Phishing — January 2019 attacks
Phishing campaigns observed during January 2019: lure templates, payload delivery and indicators across waves targeting Italian organisations.
Blog · research & analysis
Latest analysis
Read the analysis
TrickBot infection of January 2019
TrickBot is a banking-trojan malware that steals the login credentials of targeted banking sites using webinjects. Since June 2018 TrickBot features lateral movement capabilities in order to propagate itself from an infected client to a vulnerable domain controller. TrickBot Screenshots TrickBot Indicators Of Compromise (IOCs)
Compromise and Mining — Detection & Response
Cryptomining as a post-compromise objective: indicators on Linux and Windows endpoints, persistence techniques, network signals and containment workflow.
Hybrid Cyber Warfare between Russia and Ukraine — Italy among the targets
Russia-Ukraine cyber conflict: spillover operations on Italian organisations, attribution signals, defacement and DDoS waves, intelligence-driven defence priorities.
Today’s NATO event invitation used by a gang of cybercriminals
Among the cyber attacks recorded daily, there are some of more sophisticated nature. They are called Advanced Persistent Threats (APTs). These threats, among which some are state-sponsored, appear to be part of a Cyber Warfare scenario. Yet, they are as real as they can get and target specific information, such as company know-how, personal information or bank transactions. A team of analysts with appropriate … Read more
APT28 leverages the NATO event
APT28 (Fancy Bear) timing operations around NATO events: spearphishing lures, fake credential portals, payload delivery patterns and attribution signals.
Italian IoT devices abused for cyber attacks
Italian IoT devices conscripted into botnets and used as launch pads for cyber attacks: device profiles, exposure metrics and remediation considerations.
Ursnif Malware — behaviour and removal
Ursnif (Gozi/ISFB) banking trojan: persistence mechanisms, web-injection capabilities, command-and-control patterns and remediation steps for infected hosts.
Ursnif — attacks in Italy
Ursnif campaigns aimed at Italian organisations: phishing lures in Italian, payload delivery patterns and C2 hosting trends observed across multiple waves.
