection mechanisms to identify unusual system behavior that might indicate an attempted exploitation of this vulnerability.

TOP 5 AFFECTED TECHNOLOGIES OF THE WEEK
This week, CYFIRMA researchers have observed significant impacts on various technologies due to a range of vulnerabilities. The following are the top 5 most affected technologies.

ETLM Assessment
Vulnerability in VMware Fusion introduces significant risks to environments that rely on desktop virtualization for software development, testing, and isolated workload execution. As VMware Fusion is widely used to host virtual machines across enterprise and professional environments, exploitation of this vulnerability could allow attackers to gain elevated privileges on host systems, potentially compromising both virtualized workloads and underlying infrastructure. Organizations leveraging virtualization platforms must ensure timely patching, enforce least privilege access controls, and continuously monitor host activity to reduce the risk of privilege abuse. Addressing this vulnerability is essential to maintaining the integrity, security, and operational stability of virtualization environments.

6. Latest Cyber-Attacks, Incidents, and Breaches

INC Ransomware attacked and published the data of Lals Group

  • Threat Actor: INC Ransomware
  • Attack Type: Ransomware
  • Objective: Data Leak, Financial Gains
  • Target Technology: Web Applications
  • Target Industry: Retail and Consumer Services
  • Target Geography: The United Arab Emirates (UAE)
  • Business Impact: Operational Disruption, Data Loss, Financial Loss, Potential Reputational Damage

Summary:
Recently, we observed that INC Ransomware attacked and published the data of Lals Group (https[:]//www[.]lalsgroup[.]com/) on its dark web website. Lals Group is a large UAE-based family business group operating in retail, FMCG, distribution, home goods, and lifestyle brands across the GCC region. Founded in 1979, the company manages well-known brands and retail chains, including Homes ‘R’ US, Daiso Japan, Carter’s, Mom Store, and others. Lals Group operates across the UAE, Qatar, Bahrain, Oman, Kuwait, and Saudi Arabia, with activities spanning retail stores, shopping malls, and logistics services. The ransomware attack against Lals Group allegedly resulted in the compromise of approximately 400 GB of corporate data, according to the leak page shown in the image. The exposed samples suggest that the stolen information may include internal financial spreadsheets, employee or HR records, identification documents, operational and sales reports, distribution and inventory data, customer or vendor-related information, accounting records, and business management documents. The preview files display structured databases, payroll or employee-related spreadsheets, tabulated financial data, and scanned identity documentation, indicating that both sensitive corporate operational data and personally identifiable information (PII) may have been exfiltrated during the ransomware incident.

Source: Dark Web

Relevancy & Insights:

  • INC Ransomware, also known as Incransom, is a cyber threat that emerged in mid-2023. Incransom uses strong encryption algorithms to lock files, making recovery without the decryption key virtually impossible. The ransomware typically appends specific file extensions to encrypted files, signalling that they have been compromised.
  • INC Ransomware is commonly distributed through:
  • Phishing emails: Containing malicious attachments or links that, when opened, deploy the ransomware.
  • Malicious downloads: From compromised websites or software packages.

ETLM Assessment:
Based on recent assessments by CYFIRMA, INC Ransomware represents a significant threat within the evolving landscape of ransomware attacks. Its use of strong encryption methods and double extortion tactics highlights the increasing sophistication of cybercriminal operations. Organizations are advised to enhance their cybersecurity measures by implementing robust defenses against phishing attacks, maintaining updated security protocols, and monitoring for unusual network activity to mitigate risks associated with this and other ransomware variants. Continuous vigilance is essential to protect against the threats posed by emerging ransomware groups like INC Ransomware.

7. Data Leaks

Kuwait Ministry of Electricity Data Advertised on a Leak Site

  • Attack Type: Data leak
  • Target Industry: Government
  • Target Geography: Kuwait
  • Objective: Financial Gains
  • Business Impact: Data Loss, Reputational Damage

Summary: The CYFIRMA research team identified a post on a dark web forum by a threat actor using the alias “Revesky,” claiming responsibility for a significant data leak allegedly targeting the Ministry of Electricity of Kuwait through the domain mew[.]gov[.]kw. In the forum post, the actor claimed to have leaked employee- related records associated with the Ministry of Electricity, describing the incident as a breach affecting personnel data belonging to the government entity. The post, published on a cybercrime forum in May 2026, advertised access to what the actor described as a database containing information on ministry employees, with the full dataset hidden behind restricted forum access.

According to the threat actor’s statement, the allegedly compromised data includes sensitive employee-related information such as full names, job status details, phone numbers, phone-related information, and job location records. The actor presented the leak as a complete exposure of ministry employee data and included references to downloadable or restricted-access content, increasing the credibility and potential impact of the claim. While the exact method of compromise was not disclosed in the post, the nature of the exposed information suggests a possible breach involving internal personnel management systems, unsecured databases, or compromised administrative access.

Based on the threat actor’s claims and the information visible in the forum post, the compromised dataset reportedly includes:

  • Full employee names
  • Employment or job status information
  • Phone numbers and related contact details
  • Workplace or job location information
  • Potentially additional internal personnel records hidden within the restricted dataset

If validated, the exposure of employee information belonging to a government ministry could create substantial security and privacy risks for affected individuals and the organization itself. The availability of employee identities, contact numbers, and workplace details could enable targeted phishing campaigns, impersonation attempts, social engineering attacks, and credential-harvesting operations aimed at government personnel. Threat actors could also leverage the information to conduct reconnaissance against critical infrastructure entities associated with Kuwait’s energy and electricity sector.

Particularly concerning is the potential misuse of employee contact and location information to facilitate spear-phishing attacks against ministry staff or contractors with privileged access to government systems. Such exposure may also increase the risk of identity theft, fraudulent communications, and intelligence-gathering activities by cybercriminal or state-aligned threat actors targeting critical national infrastructure.

This incident highlights the ongoing cybersecurity risks facing government institutions and critical infrastructure organizations, particularly those operating within the energy and utilities sector. If confirmed, the breach would represent a potentially serious exposure of personally identifiable information (PII) and operational personnel data. The incident further underscores the importance of implementing robust access controls, continuous monitoring of exposed assets, employee data protection measures, and proactive dark web intelligence monitoring to identify and mitigate emerging cyber threats.

The authenticity of this Access sale remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

Okinawa Tourist Service (OTS) Data Advertised on a Leak Site

  • Attack Type: Data leak
  • Target Industry: Travel, Tourism & Hospitality
  • Target Geography: Japan
  • Objective: Data Theft, Financial Gains
  • Business Impact: Data Loss, Reputational Damage

Summary: The CYFIRMA research team identified a post on a dark web forum by a threat actor using the alias “Sexybroker,” advertising the alleged sale and exposure of a large-scale customer database associated with OTS International Japan, linked to the domain otsinternational[.]jp. In the forum post, the actor claimed to possess sensitive customer information belonging to Okinawa Tourist Service (OTS), a major travel and transportation service provider in Japan specializing in vehicle rentals and tourism-related operations. The post suggests that the dataset contains approximately 600,000 customer records and includes personally identifiable information (PII), booking-related metadata, and government-issued identity documentation.

According to the threat actor’s description, the compromised dataset was allegedly extracted from internal customer management and booking systems associated with the OTS platform. The actor shared screenshots of customer identification cards, drivers’ licenses, and database field structures as proof of possession, increasing the credibility of the claim. The forum post also referenced the sale of the dataset and included communication channels for negotiation, indicating a clear financial motivation behind the breach.

Based on the threat actor’s claims and the visible sample data shared in the forum post, the compromised dataset reportedly includes:

  • Internal customer identifiers and database record IDs
  • Full customer names, including kana-formatted Japanese name fields
  • Dates of birth and gender information
  • Email addresses and phone numbers
  • Residential address and regional location details
  • Facebook-linked account identifiers
  • Booking confirmation codes and reservation metadata
  • Driver license numbers and driver verification information
  • Driver license expiration dates and issuance details
  • Front and back images of customer identification cards and licenses
  • Account creation and update timestamps
  • Customer profile verification and transportation service usage information

Based on the information provided in the post, the actor assigned an estimated value of approximately USD 2,400 to the database.

The authenticity of this Access sale remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

Relevancy & Insights:
Financially motivated cybercriminals are continuously looking for exposed and vulnerable systems and applications to exploit. A significant number of these malicious actors congregate within underground forums, where they discuss cybercrime and trade stolen digital assets. Operating discreetly, these opportunistic attackers target unpatched systems or vulnerabilities in applications to gain access and steal valuable data. Subsequently, the stolen data is advertised for sale within underground markets, where it can be acquired, repurposed, and utilized by other malicious actors in further illicit activities.

ETLM Assessment:
The threat actor “Sexybroker” is assessed to be an active and capable cybercriminal entity involved primarily in data breach and leak operations. Multiple credible indicators associate the actor with incidents involving unauthorized access to organizational systems, followed by the publication, sale, or distribution of stolen data on underground forums. These activities reflect the increasing sophistication and persistence of cyber threats emerging from organized cybercriminal ecosystems, emphasizing the need for organizations to strengthen their security posture through continuous monitoring, enhanced threat intelligence capabilities, and proactive cybersecurity measures to safeguard sensitive data and critical assets.

Recommendations: Enhance the cybersecurity posture by:

  • Updating all software products to their latest versions is essential to mitigate the risk of vulnerabilities being exploited.
  • Ensure proper database configuration to mitigate the risk of database-related attacks.
  • Establish robust password management policies, incorporating multi-factor authentication and role-based access to fortify credential security and prevent unauthorized access.

8. Other Observations

The CYFIRMA research team identified a dark web forum post by a threat actor using the alias “zSenior,” who claimed responsibility for compromising and publicly disclosing a database linked to YellowSlate.com, an India-based school search and educational discovery platform. The actor alleged that the intrusion occurred in May 2026 and resulted in full access to the platform’s database, with part of the dataset already leaked and a sample of about 10,000 records offered for download.

According to the post, the exposed database contains a large amount of customer data, lead-generation, school, and transactional data gathered through the platform’s educational search and marketing services. The actor claimed the dataset includes 12,398,005 records across 11,375 CSV files, totaling about 7.2 GB. Sample records shared in the forum appear to include school lead data, customer contact details, sales records, marketing attribution metadata, and order-related information, which lends some credibility to the claim.

Based on the alleged sample data, the compromised dataset reportedly includes: Full names of customers, parents, students, and prospects.

  • Email addresses and phone numbers.
  • School names, locations, and administrative details.
  • Alternative contact information and referral details.
  • Lead generation and prospect tracking records.
  • Client status information and administrative comments.
  • Marketing campaign identifiers and attribution metadata.
  • Facebook advertising identifiers and tracking information.
  • UTM source, medium, campaign, content, and term parameters.
  • Device, browser, operating system, network, and platform information.
  • IP addresses and lead acquisition sources.
  • Order numbers, order dates, and transaction identifiers.
  • Product names, variants, SKUs, and quantity information.
  • Currency, order totals, payment-related metadata, and invoice details.
  • Due dates, overdue status information, and customer account records.
  • Record creation and update timestamps, plus activity logs.

The threat actor claimed the exposure involves more than 12.3 million records, potentially affecting schools, parents, students, institutions, prospects, and customers connected to the platform. Because the data includes contact details, educational records, marketing metadata, and transactional information, it could be misused for phishing, business email compromise, identity theft, fraudulent communications, and social engineering.

The authenticity of this breach remains unverified at the time of reporting, as the claim originates solely from the threat actor.

Source: Underground Forums

STRATEGIC RECOMMENDATIONS

  • Attack Surface Management should be adopted by organisations, ensuring that a continuous closed-loop process is created between attack surface monitoring and security testing.
  • Deploy a unified threat management strategy – including malware detection, deep learning neural networks, and anti-exploit technology – combined with vulnerability and risk mitigation processes.
  • Incorporate Digital Risk Protection (DRP) in the overall security posture that acts as a proactive defence against external threats targeting unsuspecting customers.
  • Implement a holistic security strategy that includes controls for attack surface reduction, effective patch management, and active network monitoring, through next-generation security solutions and a ready-to-go incident response plan.
  • Create risk-based vulnerability management with deep knowledge about each asset. Assign a triaged risk score based on the type of vulnerability and criticality of the asset to help ensure that the most severe and dangerous vulnerabilities are dealt with first.

MANAGEMENT RECOMMENDATIONS

  • Take advantage of global Cyber Intelligence, providing valuable insights on threat actor activity, detection, and mitigation techniques.
  • Proactively monitor the effectiveness of risk-based information security strategy, the security controls applied, and the proper implementation of security technologies, followed by corrective actions, remediations, and lessons learned.
  • Consider implementing Network Traffic Analysis (NTA) and Network Detection and Response (NDR) security systems to compensate for the shortcomings of EDR and SIEM solutions.
  • Ensure that detection processes are tested to ensure awareness of anomalous events. Timely communication of anomalies should be continuously evolved to keep up with refined ransomware threats.

TACTICAL RECOMMENDATIONS

  • Patch software/applications as soon as updates are available. Where feasible, automated remediation should be deployed since vulnerabilities are one of the top attack vectors.
  • Consider using security automation to speed up threat detection, improve incident response, increase visibility of security metrics, and rapid execution of security checklists.
  • Build and undertake safeguarding measures by monitoring/ blocking the IOCs and strengthening defences based on the tactical intelligence provided.
  • Deploy detection technologies that are behavioral anomaly-based to detect ransomware attacks and help to take appropriate measures.
  • Implement a combination of security controls, such as reCAPTCHA (completely Automated Public Turing test to tell Computers and Humans Apart), Device fingerprinting, IP backlisting, Rate-limiting, and Account lockout to thwart automated brute-force attacks.
  • Ensure email and web content filtering uses real-time blocklists, reputation services, and other similar mechanisms to avoid accepting content from known and potentially malicious sources.

Situational Awareness – Cyber News

Please find the Geography-Wise and Industry-Wise breakup of cyber news for the last 5 days as part of the situational awareness pillar.

For situational awareness intelligence and specific insights mapped to your organisation’s geography, industry, and technology, please access DeCYFIR.