Blog · research & analysis
The Incident Response activities carried out by our Team in the last period confirm the growing trend in the number of cyber attacks against Italian companies. What should make us reflect (beyond the numbers and the damage caused) is the technical evolution and increase in complexity of the latter. In fact, we notice greater interaction … Read more
On January 24, 2023, Fortgale identified an Agent Tesla malware campaign being delivered via email to compromise the systems of Italian companies. In this technical article, we will analyze the behavior of the malware and how it compromised its victims through the analysis of code characteristics and collected data. It has now become common practice … Read more
VMware ESXi #Ransomware: What is going on? What does the following code means? D6C324719AD0AA50A54E4F8DED8E8220D8698DD67B218B5429466C40E7F72657C015D86C7E4A In the last few hours, several sources have reported massive Ransomware-type activity against VMware ESXi servers exposed on a public network. The activity currently appears to be conducted by at least 2 different criminal groups. How? Both groups are exploiting a … Read more
In March, Fortgale detected a significant increase in malicious activity targeting Italian companies associated with the spread of the Trojan IceID malware. The most relevant activity was identified in the March 16 campaign in which the criminal actor manipulated previous conversations of the victims by inserting a malicious attachment with theHTML Smuggling technique: A company … Read more
After recent online publications regarding the TrueBot malware (VMware, Bleeping and THN), we have decided to contributing with our analysis of this potential new threat. At the end, you will find the indicators of compromise and a Yara rule to identify it. Before starting with the technical analysis of the malware, we believe it is … Read more
Fortgale has identified an offensive campaign targeting Italian business systems, carried out via malicious email containing the StrelaStealer malware. During the compromise, several techniques are observed including: Its purpose is usually to collect information about Outlook and ThunderBird accounts, as also confirmed by our technical analysis. The attention of these Threat Actors is focusing on … Read more
Recentemente il nostro team di analisti ha identificato l’utilizzo del Trojan PlugX all’interno di sistemi aziendali italiani. Il Trojan è riuscito ad infiltrarsi nei sistemi target tramite l’utilizzo di un dispositivo USB infetto.
Analisi del Malware RedLine inserito all’interno di una falsa installazione del software Notepad++
Fake Notepad usato per distribuire RedLine Stealer per mezzo di pubblicità Google Ads
