Cyfirma

30/08/2026

🔐 𝑪𝒚𝒃𝒆𝒓𝒔𝒆𝒄𝒖𝒓𝒊𝒕𝒚 𝒊𝒔 𝒆𝒗𝒐𝒍𝒗𝒊𝒏𝒈—𝒇𝒓𝒐𝒎 𝒅𝒆𝒕𝒆𝒄𝒕𝒊𝒏𝒈 𝒂𝒕𝒕𝒂𝒄𝒌𝒆𝒓𝒔 𝒕𝒐 𝒅𝒆𝒄𝒆𝒊𝒗𝒊𝒏𝒈 𝒕𝒉𝒆𝒎.

Traditional honeypots were just the beginning.

Today, deception environments are becoming a more strategic approach to cybersecurity—creating realistic, controlled environments designed to expose attacker behavior, understand their tactics, and disrupt threats before they reach critical assets.

In his latest Forbes Technology Council article, Kumar Ritesh, Founder & CEO of CYFIRMA, explores how deception technology is changing the way organizations think about cyber defense.

The future of cybersecurity isn’t just about building stronger walls.

It’s about making attackers believe they’ve found the way in—while you’re watching every move.

📖 Read the full article below ⬇️ https://www.forbes.com/councils/forbestechcouncil/2026/08/27/how-cybersecurity-is-evolving-from-honeypots-to-deception-environments/

Where a honeypot is a prop, a deception environment is a stage.

13/08/2026

𝑷𝒓𝒆𝒅𝒊𝒄𝒕𝒊𝒏𝒈 𝑪𝒚𝒃𝒆𝒓𝒂𝒕𝒕𝒂𝒄𝒌𝒔 𝑩𝒆𝒇𝒐𝒓𝒆 𝑻𝒉𝒆𝒚 𝑯𝒂𝒑𝒑𝒆𝒏

𝐓𝐡𝐞 𝐟𝐮𝐭𝐮𝐫𝐞 𝐨𝐟 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐢𝐬𝐧’𝐭 𝐣𝐮𝐬𝐭 𝐚𝐛𝐨𝐮𝐭 𝐫𝐞𝐬𝐩𝐨𝐧𝐝𝐢𝐧𝐠 𝐭𝐨 𝐚𝐭𝐭𝐚𝐜𝐤𝐬—𝐢𝐭’𝐬 𝐚𝐛𝐨𝐮𝐭 𝐚𝐧𝐭𝐢𝐜𝐢𝐩𝐚𝐭𝐢𝐧𝐠 𝐭𝐡𝐞𝐦 𝐛𝐞𝐟𝐨𝐫𝐞 𝐭𝐡𝐞𝐲 𝐡𝐚𝐩𝐩𝐞𝐧.

In this insightful episode of , Kumar Ritesh, CEO & Founder of CYFIRMA, explores how intelligence agencies anticipate cyberattacks and what organizations can learn from intelligence-led approaches to cybersecurity.

From nation-state threats and threat intelligence to the evolving cyber threat landscape, the conversation offers valuable perspectives on why organizations need to move beyond traditional reactive security and embrace a more preemptive approach.

🎙️ 𝗪𝗮𝘁𝗰𝗵 𝘁𝗵𝗲 𝗳𝘂𝗹𝗹 𝗲𝗽𝗶𝘀𝗼𝗱𝗲: https://www.youtube.com/watch?v=n8DQHUWDK6A

𝐴 ℎ𝑖𝑔ℎ𝑙𝑦 𝑖𝑛𝑓𝑜𝑟𝑚𝑎𝑡𝑖𝑣𝑒 𝑐𝑜𝑛𝑣𝑒𝑟𝑠𝑎𝑡𝑖𝑜𝑛 𝑓𝑜𝑟 𝑐𝑦𝑏𝑒𝑟𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑙𝑒𝑎𝑑𝑒𝑟𝑠, 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑝𝑟𝑜𝑓𝑒𝑠𝑠𝑖𝑜𝑛𝑎𝑙𝑠, 𝑎𝑛𝑑 𝑎𝑛𝑦𝑜𝑛𝑒 𝑙𝑜𝑜𝑘𝑖𝑛𝑔 𝑡𝑜 𝑢𝑛𝑑𝑒𝑟𝑠𝑡𝑎𝑛𝑑 𝑤ℎ𝑎𝑡’𝑠 𝑛𝑒𝑥𝑡 𝑖𝑛 𝑡ℎ𝑒 𝑤𝑜𝑟𝑙𝑑 𝑜𝑓 𝑐𝑦𝑏𝑒𝑟 𝑡ℎ𝑟𝑒𝑎𝑡𝑠.

30/06/2026

🚀 𝐂𝐘𝐅𝐈𝐑𝐌𝐀 𝐚𝐭 𝐂𝐲𝐛𝐞𝐫 𝐅𝐢𝐫𝐬𝐭 𝐊𝐞𝐧𝐲𝐚 𝟐𝟎𝟐𝟔

We’re excited to announce that Cyfirma will be participating in Cyber First Kenya 2026, bringing together cybersecurity leaders, practitioners, and decision-makers to discuss the evolving threat landscape and strategies for cyber resilience across Africa.

We’re proud to share that Hamid Bafghi, Director for Sales & Partnerships – Middle East & Africa at CYFIRMA, will be among the distinguished speakers at the event.

🎤 Speaker: Hamid Bafghi
📍 Event: Cyber First Kenya 2026

Join Hamid as he shares insights on:

🔹 Emerging cyber threats targeting organizations across the region
🔹 The importance of external threat intelligence in proactive cyber defense
🔹 How organizations can strengthen cyber resilience through predictive, intelligence-led security

If you’re attending Cyber First Kenya 2026, we invite you to connect with our team, attend Hamid’s session, and discover how CYFIRMA helps organizations stay ahead of cyber adversaries through AI-powered external threat landscape management.

We look forward to connecting with cybersecurity professionals, partners, and industry leaders in Kenya.



Kumar Ritesh Dr. Saurabh Lal Anna Koh Philip Varughese Glaiza Pardilla Hamid Bafghi

02/06/2026

𝗧𝗼𝗸𝘆𝗼 — 𝗝𝘂𝗻 𝟮, 𝟮𝟬𝟮𝟲 — 𝗖𝗬𝗙𝗜𝗥𝗠𝗔 is pleased to announce that 𝐓𝐡𝐞 𝐊𝐚𝐧𝐬𝐚𝐢 𝐄𝐥𝐞𝐜𝐭𝐫𝐢𝐜 𝐏𝐨𝐰𝐞𝐫 𝐂𝐨𝐦𝐩𝐚𝐧𝐲, 𝐈𝐧𝐜𝐨𝐫𝐩𝐨𝐫𝐚𝐭𝐞𝐝 (𝐊𝐚𝐧𝐬𝐚𝐢 𝐄𝐥𝐞𝐜𝐭𝐫𝐢𝐜 𝐏𝐨𝐰𝐞𝐫) has adopted hashtag , our external threat landscape management platform. DeCYFIR provides comprehensive visualization of external cyber threats and risks, giving organizations the actionable intelligence needed to anticipate, prioritize, and defend against potential attacks.

𝗞𝗮𝗻𝘀𝗮𝗶 𝗘𝗹𝗲𝗰𝘁𝗿𝗶𝗰 𝗣𝗼𝘄𝗲𝗿 uses 𝗗𝗲𝗖𝗬𝗙𝗜𝗥 to map and monitor its external threat landscape, strengthen organizational cybersecurity posture, and proactively prepare for emerging risks. This partnership underscores the increasing need for energy-sector organizations to adopt external threat intelligence solutions that deliver context-rich visibility across open, deep, and dark web sources.

We look forward to supporting Kansai Electric Power with continuous threat monitoring, tailored risk insights, and collaborative threat-hunting capabilities to help protect critical infrastructure and maintain operational resilience.

Read the full announcement here:

Main article: Tokyo – Jun 2, 2026 – CYFIRMA (Headquarters: Chiyoda-ku, Tokyo; hereafter CYFIRMA), a provider of an external threat...

15/05/2026

➡️ 𝗛𝗼𝘄 “𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀” 𝗔𝗿𝗲 𝗧𝗿𝗮𝗻𝘀𝗳𝗼𝗿𝗺𝗶𝗻𝗴 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲𝘀 🤖

𝗘𝘅𝗰𝗹𝘂𝘀𝗶𝘃𝗲 𝗜𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄 with CYFIRMA’s CEO Kumar Ritesh on ITmedia Inc. Japan

In a new feature on ITmedia ビジネスオンライン, Cyfirma Founder & CEO Kumar Ritesh dives into how 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀 are reshaping enterprise security and operations.

𝗞𝗲𝘆 𝘁𝗮𝗸𝗲𝗮𝘄𝗮𝘆𝘀:
✅ 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀 go beyond traditional AI by perceiving, planning, and acting, not just predicting or generating outputs.
✅ When governed correctly, they become powerful 𝗳𝗼𝗿𝗰𝗲 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗶𝗲𝗿𝘀 𝗳𝗼𝗿 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆, automating threat‑hunting, response, and risk‑management workflows.
✅ At CYFIRMA, we’re turning this power into 𝗽𝗿𝗲𝗲𝗺𝗽𝘁𝗶𝘃𝗲 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆: using AI‑driven intelligence to 𝗽𝗿𝗲𝗱𝗶𝗰𝘁 𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗯𝗲𝗳𝗼𝗿𝗲 𝘁𝗵𝗲𝘆 𝗵𝗮𝗽𝗽𝗲𝗻 𝗮𝗻𝗱 𝗱𝗶𝘀𝗿𝘂𝗽𝘁 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿’𝘀 𝗽𝗲𝗿𝘀𝗽𝗲𝗰𝘁𝗶𝘃𝗲.

As enterprises rapidly adopt AI‑enabled workflows, 𝗵𝗮𝘃𝗶𝗻𝗴 𝗽𝗿𝗼𝗮𝗰𝘁𝗶𝘃𝗲, 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲‑𝗹𝗲𝗱 𝗱𝗲𝗳𝗲𝗻𝘀𝗲𝘀 𝗶𝘀 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗼𝗽𝘁𝗶𝗼𝗻𝗮𝗹.

➡️ Read the full article on ITmedia Japan to see how AI agents are changing the game and how CYFIRMA is helping organizations stay ahead of the curve.

https://www.itmedia.co.jp/business/articles/2605/15/news010.html

AIの新たな使い方として注目される「AIエージェント」。企業の一員として、自律的に業務を遂行するようになる可能性もある。一方、サイバー攻撃者も高度なAIを武器として使い始めており、攻めと守りの両面でAIをうまく....

13/04/2026

At , we don’t believe in waiting for attacks to happen. We believe in stopping them before they even begin.

Today marks a bold step forward as we deepen our commitment to the ANZ region, bringing the full force of our AI-powered DeCYFIR platform and its 9-pillar intelligence architecture to organizations that refuse to operate in the dark. Because here’s the reality: The most dangerous threats are no longer inside your perimeter. They are forming outside, across the open web, the dark web, and complex third-party ecosystems, long before a single alert is triggered.

𝐀𝐧𝐝 𝐫𝐞𝐚𝐜𝐭𝐢𝐧𝐠 𝐢𝐬 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐞𝐧𝐨𝐮𝐠𝐡.

With , we are giving organizations the power to see what others can’t. To anticipate what others miss. And to act before damage is done.

This moment is also defined by leadership.

We are proud to welcome Rajeev Mathur as VP of Sales for ANZ, a leader who understands not just the market, but the urgency of the mission. His experience, combined with our strong regional team, will accelerate our vision of building a truly intelligence-led cyber ecosystem across ANZ.

𝐑𝐞𝐚𝐝 𝐭𝐡𝐞 𝐅𝐔𝐋𝐋 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭 𝐇𝐞𝐫𝐞

👉 https://www.cyfirma.com/news/cyfirma-deepens-anz-commitment-with-decyfirs-9-pillar-intelligence-architecture-and-new-regional-leadership-appointment/

13/04/2026

🛡️ 𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗜𝗻 𝗙𝗼𝗰𝘂𝘀 🛡️

CYFIRMA Research and Advisory Team has found BASANAI Ransomware while monitoring various underground forums as part of our Threat Discovery Process.

Type: Ransomware
Target Technologies: Windows Systems, Network Shares, Mapped Drives, Enterprise File Storage Systems, Backup Repositories, Remote Access Services (RDP)

𝑩𝑨𝑺𝑨𝑵𝑨𝑰 𝑹𝒂𝒏𝒔𝒐𝒎𝒘𝒂𝒓𝒆
BASANAI ransomware has been identified as a MedusaLocker-family file-encrypting malware variant that prevents access to victim data by encrypting files and appending a distinct extension associated with the BASANAI strain. Upon ex*****on, the malware systematically encrypts files across the infected system and drops a ransom note, typically named “README.txt”, informing victims of the compromise. Analysis indicates that the ransomware leverages strong cryptographic algorithms (commonly AES combined with RSA, consistent with MedusaLocker variants) to ensure that files cannot be decrypted without attacker-controlled keys. The operators claim that not only local files but also network shares and potentially backups may be impacted, increasing operational disruption. In addition to encryption, the threat actors assert that sensitive data may have been exfiltrated, introducing a double extortion element where victims face both data loss and potential public exposure. Victims are instructed to contact the attackers via the provided communication channels to negotiate payment, typically in cryptocurrency. At present, no confirmed public decryption tool is available for this variant, and recovery without attacker cooperation remains unlikely.

Read Here: https://www.cyfirma.com/news/weekly-intelligence-report-10-april-2026/

Ransomware In Focus CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various...

13/04/2026

🛡️ 𝐀𝐜𝐭𝐢𝐯𝐞 𝐌𝐚𝐥𝐰𝐚𝐫𝐞 𝐨𝐟 𝐭𝐡𝐞 𝐖𝐞𝐞𝐤 🛡️

This week, the “𝑹𝒐𝒅𝒆𝒙𝑹𝑴𝑴” malware is in focus.

Type: Backdoor| Objectives: Persistence | Target Technology: Windows OS | Target Geography: Global

Overview of Operation RodexRMM Malware
The analysed sample, identified as RodexRMM, demonstrates a structured and stealth- oriented set of behaviours indicative of a controlled malicious operation. Its activity suggests a clear intention to establish persistence within the infected environment while operating in a manner that closely mimics legitimate system processes. By utilizing standard system paths and interacting with core components, the malware attempts to remain inconspicuous and avoid raising immediate suspicion. Additionally, it gathers key system information, likely to assess the environment and prepare for subsequent actions.

Furthermore, RodexRMM exhibits multiple defense evasion characteristics, including the use of obfuscation and strategic interaction with system configurations and registry settings. These actions may contribute to weakening security visibility or bypassing detection mechanisms. The observed behaviour also indicates an awareness of analysis environments, suggesting that the malware may actively attempt to evade sandboxing or monitoring tools, thereby prolonging its presence on the compromised system.

The communication patterns associated with RodexRMM reveal outbound connections to external services, potentially to obtain system-related information such as public IP data. This, combined with its capability to execute processes and manage system activities, suggests the presence of a command-and-control mechanism. Overall, the malware reflects a level of sophistication consistent with threats designed for persistence, reconnaissance, and remote control, posing a notable risk in both targeted and opportunistic attack scenarios.

Read Here: https://www.cyfirma.com/news/weekly-intelligence-report-10-april-2026/

Ransomware In Focus CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various...

13/04/2026

𝐓𝐡𝐫𝐞𝐚𝐭 𝐀𝐜𝐭𝐨𝐫 𝐢𝐧 𝐅𝐨𝐜𝐮𝐬 - 𝐂𝐡𝐢𝐧𝐞𝐬𝐞 𝐓𝐡𝐫𝐞𝐚𝐭 𝐀𝐜𝐭𝐨𝐫 𝐒𝐢𝐥𝐯𝐞𝐫 𝐅𝐨𝐱 𝐄𝐱𝐩𝐚𝐧𝐝𝐢𝐧𝐠 𝐟𝐨𝐨𝐭𝐩𝐫𝐢𝐧𝐭𝐬 𝐢𝐧 𝐀𝐏𝐀𝐂

About the Threat Actor
Silver Fox aka Void Arachne – suspected Chinese threat actor, is assessed to have been active since at least 2019–2020, demonstrating continuous evolution in its tooling and targeting capabilities while maintaining an aggressive posture toward organizations. The group has expanded its operational footprint and digital presence across multiple countries in the APAC region.

Read Here: https://www.cyfirma.com/news/weekly-intelligence-report-10-april-2026/

Ransomware In Focus CYFIRMA Research and Advisory Team would like to highlight ransomware trends and insights gathered while monitoring various...