Group-IB’s latest threat report exposes the full scale of GoldFactory’s mobile fraud operation, one of the most technically advanced campaigns currently targeting APAC.

Key insights:
🔹A surge of 300+ modified banking apps, patched with injected modules to bypass security and retain full legitimate functionality
🔹Over 11,000 device infections traced through Group-IB Fraud Protection telemetry
🔹A unified ecosystem of loaders (Gigabud, Remo, MMRat) delivering secondary payloads such as SkyHook
🔹New Gigaflower variant features experimental OCR and QR code scanning to auto-extract ID card data.
🔹Infrastructure overlaps linking open directories and shared S3 buckets hosting malicious binaries

This report reveals how GoldFactory has industrialized mobile fraud by weaponizing legitimate apps and what defenders need to know now. Read the full analysis.

#MobileBanking #CyberSecurity #APACThreats #BankingMalware #GoldFactory

As digital lending accelerates in Uzbekistan, cybercriminals are exploiting verification gaps, low financial awareness, and social engineering to weaponize online credit services at scale turning personal identity into a profitable attack surface.

Key Highlights:
🔹 Online credit fraud cases surged 42% in 2024 compared to 2023
🔹 34% of incidents involved fraudsters posing as bank or government officials
🔹 Microcredits are approved using stolen passport, FaceID, and OTP data
🔹 Scammers deploy Telegram bots and SMS-stealers to bypass authentication
🔹 New regulations now allow victims to be exempt from repaying fraudulent loans

Our latest analysis breaks down the evolving fraud ecosystem, the social engineering tactics behind it, and the controls financial institutions must implement to stay ahead.

Read the full report here.

#FraudIntelligence #ThreatIntel #DigitalFraud #SocialEngineering #CyberSecurity

Group-IB’s Red Team has identified two previously unknown zero-day vulnerabilities in widely used enterprise platforms: Cisco UCCX and IBM Sterling.

Following responsible disclosure, both vendors validated the findings and released security updates to protect their customers.

This discovery highlights the strength of Group-IB’s approach to rigorous, dependable, and attributable analysis. By leveraging deep empirical threat intelligence to replicate highly advanced attacks, our teams reveal critical risks that many other security assessments overlook.

Full technical details are available in our press release.

#CyberSecurity #ZeroDay #VulnerabilityAssessment #ThreatIntelligence #EnterpriseSecurity #SecurityUpdates #FightAgainstCybercrime

🚨Android-based financial fraud in Uzbekistan has entered a new stage of operational maturity, with threat actors shifting from simple SMS stealers to sophisticated, multi-stage infection chains built around stealthy droppers, advanced obfuscation, and automated infrastructure.

Key Highlights:
🔹Over $2M stolen by a single tracked group since January 2025
🔹Two primary dropper families, MidnightDat and RoundRift, were identified using native decryption and encrypted asset storage.
🔹Wonderland, a new SMS stealer with bidirectional WebSocket C₂, enables real-time command execution, SMS sending, and USSD control.
🔹Telegram remains the central distribution channel, fueled by stolen sessions sold on dark web markets.
🔹Thousands of unique samples generated through automated build pipelines to evade signature-based detection

🔗 Read the full analysis here.

#ThreatIntelligence #AndroidMalware

💸 “Easy money. Simple tasks. Work from your phone.”

Our latest analysis exposes a coordinated wave of fake online job ads sweeping across the Middle-East and Africa region. These aren't isolated scams, they are a large-scale, organized operation exploiting the demand for remote work to steal personal data and funds.

Key insights from our investigation:
🔹 Over 1,500 fraudulent job ads identified in 2025, impersonating trusted e-commerce platforms, banks, and even government ministries.
🔹 Ads are highly localized, using Arabic dialects and regional currencies to appear authentic.
🔹 Victims are funneled from social media into private Telegram and WhatsApp groups, where sensitive information and upfront “deposits” are collected.
🔹The scam infrastructure includes fake registration portals, cloned branding, and repeat behavioral patterns among attackers.

Read More.

#CyberSecurity #OnlineScams #MENA #Phishing #DigitalRisk #FraudPrevention #ThreatIntelligence

🚨 Tap-to-pay fraud has evolved into a remote, industrialized threat. Chinese cybercrime groups are now selling NFC relay malware on Telegram, enabling real-time payment fraud from anywhere in the world.

Our latest research breaks down the full ecosystem from malware vendors and illicit POS terminals to mule networks and provides technical analysis of key families like TX-NFC and NFU.

Learn how this threat works and how to defend against it. 🔗 Read the full report.

#CyberSecurity #MalwareAnalysis #NFCFraud #AndroidSecurity #FraudPrevention #ThreatIntelligence #FightAgainstCybercrime

Most organizations are stuck in survival mode. Real resilience is achieved when we move beyond reaction to planning ahead with real-world threat intelligence.

Gartner report highlights:
🔹 90% of attacks will exploit known vulnerabilities by 2028
🔹 Most can be prevented with strategic Threat Intelligence
🔹 Threat intelligence reduces MTTD & MTTR and strengthens overall readiness.

Download the report.

#ThreatIntelligence #CyberSecurity #IncidentResponse #CyberAwareness #GartnerReport

🚨 Group-IB has uncovered a sophisticated new threat rewriting the ransomware playbook. DeadLock leverages Polygon smart contracts to rotate proxy addresses, a stealthy, under-reported technique that bypasses traditional defenses by abusing decentralized infrastructure.

Key Highlights:
🔹 Decentralized Proxy Management: Uses Polygon smart contracts to dynamically retrieve and rotate proxy server addresses, complicating takedowns.
🔹 Service Disruption: Employs a custom PowerShell script to stop all non-whitelisted Windows services, sparing only native processes & its own RMM tool, AnyDesk.
🔹 Evolving Extortion: Ransom notes have matured from simple encryption alerts to explicit threats of selling stolen data, even offering "security reports" and promises not to re-target victims.
🔹Infrastructure Tracking: We traced proxy servers and smart contract transactions, revealing dedicated infrastructure & recent reactivation of operations.

Read the full technical analysis.

#ThreatIntelligence #DeadLockRansomware

🚨Peruvian Peaks: The Illusion of Digital Loans

Phishing scams based on fake digital loan offers are growing at an alarming rate in Peru and across Latin America. In this new technical blog, we present an in‑depth investigation into a fraudulent campaign that combines social media advertising, bank impersonation, and advanced credential‑harvesting techniques.

Since 2024, Group‑IB has identified approximately 370 fraudulent domains and dozens of malicious social‑media advertisements, all designed to mimic legitimate loan application processes in order to capture sensitive financial data, including card numbers, PINs, and online banking credentials, for sale on underground markets or use in further attacks.

👉 Discover how this scheme operates, why it is so effective, and what risks it poses to the regional financial ecosystem. Read the full technical analysis here.

#DigitalLoans #PhishingScams #CyberSecurity #FraudPrevention #LATAM #OnlineScams

🚨Group-IB’s first Weaponized AI report reveals how cybercriminals are operationalizing artificial intelligence to drive a fifth wave of cybercrime.

Skills that once required human expertise, such as persuasion, impersonation, and malware development, are now being turned into on-demand services, available at scale and speed. From the abuse of publicly available LLMs to the rise of proprietary Dark LLMs traded on the dark web, AI crimeware is rapidly being commercialized across the underground economy.

Key insights from the report:
✅ Mentions of AI on dark web forums surged 371% between 2019 and 2025, signalling rapid adoption by threat actors.
✅ AI-powered phishing tools are selling for as little as $30 per month.
✅ A growing deepfake-as-a-service market, with synthetic identity kits from US$5 and activity up 52% YoY in 2025.
✅ Criminal-grade LLMs sold for $30–$200 per month, with customer bases exceeding 1,000 users.

👉 Download the full report.

#AI #DarkWeb #Deepfake

🎉 Group-IB announces the launch of Cloud Security Posture Management (CSPM) as part of our Unified Risk Platform. Designed to help organizations reduce risks associated with cloud transformation, it ensures business continuity by identifying misconfigurations, eliminating compliance gaps, and enhancing cloud security from initial development through to deployment.

What makes Group-IB CSPM different:
🔹 See the configurations that matter most: By enriching posture findings with real-world exposure data from Group-IB Attack Surface Management and industry-leading Group-IB Threat Intelligence, your team sees cloud risks as attackers would.
🔹 Combined with built-in CI/CD misconfiguration checks and a unified Group-IB ecosystem, it goes beyond traditional CSPM to give you deep visibility that closes active cloud risks.

Read the full press release to learn how Group-IB is redefining cloud security posture management.

#CloudSecurity #CSPM #CyberSecurity