WannaCry! Un ransomware dal codice grossolano mette in ginocchio il cyber-spazio.

WannaCry! Un ransomware dal codice grossolano mette in ginocchio il cyber-spazio.

Nel momento in cui scrivo, tutti i professionisti dell'IT Security avranno già sentito parlare del ransomware che sta terrorizzando il mondo: WannaCry. Dal 12/05 ogni blog specializzato nel settore oltre che la stampa in genere, non fa che parlare dei danni (reali, ipotetici o presunti) che l'incrontrollata diffusione di tale codice starebbe causando. Da circa un paio di giorni ho iniziato a studiare in maniera abbastanza approfondita diversi campioni (malware samples) appartenenti alla campagna … [Read more]

EyePyramid – A truly mysterious malware is shaking Italy !

EyePyramid - A truly mysterious malware is shaking Italy !

EyePyramid. This is the name of the malware that is shaking the Italian institutions as well as the private sector of this country. I recovered, from open sources and from a collection of malware, some samples probably belonging to the family in object. I elaborated as well a simple behavioral workflow after my first analysis available for download. EyePyramid is not an advanced threat. It's a malware built in vb.net and leans to a whole infrastructure built on Microsoft products. This is … [Read more]

“Office Monkeys” Russian actor is using hacked netmon services as C&C

"Office Monkeys" Russian actor is using hacked netmon services as C&C

The APT russian actor "Office Monkeys" is able to perform low-profile attacks against high-value targets after in depth surveillance. The campaign is currently targeting government organizations, research institutions, and think tanks in democratic countries. The actor uses compromised legitimate website to host their spear-phishing end-points and command and control centers. Its spear-phishing attack delivers malware payload via code-protected .zip files  attached to the email (with the code to … [Read more]