CYFIRMA Research

New Research: Dead Infrastructure Hijacking — The Attack That Doesn't Need a Vulnerability

Most breaches start with an exploit. This one starts with a domain registration.

We've published a full threat intelligence report on Dead Infrastructure Hij... more

APT36 Multi-Vector Execution Malware Campaign Targeting Indian Government Entities

Researchers at CYFIRMA have identified and analyzed a sophisticated malware campaign attributed to APT36 targeting Indian government entities. The campaign demonstrat... more

The Telegram ecosystem.

Ransomware groups, Initial Access Brokers, malware operators, and leak channels are converging on a single platform for coordination, recruitment, validation, and amplification.

This isn’t a migration from darknet forums — i... more

Emerging Threat Model: Python-Based Credential Stealer (CharlieKirk Grabber):

Recent analysis of a Python-based information stealer highlights the continued growth of modular, builder-driven malware targeting Windows environments. The sample demonstr... more

Stay ahead with CYFIRMA’s January 2026 Ransomware Threat Report.

January 2026 opened with sustained high ransomware activity and sharp operational volatility across major groups. Qilin remained one of the most active actors despite a post-surge decl... more

Malware Spotlight: LTX Stealer 

CYFIRMA researchers uncovered a sophisticated Windows info-stealer hidden in a legit Inno Setup installer.

Key takeaways:

 🔹 Node.js stealer with Bytenode bytecode obfuscation

 🔹 Targets Chromium browsers & crypto ... more

CYFIRMA has identified an active Telegram phishing campaign that abuses Telegram’s legitimate login and in-app authorization workflows to fully compromise user accounts without malware or exploits. By leveraging QR codes and manual login flows tied t... more

Critical Alert: CVE-2026-23760 – SmarterMail Pre-Auth Bypass Leading to Full System Compromise

Organizations running SmarterTools SmarterMail email servers—widely deployed across SMBs, MSPs, educational institutions, and healthcare environments—must... more