Advertise on podcast: CYFIRMA Research

CYFIRMA Research - September 2026 Ransomware Threat Intelligence Briefing Ransomware activity in September 2026 settled at 862 publicly disclosed victims worldwide, down 26.3% from August's 1170, based on CYFIRMA's final full-month leak-site tracker count. Affiliate tradecraft around RMM abuse, edge access, BYOVD, and data extortion remained intact. Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-september-2026/  #Ransomware #CyberSecurity #ThreatIntelligence #CYFIRMA #CyberThreats #RaaS #ThreatLandscape #CyberDefense #InfoSec #DigitalRisk #RansomWatch https://www.cyfirma.com/

The CYFIRMA Research team has published its Australia & New Zealand Cyber Threat Landscape Report, examining cyber threat activity across Mining, Financial Services, Manufacturing, and Banking from January 2025 onward. The research highlights a persistent identity and access-driven threat landscape, with credential-based attacks, ransomware, compromised access, and underground-market activity continuing to shape the regional risk environment.  Link to the Research Report: https://www.cyfirma.com/research/healthcare-cyber-threat-landscape-australia-new-zealand/ #CYFIRMAResearch #CyberSecurity #ThreatIntelligence #CyberThreatLandscape #Australia #NewZealand #ANZ #ETLM #Ransomware #DarkWeb #CyberThreats #CyberRisk https://www.cyfirma.com/

Tax-Themed Malware Campaign Abusing Indian Income Tax Department Identity Researchers at CYFIRMA have identified and analysed a malware distribution campaign abusing the Indian Income Tax Department theme to target users in India. The campaign uses multiple fraudulent tax-themed domains, deceptive assessment notices, and a malicious VHDX disk image to deliver a staged malware payload.  The campaign demonstrates a multi-stage malware delivery operation combining government impersonation, tax-themed social engineering, VHDX-based payload delivery, file masquerading, and process injection. CYFIRMA assesses with low confidence that the activity may be linked to a China-nexus threat actor or activity cluster targeting Indian entities; infrastructure geolocation alone is not sufficient to establish definitive attribution. Link to the Research Report: https://www.cyfirma.com/research/fake-tax-themed-phishing-campaign-delivers-malware/ #CYFIRMA #ThreatIntelligence #CyberSecurity #MalwareAnalysis #ThreatResearch #IncomeTax #Phishing #Malware #CyberThreat https://www.cyfirma.com/

August 2026 Ransomware Threat Intelligence Briefing Ransomware activity rebounded in August 2026, with 1046 publicly disclosed victims worldwide, an 18.2% increase from July, highlighting the continued resilience and expansion of the ransomware-as-a-service (RaaS) ecosystem. In this episode, we break down: • The most active ransomware groups shaping the August threat landscape, including Qilin and Thegentlemen • Industries and countries experiencing the highest levels of targeting • The growing shift toward edge-device exploitation, identity-focused intrusion, and compressed attack timelines • How data-centric extortion and trusted-platform abuse are expanding attacker reach • Why ransomware is evolving into a highly specialized cybercriminal economy built on access brokers, extortion services, and criminal infrastructure providers Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-aug-2026/ #Ransomware #CyberSecurity #ThreatIntelligence #CYFIRMA #CyberThreats #RaaS #ThreatLandscape #CyberDefense #InfoSec #DigitalRisk #ETLM #ExternalThreatLandscapeManagement https://www.cyfirma.com/

India BFSI Cyber Threat Landscape 2026 India’s BFSI ecosystem is entering a more complex cyber-risk environment where data exposure, ransomware, digital-payment fraud, identity compromise, AI-enabled social engineering, cloud/SaaS abuse and third-party risk are increasingly converging. Our latest analysis of validated threat activity identified 46 data-breach incidents, 37 data-leak incidents and 33 credit-card-related incidents, alongside hacktivism, DDoS, web exploitation and ransomware activity during the reporting period. The report examines how attackers are moving beyond traditional infrastructure compromise, leveraging employees, customers, identities, mobile channels, legitimate cloud platforms and interconnected technology providers to reach financial assets and sensitive data. Key areas covered include: ▪️ APT & malware activity targeting BFSI ▪️ Ransomware and ecosystem exposure ▪️ Data breaches, leaks & financial information exposure ▪️ UPI, mobile banking & payment fraud ▪️ AI, deepfake & social-engineering risks ▪️ Cloud/SaaS and third-party abuse ▪️ Vulnerability and exploitation trends ▪️ CERT-In / DPDP-aligned incident response ▪️ Strategic, tactical and operational priorities for BFSI leaders The central message: cybersecurity and fraud can no longer be managed as separate risks. Protecting India’s financial ecosystem requires an integrated approach to identity, data, payments, resilience, cloud security, third-party risk and intelligence-led detection. From threat visibility to actionable resilience. Link to the Research Report: https://www.cyfirma.com/research/cyber-threat-landscape-report-india-bfsi-2026/ #IndiaBFSI #CyberSecurity #ThreatIntelligence #BankingSecurity #FinancialServices #CyberThreats #Ransomware #DataBreach #DigitalPayments #AI #CyberRisk #BFSI #IndiaCyberSecurity https://www.cyfirma.com/

Deepfakes didn't stay a disinformation problem; they've become a manufacturing supply chain risk. Our latest cyber threat intelligence report breaks down what's actually happening on the ground: Executive impersonation fraud is scaling fast: Arup lost $25M after attackers ran a live video call where every "executive" on screen was AI-generated. Pindrop tracked a 1,210% rise in AI-driven fraud attacks across major U.S. customers. Blended-channel attacks are beating single-channel checks: a spoofed email + a deepfake "confirmation" call from the CEO is now enough to defeat standard verification — FBI IC3 logged a 312% YoY jump in deepfake-linked BEC losses. The workforce itself is a threat vector: 300+ companies have unknowingly hired North Korean operatives who passed live video interviews using real-time deepfake overlays — sophisticated enough to beat conventional liveness detection. No single fix closes the gap: even Microsoft and EU regulators agree — provenance standards, watermarking, and detection tools all have coverage gaps. The real defence is process: out-of-band verification, unscripted interview questions, and a default posture of "verify before you trust." The clearest lesson for manufacturers: the exposure isn't a software flaw — it's the assumption that a familiar face or voice on a call is proof of identity. Link to the Research Report: https://www.cyfirma.com/research/deepfake-risks-in-manufacturing-supply-chains/ #CyberThreatIntelligence #Deepfakes #ManufacturingSecurity #SupplyChainRisk #CyberSecurity #ThreatIntel #InfoSec #CYFIRMA #ETLM #ExternalThreatLandscapeManagement https://www.cyfirma.com/

A stolen credential at one company just breached a completely different company.   No malware in that second half. No phishing email either. Just an OAuth grant nobody flagged as risky. CYFIRMA's new report, "The Trust Cascade," walks through four real, documented intrusions from the past year and finds they aren't isolated incidents. They're the same attack surface, entered from different points.   * An infostealer hits one employee's laptop. A completely unrelated company's OAuth connection to that same AI tool becomes the way in. * One AI sales-agent vendor gets compromised. Its stolen tokens grant MFA-bypassing access into 700+ downstream organizations' Salesforce environments. (Salesloft / Drift) * Coordinated AI sub-agents run a dozen reconnaissance waves against government systems in days, not months. (Taiwan) * A single crafted email hijacks an AI assistant's reasoning and exfiltrates data without a single credential being touched. (EchoLeak)   Four different entry points. One outcome: identity, SaaS integrations, and AI agents behaving as a single connected attack surface, not four separate ones.    As agentic AI adoption accelerates, the question isn't whether identity, SaaS platforms, and AI agents will keep converging into one exploitable surface. They already have. The question is whether security ownership is converging just as fast. Link to the Research Report: https://www.cyfirma.com/research/the-trust-cascade/ #CyberSecurity #ThreatIntelligence #ArtificialIntelligence #AI #NonHumanIdentity #AgenticAI #ThreatResearch #RiskManagement #EnterpriseSecurity #CloudSecurity https://www.cyfirma.com/

While conventional weapons in the Middle East may pause under a shaky ceasefire, the wires remain hot. Our latest analysis dives into the fragile U.S.–Iran conflict over the Hormuz Strait, exploring how a permanent grey-zone and cyber attrition are shaping a new era in the Middle East. Link to the Research Report: https://www.cyfirma.com/research/permanent-attrition-and-the-shifting-grey-zone-in-the-strait-of-hormuz/ #IranWar #HormuzStrait #USForeignPolicy #CyberWarfare #CYFIRMAResearch #ThreatIntelligence #cybersecurity #ETLM #currentaffairs #CYFIRMA https://www.cyfirma.com/

Technical Analysis: Lucid Stealer Understanding how modern information stealers operate is essential for strengthening enterprise defenses.   Our comprehensive technical analysis of Lucid Stealer provides an in-depth breakdown of its complete execution lifecycle—from payload initialization and anti-analysis techniques to browser credential theft, cryptocurrency wallet targeting, PowerShell-based keylogging, privilege elevation, command-and-control (C2) communication, and data exfiltration.   The report also presents detailed reverse engineering findings, execution flow analysis, and practical detection and mitigation guidance to help security teams better understand and defend against this threat. Link to the Research Report: https://www.cyfirma.com/research/technical-analysis-of-lucid-stealer-execution-capabilities-and-c2-infrastructure/ #MalwareAnalysis #InfoStealer #CYFIRMAResearch #ThreatIntelligence #CyberSecurity #InfoSec #ETLM #ExternalThreatLandscapeManagement https://www.cyfirma.com/

July 2026 Ransomware Threat Intelligence Briefing Ransomware activity rebounded sharply in July 2026, with 883 publicly disclosed victims worldwide, a 21.3% increase from June and one of the highest monthly totals of the year, highlighting the continued resilience and expansion of the ransomware-as-a-service (RaaS) ecosystem. Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-jul-2026/ #Ransomware #CyberSecurity #ThreatIntelligence #CYFIRMA #CyberThreats #RaaS #ThreatLandscape #CyberDefense #InfoSec #DigitalRisk #ExternalThreatLandscapeManagement #ETLM https://www.cyfirma.com/

AI is changing the cybersecurity threat landscape and accelerating the speed, scale, and sophistication of cyberattacks. CYFIRMA’s latest insights on Thailand’s AI-era cyber risk environment highlight a critical shift: AI is not necessarily creating entirely new attack categories. Instead, it is acting as a force multiplier, enabling threat actors to conduct reconnaissance, personalise phishing and social engineering, exploit vulnerabilities, and coordinate campaigns faster than ever. From AI-enhanced phishing and deepfake impersonation to ransomware, credential attacks, supply-chain compromise, and Shadow AI risks, organisations must rethink cybersecurity beyond traditional reactive controls. Link to the Research Report: https://www.cyfirma.com/research/thailands-ai-era-cybersecurity-threat-landscape-and-cyfirmas-solutions/ #CYFIRMA #Cybersecurity #ArtificialIntelligence #AI #CyberThreatIntelligence #ThreatIntelligence #CyberResilience #Ransomware #Thailand #ETLM #ExternalThreatLandscapeManagement https://www.cyfirma.com/

UK & Ireland Threat Landscape Report 2026 The cyber threat landscape across the United Kingdom and Ireland continues to evolve as ransomware groups, data leak actors, and financially motivated adversaries refine their tactics and expand their operational reach. Our latest The UK & Ireland Threat Landscape Report delivers an intelligence-led assessment of the region's evolving threat environment, providing actionable insights into the threats shaping today's cyber risk landscape. As cyber threats become increasingly sophisticated, timely intelligence remains critical for strengthening organizational resilience, prioritizing defensive efforts, and supporting informed risk-based decision-making. Link to the Research Report: https://www.cyfirma.com/research/cyber-threat-landscape-uk-ireland/ #ThreatIntelligence #CyberThreatIntelligence #CyberSecurity #Ransomware #ThreatLandscape #UnitedKingdom #Ireland #CYFIRMA #CYFIRMAresearch #ETLM https://www.cyfirma.com/

The next industrial espionage campaign may not begin with malware. It may begin with an AI-generated resume, a cloned executive's voice, or an employee asking a public chatbot for help. Perhaps the biggest shift is not any individual technique, but how these capabilities combine. The report explores emerging risks around AI coding assistants, software supply chains, overprivileged AI agents, and the growing importance of treating AI systems as critical business assets rather than productivity tools. Organizations need to move beyond securing AI models alone. They must secure the entire ecosystem that surrounds them, including employees, vendors, AI agents, connectors, and the data flowing between them. As AI adoption accelerates, the question is no longer whether AI will reshape industrial espionage. Link to the Research Report: https://www.cyfirma.com/research/aaie-how-artificial-intelligence-is-reshaping-the-theft-of-trade-secrets-models-and-access/ #CyberSecurity #ThreatIntelligence #ArtificialIntelligence #AI #IndustrialEspionage #CyberThreats #InformationSecurity #ThreatResearch #RiskManagement #EnterpriseSecurity https://www.cyfirma.com/

CYFIRMA's latest assessment highlights a threat environment shaped by ransomware, state-aligned espionage, mobile banking fraud, AI-enabled attacks, and persistent botnet activity. Key findings:  🔹 Ransomware remains the most disruptive threat  🔹 Mobile banking fraud is becoming increasingly sophisticated and scalable  🔹 State-sponsored actors continue targeting government and critical infrastructure  🔹 AI is accelerating phishing, deepfake fraud, and malware development  🔹 Dark web activity involving Indonesian data remains persistently elevated As Indonesia's digital economy expands, organizations must adopt intelligence-led security strategies and strengthen cyber resilience. Cyber resilience is no longer optional. It is a business imperative. Link to the Research Report: http://cyfirma.com/research/threat-landscape-indonesia/ #CyberSecurity #ThreatIntelligence #Indonesia #CyberRisk #Ransomware #CyberResilience #ThreatLandscape #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement #CYFIRMA https://www.cyfirma.com/

The June 2026 edition of the CYFIRMA Ransomware Threat Intelligence Briefing is now available. While publicly disclosed ransomware incidents declined during the month, threat actors continued to evolve their operations through Initial Access Brokers, ClickFix campaigns, custom malware, identity-focused attacks, and advanced defense-evasion techniques. Tune in as the CYFIRMA Research Team analyzes the latest ransomware trends, emerging threats, and key recommendations to help organizations strengthen their cyber resilience. Link to the Research Report: https://www.cyfirma.com/research/tracking-ransomware-jun-2026/ #CYFIRMA #Ransomware #ThreatIntelligence #CyberSecurity #CyberThreats https://www.cyfirma.com/