#Wikiloader #TA544 malspam spotted in #Italy 🇮🇹

EML>.pdf>url>.zip>.js>notepad.exe

🔗s://diretkontakt,com/Quote-Services

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll

wscript.exe Invoice-808.js

wscript.exe sso.js

C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇

\npp.8.6.3.portable.x64\plugins\mimeTools.dll

(1/3)👇

IOC's
github.com/pr0xylife/Wiki…

#TA544 back using #Remcos after using #SystemBC briefly last week. Unique page,link URLs redir to .url file with file://.zip/.vhd SMB target abusing CVE-2023-36025 so it will mount the VHD by just opening the .URL. Exe using #DOILoader #IDATLoader w. local payload. cc Will Dormann

innovation in cyber intrusions the evolution of ta544 yoroi.company/en/research/in… #pentesting #cybersecurity #Infosec

TA544, aka Bamboo Spider or Zeus Panda, spreads WailingCrab via delivery-themed emails. This sophisticated malware infiltrates systems, prioritizing stealth to resist analysis efforts. Learn more about this threat in our #ThreatAdvisoryTuesday report. okt.to/E3otsY

#Hacking #Ursnif #Malware #Vulnerability #Cyberespionage #CyberCrime #CyberAttack #CyberSecurity
TA544 group behind a spike in Ursnif malware campaigns targeting Italy.
proofpoint.com/us/blog/securi…

Autograph and manuscript notes from Library of Virginia’s copy of: Leybourn, William, 1626-1716. The compleat surveyor, or, The whole art of surveying of land. London : Printed for S. Ballard, 1722

TA544 .L68 1722

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll

wscript Invoice_818493.js

wscript out.js

C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇

\npp.8.6.3.portable.x64\plugins\mimeTools.dll

(1/3) 👇

IOC's
github.com/pr0xylife/Wiki…

🔎 Se ha observado un nuevo downloader denominado WikiLoader que ha sido detectado en varias campañas dirigidas específicamente a organizaciones financieras en Italia. Este está relacionado con el actor de amenaza (TA) conocido como TA544.
👉 Más info: csirtasobancaria.com/sala-de-prensa…

#DanaBot back in email threat data? You botcha. On 14 Feb, TA544 targeted Italian organizations using Agenzia delle Entrate lures to distribute Google Firebase PageLink URLs.

Too in #italy #WikiLoader - #TA544 #quickbooks

'Invoice Reminder: Your payment to Allen&Overy LLP '
EML>PDF>url>zip>js>js>dll

⚠️zip Url
https[:]//infplaute[.]com/international-commercial

❇️Samples
bazaar.abuse.ch/browse/tag/Wik…

☢️ #TA544 #phishing #Italy 🇮🇹

Subject: Emissione bolletta PEC

xls: 109d15a7d33e671ded911d97bc4a15ab
url (503): dooxil[.]com

Enel Energia Clienti Enel Group

#WikiLoader - #TA544 - .pdf > url > .zip > .js > .js > .dll

wscript Inv_03_20_2024.js

wscript confidential-legal.js

C:\Users\Admin\AppData\Local\Temp\npp.8.6.4.portable.x64\notepad.exe (sideload)👇

\npp.8.6.3.portable.x64\plugins\mimeTools.dll

IOC's
github.com/pr0xylife/Wiki…

🇮🇹 Il gruppo #TA544 cambia ancora strategia sfruttando il malware #Danabot

⚠️ La lista individuata comprende gli URL di 20 banche italiane. Si tratta di un modulo in grado di modificare dinamicamente il contenuto delle pagine iniettando codice JS.

🔗 cert-agid.gov.it/news/il-gruppo…

Continuing to learn different libraries in Python, I wanted to create a scatter plot of different domain names attrib'd to #TA544 . A lot of work left to clean it up, but it always feels good when you see the end product of something you created.

TA544 group behind a spike in Ursnif malware campaigns targeting Italy dlvr.it/S8rkGs

Sintesi riepilogativa delle campagne malevole nella settimana del 10 - 16 Febbraio 2024

➡️ Attacchi a device #Android con #SpyNote e #IRATA
➡️ #TA544 > #Danabot e #AgenziaEntrate
➡️ #Pikabot con XLS e #SMB

💣 #IoC 276
🦠 #Malware 9
🐟 #Phishing 8

🔗 cert-agid.gov.it/news/sintesi-r…

TA544, aka Bamboo Spider or Zeus Panda, spreads WailingCrab via delivery-themed emails. This sophisticated malware infiltrates systems, prioritizing stealth to resist analysis efforts. Learn more about this threat in our #ThreatAdvisoryTuesday report. okt.to/PjNphF

HijackLoader Gelişiyor: Araştırmacılar En Son Kaçınma Yöntemlerinin Kodunu Çözüyor

sibermuhbir.com/haber/hijacklo…

#hijackloader #sibertehdit #cyberthreat #guvenlik #security #endpoint #vulnerability #sibermuhbir #crowdstrike #ta544 #idatloader

TA544の話についてはJSAC2020で、ばらまきメール回収の会のメンバーも発表をしているので、気になる方は。

jsac.jpcert.or.jp/archive/2020/p…