Recentemente, gli operatori di AgentTesla hanno rafforzato le campagne di malspam in Italia, confermando la tendenza osservata negli ultimi mesi verso un maggiore impiego di allegati PDF. Questi documenti contengono link che, una volta cliccati, avviano il download di file con codici JavaScript dannosi.
Key Findings Explosive AI growth: Enterprise AI/ML transactions surged by 595% between April 2023 and January 2024. Concurrent rise in blocked AI traffic: Even as enterprise AI usage accelerates, enterprises block 18.5% of all AI transactions, a 577% increase signaling rising security concerns….
Domestic violent extremists (DVEs) in the United States have increasingly targeted senior public- and private-sector leaders by publishing their personally identifiable information (PII), expanding beyond prior targets to include executives and officials and e…
Exploitation of CVE-2023-48788 in FortiClientEMS allows unauthenticated attackers to execute code via an SQL injection, enabling initial access into organizations. eSentire notes that attackers deploy persistence mechanisms such as reverse webshells and Screen…
Tax-season phishing campaigns are escalating with QR-code schemes, fake refunds, and AI-assisted imposters designed to steal credentials and money. Check Point Research outlines campaigns impersonating IRS/HMRC, malicious PDFs, fake domains, and dark-web marke…
A heavily obfuscated JavaScript dropper named “_Rechnung_01941085434_PDF.js” uses UTF-16 BOM, massive unused code, and embedded Base64 to conceal its payloads. It then drops a multi-stage PowerShell chain that downloads and executes remote payloads, culminatin…
The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening to leak three terabytes of alleged stolen data. The INC Ransom extortion gang added the National Health Service (NHS) of Scotland to the list of victims on its Tor leak site. The cybercrime group claims to have stolen three terabytes of […]
The article demonstrates using the Validin DNS analysis tool to perform DNS pivoting — extracting domain history, IP histories, and related domains to expose malicious infrastructure. Examples show pivots from domains to IPs, IP-to-domain pivots, lookalike-dom…
____________________ Summary: The Finnish police have linked APT31 to the 2021 parliament attack, confirming their suspicions and identifying a suspect. Key Point 🕵️♂️: – The attack on the parliament was attributed to the China-linked group APT31. – The investigation revealed a complex criminal inf…
Summary: The State Department is warning employees about a fraudulent scheme targeting their payroll accounts, involving phishing and social engineering tactics. Key Point: 🔒 Cybercriminals are using phishing, email takeovers, and social engineering to redirect employee payroll deposits. 📧 The schem…
Summary: Leaked documents reveal Australia was targeted by Chinese hackers, indicating a sophisticated international hacking operation with ties to the Chinese government. Key Point: 🔒 Australia was on the targeted list, but specific targets were not mentioned. 🔒 i-Soon often pitched to Chinese gove…
Threat Actor: – Unknown individual or group selling the zero-day vulnerability Victim: – Major financial institutions, including: – Cryptocurrency exchanges – Governmental organizations – Banking institutions Information: – The zero-day vulnerability is specifically designed to target large financia…
Cyble CRIL observed a tax-themed spam campaign delivering multi-stage malware that ultimately deploys WarzoneRAT (aka Avemaria) via reflective .NET loading or DLL sideloading. The chain uses LNK → HTA → VBScript → PowerShell (or a legitimate EXE + malicious DL…
____________________ Summary : The tech industry’s focus on innovation has left security behind, leading to increased cyber threats and vulnerabilities. Key Point : 🔒 Technology companies face rising cyber threats, with ransomware gangs stealing sensitive data and phishing attacks targeting crypto u…
Summary : TheMoon malware infects thousands of ASUS routers in a short period, serving as a proxy for cybercriminals. Key Point : 🔒 TheMoon malware targets outdated ASUS routers for proxy service. 🌐 Malware operations like IcedID and SolarMarker use the proxy botnet. 🔑 Attackers may exploit known vu…