What are the opening hours?

Monday 08:00 - 16:00 Tuesday 08:00 - 16:00 Wednesday 08:00 - 16:00 Thursday 08:00 - 16:00 Friday 08:00 - 15:00

Digital Forensics Research & Service Center - DFRSC

Home
Pakistan
Lahore
Digital Forensics Research & Service Center - DFRSC

DFRSC is the first research facility of its kind in Pakistan. It will work to increase awareness about digital forensics and cyber security in Pakistan.

Digital Forensic Research and Service Centre (DFRSC) have been established at Lahore Garrison University, Lahore. The Prime Purpose of this centre is to Conduct research on Digital forensic problems and provide solutions, in order to, enhance crime investigation process.

17/09/2026

𝗔𝗜 𝗣𝗿𝗼𝗴𝗿𝗲𝘀𝘀 𝗠𝘂𝘀𝘁 𝗕𝗲 𝗠𝗮𝘁𝗰𝗵𝗲𝗱 𝗯𝘆 𝗔𝗜 𝗦𝗮𝗳𝗲𝘁𝘆

It is a matter of great pride for our department to see our respected Dean, **Kaukab Zuberi**, sharing his valuable insights on Artificial Intelligence and AI Safety during an interview on **Pakistan Front, Public News**, with Mr. Salman Haider.

The discussion highlighted several important aspects of AI, including:

• The potential risks associated with the rapid development of AI
• Increasingly autonomous AI decision-making
• The use of AI in military and other high-risk applications
• The growing importance of AI safety and cybersecurity
• The need for transparency, accountability, and human oversight
• Responsible AI governance and effective regulation

As students in the field of **Digital Forensics and Cybersecurity**, discussions like these are particularly valuable. The rapid advancement of AI is creating new opportunities, while also introducing challenges related to cybersecurity, digital trust, privacy, accountability, and the investigation of AI-related incidents.

AI innovation should therefore be accompanied by appropriate safety measures, responsible governance, and meaningful human control. Understanding these challenges is increasingly important for the future of cybersecurity and digital forensics.

We are proud to see our respected Dean, **Kaukab Zuberi**, contributing to this important conversation and highlighting the importance of responsible and secure AI development.

A valuable discussion for everyone interested in **Artificial Intelligence, Cybersecurity, Digital Forensics, and AI Governance**.

15/09/2026

DDRop Attack: A New Threat to Confidential Computing

Cybersecurity researchers have disclosed a new hardware attack called DDRop that challenges the security of confidential computing technologies.

DDRop exploits a weakness in memory protection by silently dropping write commands to DDR5 memory. As a result, the processor may read old encrypted data as if it were the latest data.

How Does DDRop Work?

An attacker with temporary physical access to a server can install a small hardware device called an interposer between the processor and DDR5 memory.

The interposer can:

Drop selected memory write operations

Keep old data in memory

Make the processor read stale data

Potentially undermine protected virtual machines

Technologies Affected

DDRop has been demonstrated against:

Intel TDX

Intel Scalable SGX

AMD SEV SNP

The research highlights an important limitation: encryption protects the confidentiality of data, but without freshness protection, old encrypted data may still be accepted as valid.

Key Takeaway

Encrypted memory is not necessarily enough.

Strong security requires protection against both unauthorized access and the reuse of outdated memory contents.

The researchers report that the interposer can be built relatively cheaply, with component costs around $159, although the attack requires physical access to the target server.

Security Awareness

DDRop demonstrates why hardware-level security, memory integrity, and freshness mechanisms are becoming increasingly important for cloud computing and confidential computing environments.

Stay informed. Stay secure.

14/09/2026

Passkey Phishing: A New Threat to Microsoft Cloud Accounts
Cyber attackers are using increasingly sophisticated social engineering techniques to compromise organizations and passkeys/MFA are now being used as part of the lure.
Microsoft recently highlighted two attack campaigns:
1. Executive Impersonation & Fake Invoices
Attackers impersonated CEOs and other executives, sending convincing emails containing fake invoices and forged email conversations. The goal was to trick finance teams into making fraudulent ACH payments.
2. Passkey-Themed Social Engineering
Attackers contacted employees while pretending to be IT help desk staff and urged them to update their passkey, MFA, or SSO. Victims were then redirected to fake Microsoft sign-in pages.
Once an account was compromised, attackers could:
• Register their own MFA methods
• Access Microsoft Graph
• Explore users, groups, and permissions
• Access SharePoint and OneDrive
• Collect mailbox data
• Exfiltrate sensitive information
• Maintain persistent access
The important lesson:
MFA or passkeys alone cannot eliminate the risk of social engineering. Attackers are increasingly targeting the authentication process itself.
Stay protected:
Verify unexpected IT/security requests through trusted channels
Don't blindly click authentication links received by SMS
Check domains carefully before signing in
Monitor newly registered authentication methods
Detect unusual cloud activity and large data downloads
Train employees to recognize phishing and impersonation attempts
Cybersecurity is not just about protecting passwords — it's about protecting the entire identity and authentication process.

11/09/2026

THREATSDAY BULLETIN: WEEKLY CYBER THREAT INTELLIGENCE UPDATE
The Digital Forensics Research & Service Center (DFRSC) presents this week’s ThreatsDay news roundup, analyzing key vulnerabilities, automated attack vectors, and operational risks currently impacting the global cybersecurity landscape.

KEY THREAT HIGHLIGHTS
Malicious Extensions Targeting Crypto Assets: A cross-browser campaign featuring four malicious extensions (J7Tracker, VREO, Orbit Tracker, and Padre) is actively harvesting Axiom Trade session tokens and crypto wallet data. The extensions exfiltrate authenticated user information, Firebase tokens, and application state directly to threat-actor-controlled Vercel deployments.
AI Agents Automating Cyber Intrusions: Chinese speaking threat operators are leveraging LLM frameworks (including Anthropic Claude, Alibaba Qwen, and DeepSeek) via "SecFlow" to automate cyber intrusions against government and financial targets across Asia and the US. Attackers convert operational objectives into automated AI tasks to exploit legacy flaws like Shellshock, Spring4Shell, and Log4Shell, subsequently deploying Go-based backdoors.
Shadow AI Risks & Sensitive Data Exposure: The U.K.’s National Cyber Security Centre (NCSC) has issued a critical warning regarding unapproved corporate AI usage. Employees leveraging unauthorized AI tools risk exposing proprietary intellectual property, breaking regulatory compliance, and creating untracked attack vectors that bypass enterprise monitoring controls.
Stay ahead of emerging vectors, audit third-party browser extensions, and enforce strict Shadow AI policy controls across enterprise environments.

10/09/2026

Urgent Threat Intel Update: New ‘BlueMoon’ Exploit Kit Employed by 4+ Advanced Espionage Groups

Proofpoint researchers have published a critical analysis of a previously undocumented exploit kit, dubbed ‘BlueMoon,’ which chains multiple vulnerabilities in Microsoft Windows and Google Chrome to deploy highly target-specific backdoors.

This discovery is significant due to its rapid proliferation among distinct China-aligned threat clusters (including APT31 and UNK_QuietRacket), all within just one week of its initial use on August 28, 2026.

Key Technical Takeaways:

Exploit Chain Analysis: BlueMoon chains three key vulnerabilities:

CVE-2026-85046: A type confusion vulnerability in the Google Chrome V8 engine (patched last week).

An Unassigned V8 Sandbox Escape: No CVE assigned, crucial for bypassing browser security controls.

CVE-2026-85880: A heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) (patched today by Microsoft in Sept 2026 updates).

Patch-Gap Exploitation: Crucially, both Chrome vulnerabilities were "patch-gap" zero-days at the time of exploit. They were already fixed in public upstream Chromium code but had not yet propagated to stable Chrome releases, creating a window for exploitation.

Suspected AI-Assisted Development: The presence of extensive logging and verbose comments in the exploit source code suggests potential assistance from artificial intelligence (AI) tools.

Observed Post-Exploitation Activity:

Threat actors used distinct attack chains, but commonalities included DLL sideloading and the deployment of new or existing malware:

APT31: Deployed ‘GemStone’ browser-surveillance backdoor, disguised as a Google Gemini add-on using a novel integrity bypass method (GhostChrome-X).

UNK_LateNight & UNK_QuietRacket: Used spear-phishing and DLL sideloading to drop known backdoors like ShadowPad and custom .NET assemblies.

Defensive Implications:

This report highlights a critical and reduced barrier to entry for highly weaponized browser exploits, possibly accelerated by AI agents reverse-engineering patches. It also underscores the strategic exploitation of the "patch-gap" window. CISA has added the Chrome flaw to its KEV catalog.

Critical Defender Actions:

Check for IOCs (Registry, Mutex, Scheduled Tasks): Look for artifacts like C:\Users\Public\stomp_ext, mutex Dataupcheckinfo, or registry key HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}.

Review Process Trees: Identify anomalies like chrome.exe starting cmd.exe, curl.exe, or msgbox.exe.

Full research by the Proofpoint team (Mark Kelly, Greg Lesnewich, et al.). Stay vigilant.

08/09/2026

PEEP: Turning Chrome & Edge into Post-Compromise Backdoors

Recently, cybersecurity researchers disclosed PEEP, a Chromium-based post-exploitation toolkit that disguises itself as a legitimate browser extension called “Smart Bookmarks.”

What makes PEEP interesting from a cybersecurity perspective is that it goes beyond simple browser data theft. It combines a malicious browser extension with a Native Messaging Host to interact with the underlying operating system.

Key capabilities:

• Browser history & active-tab monitoring
• Cookie and session-data theft
• Remote command ex*****on
• File management
• Process & service discovery
• JavaScript/page manipulation
• C2 communication and data exfiltration
• Persistence through browser configuration

The interesting part is the browser-to-OS pivot: after a system is already compromised, PEEP can leverage Chrome/Edge as a persistent access point to the host.

This highlights an important security lesson: browser extensions should be treated as part of the endpoint attack surface, not just as productivity tools.

Organizations should monitor unauthorized extensions, Native Messaging Hosts, browser policies, PowerShell activity, and suspicious browser-to-process behavior.

Cybersecurity is not only about preventing initial access — post-compromise detection and response are equally important.

07/09/2026

BUILDING BRIDGES BETWEEN ACADEMIA AND THE CYBERSECURITY INDUSTRY

It was an honor to welcome Mr. Rafay Baloch, Founder & CEO of RedSecLabs, along with his distinguished team, to the Digital Forensics Research & Service Center (DFRSC) at Lahore Garrison University.

During the visit, leadership and faculty engaged in a highly productive discussion focused on strengthening industry-academia collaboration, driving cybersecurity research, and fostering professional development opportunities.

We are pleased to announce that RedSecLabs has graciously agreed to provide internship opportunities for DFRSC students. This hands-on industry exposure will be instrumental for our students pursuing careers in Cybersecurity, Digital Forensics, and Information Security, enabling them to bridge academic learning with real-world practical expertise.

Mr. Rafay Baloch is an internationally acclaimed information security researcher based in the UK. His pioneering work in security research earned him the prestigious Pride of Pakistan Award in 2022.

We extend our sincere gratitude to Mr. Rafay Baloch and the RedSecLabs team for visiting DFRSC and supporting our academic mission. We look forward to building a sustainable, long-term partnership that advances cyber research, talent development, and industry alignment.

07/09/2026

Cyber Security Alert: Modern Cyber Threats & Defense Strategies
Cyber threats are evolving faster than ever. From targeted phishing and impersonation attacks to Advanced Persistent Threats (APTs) and destructive ransomware, individuals and organizations must stay alert to protect their digital assets and sensitive information.
Phishing & Impersonation Attacks
Cybercriminals are increasingly using fake emails, SMS messages, and fraudulent login or OAuth consent requests to steal credentials and gain unauthorized access.
Stay Safe: Always verify the sender’s identity and avoid clicking suspicious or untrusted links.
AI-Driven Threats & Advanced Persistent Threats (APTs)
Modern attackers can leverage automation and AI-assisted techniques to conduct sophisticated attacks, remain undetected, and steal sensitive information over time.
Stay Protected: Implement strong access controls, continuous monitoring, and effective security policies across your network.
Ransomware & Data Encryption Attacks
Ransomware can encrypt critical files and disrupt business operations while attackers demand payment for data recovery.
Be Prepared: Maintain secure, offline backups, regularly test recovery procedures, and keep your incident response plan up to date.
Remember:
🔹 Verify before you click!
🔹 Never trust suspicious emails, messages, or links.
🔹 Report suspicious activity to your IT Support / Service Desk immediately.
🔹 Stay aware, stay informed, and make cybersecurity a continuous priority.
Your awareness is your first line of defense. Together, we can build a safer digital environment.

04/09/2026

Call for Papers: IEEE AI2CF 2026
We are excited to invite researchers, academicians, industry experts, and law enforcement professionals to submit their groundbreaking research to the IEEE 1st International Conference on Artificial Intelligence for Cyber and Crime Forensics (AI2CF 2026)!
Hosted by the Department of Criminology & Digital Forensics Research & Service Center (DFRSC) at Lahore Garrison University, this conference brings together cutting-edge advancements in AI, Cybersecurity, and Digital Forensics.
Conference Tracks Include: • AI in Cybercrime & Financial Crime Investigation
• Digital Forensics & Incident Response
• Threat Detection, Malware Analysis & OSINT
• Blockchain Security & Cryptocurrency Forensics
• Ethical AI & Digital Governance in Criminal Justice
Publication Opportunity:
Presented papers will be submitted for inclusion in IEEE Xplore (subject to scope & quality requirements).
Important Dates: • Extended Submission Deadline: August 31, 2026
• Notification of Acceptance: September 15, 2026
• Camera Ready Paper: September 30, 2026
• Conference Dates: November 11–12, 2026
Submit Your Paper Here: https://ai2cf.lgu.edu.pk/

03/09/2026

Malware Campaign: Disabling & Weakening Security Defenses

Cybersecurity mein attackers sirf malware install karne ki koshish nahi karte kabhi kabhi unka pehla goal security defenses ko weaken karna hota hai.

This malware campaign highlights several important attack techniques:

Fake download pages and spoofed installers
Malicious executable files
Attempts to disable Windows Update
Weakening Microsoft Defender
Abuse of security exclusions
RAT payload deployment
Command & Control (C2) communication

On the defensive side, modern security solutions can help through:

Automated Investigation
Automated Containment
Attack Disruption
Threat Detection & Response
Restoration of system integrity

Key Takeaway

A strong cybersecurity strategy is not only about detecting malware after infection. It is also about preventing attackers from weakening security controls in the first place.

Keeping systems updated, monitoring suspicious activity, reviewing security exclusions, and educating users about fake download pages are important steps in reducing the risk of such attacks.

Address

Lahore Garrison University. , Sector C DHA Phase 6
Lahore

Opening Hours

Monday	08:00 - 16:00
Tuesday	08:00 - 16:00
Wednesday	08:00 - 16:00
Thursday	08:00 - 16:00
Friday	08:00 - 15:00

Website

http://www.dfrsc.org/

Alerts

Be the first to know and let us send you an email when Digital Forensics Research & Service Center - DFRSC posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.