🐁 #Malware #Rat #JRat #Adwind targeting #italy 🇮🇹

'QUOTATION REQUEST NR.13346'

🔥c2:
103.114.107.184:7180

Gianni Amato TG Soft Brad merlos @Dr_N0b0dyh Bl4ng3l Joe Roosen moto_sato sugimu

#infosec #CyberSecurity #DFIR

full config below👇

🌊very big waves of😈 #QakBot #Qbot #Malware target (also) #Italy 🇮🇹

➡️urlhaus.abuse.ch/browse/tag/Qak…
🔥c2: pastebin.com/Q8wMY549

James Quinn Gianni Amato James Joe Roosen merlos @Dr_N0b0dyh Bl4ng3l TG Soft Tommy M (TheAnalyst)

#infosec #CyberSecurity #DFIR

😈 #Lokibot #Malware from CVE 2017-11882
⚙️app.any.run/tasks/9e9b31ed…
1⃣hxxp://wsdyshgshgnationalobjindustrialatwsmbq.ydns.eu/shengdoc/vbc.exe
🔥c2: hxxp://forrastfoods.com/candy/five/fre.php
Gianni Amato merlos Bl4ng3l @Dr_N0b0dyh James
#infosec #CyberSecurity #DFIR

😈 #Malware #Gozi #Italy 🇮🇹
thanks moto_sato

➡️s://fatturanumeroverde.com/
🔥c2:kaztam,com

⚙️run:app.any.run/tasks/b30474d4…
Gianni Amato merlos Bl4ng3l TG Soft @Dr_N0b0dyh Francesco Bussoletti sugimu .sS.!
#infosec #CyberSecurity #DFIR

twitter.com/58_158_177_102…

#Malware #Gozi targeting #italy 🇮🇹
using old template pwd protected!
doc:app.any.run/tasks/c5acd0ee…
dll:app.any.run/tasks/36a2830f…
🔥c2: ystatistics.]com
Cert AgID Gianni Amato merlos Bl4ng3l TG Soft @Dr_N0b0dyh Francesco Bussoletti sugimu .sS.!

#infosec #CyberSecurity

😈 #Malware #Gozi #Ursnif targets #Italy 🇮🇹 as fake Enel Group invoice

Sollecito di pagamento

⚙️app.any.run/tasks/16198cd4…

dropUrL: hxxps://willeam.org

c2:🔥
santaliny.]org

Cert AgID Gianni Amato merlos lc4m Bl4ng3l TG Soft Francesco Bussoletti

#infosec #CyberSecurity

#Malware #Gozi #Ursnif back again targeting #Italy 🇮🇹
h/t moto_sato

⚙️app.any.run/tasks/66bb7564…

🔥
hxxp://agentsystems.cyou/opzionalla.dll
statwindows.]com

Cert AgID Gianni Amato merlos Matteo Lodi lc4m Bl4ng3l TG Soft Francesco Bussoletti
#infosec #CyberSecurity

#Malware #AgentTesla targets #Italy 🇮🇹

💉RegAsm

⚙️app.any.run/tasks/0e01d981…

🔥
mail.ebop.]website

Cert AgID Gianni Amato merlos Matteo Lodi lc4m Bl4ng3l TG Soft Francesco Bussoletti

#infosec #CyberSecurity

😈 #Remcos #Malware #Keylogger targeting #Italy 🇮🇹

'Ciao buon giorno'

app.any.run/tasks/9de16759…

c2🔥 uzbektourism8739.ddns.[net

Cert AgID Gianni Amato hiddenaccount merlos CSIRT Italia Bl4ng3l TG Soft Francesco Bussoletti moto_sato sugimu

#infosec #CyberSecurity

#NEFILIM : 'It seems that the security advisors do not know how to do their job or they were asked by Luxotica to lie for them. Luxotica knew that the breach has happened and received proof of the breach.'

moto_sato sugimu Frost Bl4ng3l Peter Kruse | Cybercrime Research

😈 #Malware #MassLogger targets #Italy 🇮🇹

'MOU Conditions'

R19 > CHM > PS > RegAsm

🔥
hxxp://optovision.gr/4B.jpg
med-star.]gr

⚙️app.any.run/tasks/61a8f81c…

Gianni Amato Cert AgID merlos Matteo Lodi lc4m @Dr_N0b0dyh Bl4ng3l TG Soft CSIRT Italia
Francesco Bussoletti
#infosec

😈 #Malware #QRAT targeting #Italy 🇮🇹

'In allegato una ricevuta della transazione'

JAR > JS
🔥francis77.hopto[.org

⚙️app.any.run/tasks/4eb04a88…

Gianni Amato Cert AgID merlos Matteo Lodi lc4m @Dr_N0b0dyh Bl4ng3l TG Soft CSIRT Italia Francesco Bussoletti
#infosec #CyberSecurity

😈Fresh #Formbook #Malware using discordapp loader!

⚙️app.any.run/tasks/9ec07b95…

➡️hxxps://cdn.discordapp.com/attachments/751870937779011659/760751237380702228/Uxuzzzz

🔥c2 list: pastebin.com/1Uax6brn

#infosec #DFIR #CyberSecurity

#Phobos ransomware targeting #Italy

2EFF58738B5A7717A3FCDF7A4171C6FA18492BC200EDDC26BF608FA35D28466E

technopc[at]protonmail[.com
technopc[at]tuta[.io

Sample: app.any.run/tasks/a3652d12…

h/t Ludovico Loreti
cc lc4m CSIRT Italia reecDeep Bl4ng3l Pierluigi Paganini - Security Affairs Francesco Bussoletti

#OSTAP #ITA 🇮🇹 2020-09-28
Campagna: 'Fattura n. '

DOC: 45DFEB37B180D81BA5FBB5518DD94727
JSE: 9E4A5826A1A1CF37B3027322A8E74486

C2: https://188.116.36.]143

moto_sato CSIRT Italia Cert AgID Gianni Amato Frost Bl4ng3l Andrea De Pasquale

#Malware #Masslogger targeting #Italy 🇮🇹 from JS script

'doc20200916XXXXXX.R04'
where X={0,9}

app.any.run/tasks/84635b86…

1⃣ hxxp://gsbc.gr/F12.jpg
🔥nankasa[.com[.ar

CSIRT Italia Gianni Amato TG Soft merlos Matteo Lodi lc4m Bl4ng3l Francesco Bussoletti

#infosec #CyberSecurity

⚠️malicious #VBS targets #Italy 🇮🇹

#SLoad #Malware

'Allegato_doc_XXXXXXXXXXX.7z'

s://sapphireloading.com/sal/XXXXXXXXXXX/it.css

c2🔥
uykjhfgn.]eu ,cvbyti.]eu

CSIRT Italia Gianni Amato TG Soft Matteo Lodi D3Lab Antelox Francesco Bussoletti merlos

#infosec #CyberSecurity

New #malspam #sexstortion campaign 🇮🇹. Crooks try to blackmail Italian victims to pay 1000$ ..

reecDeep illegalFawn
James
abuse.ch Paul Melson Antelox Artilllerie ☣ James Quinn ⛧ɉªɳ ҎʘΰⱠᶊᶓא⛧🇺🇦 marc ochsenmeier

🚨Another big #malspam campaign targets #Italy 🇮🇹
#Gozi #Malware ( #Ursnif )

1⃣social.farfetchedproductions.[com/Previdenza_Sociale.jar

2⃣line.campdiy[.com/nazionale.jpg

CSIRT Italia Gianni Amato Cert AgID TG Soft Bl4ng3l lc4m moto_sato

#infosec #CyberSecurity

🐁 #Netwire #Malware RAT from #malspam

15 mins run: app.any.run/tasks/b2a10fd5…

🔥c2: owo.myftp.[biz:3990 (161.129[.65.142)

Brad James ExecuteMalware Malware Patrol Suspicious Link Frost Herbie Zimmerman Racco42 Bl4ng3l

#infosec #CyberSecurity