CYFIRMA Research

#CYFIRMAResearch - October 2026 #Ransomware #ThreatIntelligence Briefing: #Ransomware activity rebounded in October 2026, with 1178 publicly disclosed victims worldwide, a 36.7% increase from September's 862, highlighting the continued resilience and expansion of the ransomware-as-a-service (#RaaS) ecosystem. #CyberSecurity #ThreatIntelligence #CYFIRMA #CyberThreats #ThreatLandscape #CyberDefense #InfoSec #DigitalRisk cyfirma.com/research/ransom-…

🚨 #PHP2Shell is being actively exploited. #CVE2026109618 + #CVE2026109619 (CVSS 9.2) = unauthenticated #RCE in #PHPcore. Updating your CMS does NOT fix it — the flaw is in #PHP itself. #CYFIRMA captured the attackers’ 216-host target list; attribution: #DPRK/#Lazarus-nexus, high confidence. Patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 #CyberSecurity #ThreatIntelligence #VulnerabilityManagement #CVE #CYFIRMAresearch cyfirma.com/blogs/php2shell-…

THREAT HORIZON: After #BlackOctober. A disclosure wave, not a coordinated campaign, and likely to repeat. Most supplier incidents trace to basic control gaps, and #AI is finding flaws faster than suppliers can fix them. #ThreatIntelligence #SupplyChainSecurity #CyberSecurity #CTI #CYFIRMA cyfirma.com/research/threat-…

New CYFIRMA First Sight: PHP2Shell — suspected DPRK-nexus exploitation of PHP core Korean-speaking operators are chaining two unauthenticated remote-code-execution flaws in PHP core — CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2) — to drop web shells on internet-facing servers. What we're seeing: • Operators claim they began with a 216-host target set and have since expanded it to 581 hosts across 10 countries • Low-and-slow scanning, AI-ranked public PoCs, rotating source nodes and burn discipline to slip under rate-based alerts • Targeting skewed to government, banking, telco, logistics and trading platforms • A dual mandate — financial gain alongside espionage (attribution held at limited-to-moderate confidence) What to do now: ✅ Patch and restart every PHP worker — 8.5.12+, 8.4.27+, 8.3.36+, 8.2.35+ (a reload that leaves old workers alive stays vulnerable) ✅ Hunt web/WAF/proxy logs back to 17 Oct 2026 for multipart anomalies, unexpected PHP files and PHP-spawned shells ✅ Preserve volatile evidence before patching — a restart destroys the -109619 artefact ✅ Block/monitor the published scan-node infrastructure #ThreatIntel #PHP #CVE #DPRK #IncidentResponse #CYFIRMA cyfirma.com/research/cyfirma…

#CYFIRMAResearch is thrilled to share insights on the active #APT Star Blizzard. Stay ahead with insights on Star Blizzard's motives, targeted industries, targeted countries, and TTPs. #StarBlizzard #CyberSecurity #CYFIRMA #threatintelligence #campaign #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/adversa…

In 2019, 40% of detections were malware-free. Today it’s 82%. #CYFIRMA predicted that fewer than 10–15% of cases will need malware reverse-engineering. 90%+ of attribution will come from identity, cloud, and infrastructure telemetry, and Malware becoming disposable loader logic. Prediction 7 of the CYFIRMA Threat Horizon Series Q3 says: 82% of detections were malware-free in the latest Global Threat Report; 52% of intrusions detected internally, up from 43% (CrowdStrike / M-Trends). AI-agent-triggered detection produced 2.5x more threat leads than manual hunting (CrowdStrike Threat Hunting Report, Aug ‘26). #ThreatIntelligence #IncidentResponse #DFIR #CloudSecurity #CyberSecurity #CISO #ThreatHorizonSeries cyfirma.com/research/threat-…

#CYFIRMA’s latest research examines the evolving #cyberthreat landscape affecting India’s #healthcare and #pharmaceutical ecosystem in 2026. Key findings include: 20 healthcare #ransomware victim entries recorded during January–August 2026. #Databreach and #dataleak observations were prominent in the monitored dataset. #APT-associated observations, #darkweb listings, and #Telegram claims highlight potential risks. #Thirdparty exposure, #vulnerability exploitation, #phishing, and potential #intellectualproperty theft remain important areas of concern. #ThreatIntelligence #CyberSecurity #HealthcareSecurity #PharmaSecurity #IndiaCyberSecurity #ThreatLandscape2026 cyfirma.com/research/india-h…

#AI is changing the financial fraud landscape, making #impersonation more convincing and #cyberthreats more difficult to detect. For #India’s #Banking, #FinancialServices and #Insurance (#BFSI) sector, the convergence of AI-enabled fraud and external cyber exposure presents growing challenges. #CYFIRMA #CyberSecurity #ThreatIntelligence #FinancialFraud #ArtificialIntelligence #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/ai-driv…

PHP2Shell update: the DPRK-nexus campaign has moved from planning to active scanning. CYFIRMA has issued Version 3 of its Early Warning advisory on PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS v4.0 9.2 — unauthenticated RCE in the PHP runtime itself). What’s new since our 22–23 October reporting: 🔴 The operators report a filtered target set of 216 internet-facing hosts that still advertise unpatched PHP — across the US, Japan, South Korea, Thailand, Indonesia, Taiwan, Australia, India, Singapore, UAE, Saudi Arabia and the EU, with government, financial services, logistics, aviation, manufacturing and online transaction platforms prioritised. 🔴 Active weakness checks are being run from a separate set of 21 compromised nodes, deliberately low-volume and paced to stay under rate-based alerting. Roughly a third of the target set had already been touched at the time of collection. 🔴 CYFIRMA observed the same 21 addresses performing web-shell tooling and upload-progress session-poisoning attempts in the hours before this update. They are now published as blocking indicators alongside the 17 source IPs from Version 2. What to do now: ✅ Patch to PHP 8.5.12+ / 8.4.27+ / 8.3.36+ / 8.2.35+ and restart every worker — a reload leaves the stale state in place. ✅ Hosts still bannering an older PHP version are exactly what the operators kept on their list. Isolate what you can’t patch within hours; Apache mod_php first. ✅ Hunt back to 17 October across extended time windows — this scanning is designed not to trip volume alerts. No launch date has been stated. The next adversary milestone is their shortlist of highest-confidence hosts. The channel remains under continuous monitoring, and the advisory will be re-issued on any launch statement or confirmed exploitation. #PHP2Shell #ThreatIntelligence #EarlyWarning #Lazarus #DPRK #CVE2026109618 #CVE2026109619 #CYFIRMA #DecodingThreats #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/cyfirma…

#PHP2Shell is about to go from opportunistic to targeted. #CYFIRMA has surfaced a #Korean-speaking threat actor, assessed with moderate confidence to be linked to the #Lazarus ecosystem, coordinating sector- and country-prioritised exploitation of the two critical #PHP runtime flaws known as PHP2Shell (#CVE2026109618 / #CVE2026109619, CVSS v4.0 9.2, unauthenticated #RCE). What makes this different from the scanning everyone is already seeing: ▪️ Deliberate targeting: government and financial institutions first, then logistics, ports, airports, and manufacturing ▪️ Priority geographies: US, Japan, Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU ▪️ Disciplined tradecraft: public PoCs ranked with a local AI model, lab-validated before use, no noisy scanning ▪️ 15 pieces of staging infrastructure already shared; first filtered target list due by 25 October The flaw sits in the PHP runtime itself, not in any CMS or framework, so updating WordPress, Drupal, Magento, or Laravel does not fix it. One multipart POST can reach code execution before any application code runs. What to do now: ✅ Patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart every worker (a reload is not enough) ✅ Isolate anything you cannot patch within hours; Apache mod_php first ✅ Hunt back to 17 October 2026 ✅ Deploy the IOCs, Sigma and YARA content in the report Full advisory (TLP: CLEAR) with 33 IOCs, detection rules, and interim controls. #CyberSecurity #ThreatIntelligence #DPRK #CYFIRMA #CYFIRMA #ExternalThreatLandscapeManagement #ETLM cyfirma.com/research/cyfirma…

In January, we said #AI would make attacks cheaper, faster, and more reliable. Nine months on, 82.6% of #phishing emails are written by a machine. Latest data from Prediction 6 of this #CYFIRMA Series says: AI-driven attacks up by 56% year on year; 1 in 4 organisations hit; roughly $1M added to the cost of a breach (IBM Cost of a Data Breach, Jul ‘26). The first in-the-wild zero-day exploit believed to be AI-developed (Google Threat Intelligence Group, May ‘25). #AISecurity #ThreatIntelligence #CyberSecurity #CISO cyfirma.com/research/crystal…

The next gap in your #AI agent’s security model may not be in its tool list. #CYFIRMA’s new report, “Shadow Channels,” examines three architectural gaps that reviews what declared tools and permissions can miss. 1. Trace Drain: Observability pipelines capture prompts, completions, and tool arguments as part of normal operation. Could a trusted telemetry path become a quieter route for data to leave? 2. Sleeper Context: Saved memories can outlive the conversations that created them, making it harder to trace a later behavior change back to its source. 3. The Sighted Adversary: Computer-use agents can remove the human-attention cost that many UI friction controls quietly relied on. #CyberSecurity #ThreatIntelligence #ArtificialIntelligence #AgenticAI #AISecurity #ThreatModeling #SupplyChainSecurity #InformationSecurity #RiskManagement #EnterpriseSecurity cyfirma.com/research/shadow-…

#CYFIRMAResearch Team just kicked off an #ExploitRadarSummary! Get the latest insights on Fortnightly #vulnerabilities, severity levels, industry-specific threats, current trends, and much more. Stay informed, stay secure! #CyberSecurity #VulnerabilitySummary #ExternalThreatLandscapeManagement #ETLM #CYFIRMA cyfirma.com/research/exploit…

New #CYFIRMA FIRST SIGHT report: N0n Extortion Group Targets Global Shipping. #N0n, a #datatheft #extortion group active since 18 September 2026, posted 38 port, terminal, #shipping and #logistics organisations to its leak site on 12 October, all within 23 minutes. The batch spans 18 countries and territories, with #SouthKorea the most affected. All 38 face a single publication deadline of 19 October. #CyberSecurity #ThreatIntelligence #CYFIRMAResearch #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/non-ext…

#CYFIRMAResearch - September 2026 #Ransomware #ThreatIntelligence Briefing. Ransomware activity in September 2026 settled at 862 publicly disclosed victims worldwide, down 26.3% from August's 1170, based on #CYFIRMA's final full-month leak-site tracker count. Affiliate tradecraft around RMM abuse, edge access, #BYOVD, and data extortion remained intact. #CyberSecurity #CyberThreats #RaaS #Qilin #ThreatLandscape #CyberDefense #DigitalRisk cyfirma.com/research/trackin…

#SAARC Telecom Threat Landscape | Apr–Sep 2026 Telecom infrastructure is becoming a bigger and more complex cyber target. #CYFIRMA's latest assessment highlights key trends across #darkweb exposure, #ransomware, #vulnerability exploitation, credential compromise, #APT activity, and emerging 5G/cloud/API risks. The key takeaway? Visibility is no longer optional. Protecting subscriber data, privileged access, network infrastructure, and third-party connections requires continuous monitoring and intelligence-led security. #CyberSecurity #TelecomSecurity #ThreatIntelligence #SAARC #Ransomware #APT #DarkWeb #5G #CyberThreats cyfirma.com/research/sector-…

Prediction 4 of this #CYFIRMA Series observes that 62% of organisations were hit by a #deepfake attack in the past 12 months (Gartner). What we expect to see: The first confirmed fraud using a real-time 3D executive persona in a spatial or AR/VR meeting. Liveness detection built on 2D cues fails as a control, and “presence verification” becomes a product category. Immersive synthetic personas used in state influence operations and recruitment fraud. EU AI Act Article 50 enforcement produces the first deepfake-labelling fines. Our trajectory metric: deepfake fraud attempts per day (Pindrop) — 0.03 in 2023, 7 in 2024, 18 in 2025. Our projection for 2027: 60 per day. #SyntheticMedia #IdentityVerification #ThreatIntelligence #CyberSecurity #CISO #ThreatHorizon2027 cyfirma.com/research/crystal…

#CYFIRMAResearch is thrilled to share the Adversary Unmasked APT Quarterly report for July 2026 to September 2026. Stay ahead with #Iranian, #Russian, #Chinese, and #NorthKorean #APT #ThreatActor Activities, covering techniques observed, targeted industries, countries, and technology. #CyberSecurity #CYFIRMA #ExternalThreatLandscapeManagement #ETLM cyfirma.com/research/adversa…

#CYFIRMAResearch presents #ExploitRadarSummary! Get the latest insights on Fortnightly #vulnerabilities, severity levels, industry-specific threats, current trends, and much more. #CyberSecurity #VulnerabilitySummary #ExternalThreatLandscapeManagemen #CYFIRMA cyfirma.com/research/exploit…

#CYFIRMA #EducationIndustry Report | Q2 2026 | Overall industry risk: 6.0/10 - ELEVATED. 85 #Ransomware victims across 28 countries, up 19.7% quarter-on-quarter. #Universities & #ResearchInstitutions accounted for almost half of all sector victims. 12 #APT campaigns touched education orgs, and the actor set was exclusively #statesponsored. #CyberSecurity #externalthreatlandscapemanagement #ThreatIntelligence #CYFIRMAResearch #CYFIRMAIndustryReport #Qilin #Thegentlemen cyfirma.com/research/62735/