In April 2021, an unidentified Gold Southfield operator carried out a Ransomware attack against a European company. The initial access is performed by Gold Cabin, an access broker, that deploys IceID (Bokbot), a Remote Access Tool (RAT) malware[link]. Once inside the company, the access broker passes privileges to the main operator who deploys the REvil ransomware. This threat actor […]
In March, Fortgale detected a significant increase in malicious activity targeting Italian companies associated with the spread of the Trojan IceID malware. The most relevant activity was identified in the March 16 campaign in which the criminal actor manipulated previous conversations of the victims by inserting a malicious attachment with theHTML Smuggling technique: A company […]
Fortgale has identified an offensive campaign targeting Italian business systems, carried out via malicious email containing the StrelaStealer malware. During the compromise, several techniques are observed including: Its purpose is usually to collect information about Outlook and ThunderBird accounts, as also confirmed by our technical analysis. The attention of these Threat Actors is focusing on […]
Negli ultimi giorni sono stati osservati diversi nuovi attacchi Ransomware Conti associati alla presenza del malware TrickBot. L’aumento di attacchi e diffusione del ransomware sembrerebbe associata a nuovi accordi di affiliazione stretti tra i gruppi Hive0106 e Hive0107 con la gang TrickBot, nota anche per i malware BazarLoader e TirckBot. Il Malware Il Trojan bancario TrickBot […]
