Email: 5 tips to protect against attacks
Five practical guidelines to reduce exposure to email-borne threats: phishing, attachment macros, sender spoofing, MFA and user awareness — what works and what does not.
Category
Emerging Threats
Read the analysis
Red Teaming Series — Antivirus Bypass
Antivirus evasion techniques in red-team operations: payload encoding, signature avoidance, behavioural-detection bypass and corresponding defensive lessons.
Red Teaming Series — Armitage
Armitage in offensive security operations: post-exploitation workflows, Metasploit collaboration, lateral movement and defensive lessons for SOC teams.
ALERT — Microsoft cryptography systems vulnerability
CVE-2020-0601 (CurveBall): Microsoft Windows certificate validation vulnerability, exploitation primitives, NSA disclosure and remediation steps.
ALERT — Vulnerability in Citrix ADC (NetScaler)
Critical Citrix ADC/NetScaler vulnerability: exploitation primitives, exposure metrics on Italian perimeters and remediation steps for affected appliances.
Phishing — January 2019 attacks
Phishing campaigns observed during January 2019: lure templates, payload delivery and indicators across waves targeting Italian organisations.
TrickBot infection of January 2019
TrickBot is a banking-trojan malware that steals the login credentials of targeted banking sites using webinjects. Since June 2018 TrickBot features lateral movement capabilities in order to propagate itself from an infected client to a vulnerable domain controller. TrickBot Screenshots TrickBot Indicators Of Compromise (IOCs)
Compromise and Mining — Detection & Response
Cryptomining as a post-compromise objective: indicators on Linux and Windows endpoints, persistence techniques, network signals and containment workflow.
Hybrid Cyber Warfare between Russia and Ukraine — Italy among the targets
Russia-Ukraine cyber conflict: spillover operations on Italian organisations, attribution signals, defacement and DDoS waves, intelligence-driven defence priorities.
