Phishing — January 2019 attacks

We have detected a wave of cyberattacks targeting multiple Italian organizations in recent days.

Threat actors employ malicious attachments to redirect users to sites hosting malware or phishing pages, representing the initial phase of more severe system compromise within targeted enterprises.

The email body contains minimal information, with a PDF file attached.

The PDF contains a link to a malicious site that induces users to download malware or submit credentials. This attack chain aligns with T1566.001 (Phishing: Spearphishing Attachment) and T1598.003 (Phishing for Information: Spearphishing Link), tactics commonly observed in initial access operations. Organizations implementing Cyber Threat Intelligence capabilities can identify such indicators of compromise and establish detection rules to prevent credential harvesting and malware deployment at the perimeter: