CERT-AGID Reports 121 Malicious Campaigns Affecting Italy in One Week
Summary
CERT-AGID identified 121 malicious campaigns affecting Italy and shared 965 indicators with accredited organizations. The weekly report also details phishing themes, malware families, and a scan of potentially vulnerable public-administration URLs.
Key points
- CERT-AGID identified 121 campaigns: 76 targeting Italy and 45 generic campaigns that also affected the country.
- The agency provided accredited organizations with 965 identified indicators of compromise.
- Fake unpaid-traffic-fine messages impersonating PagoPA were sent from compromised PEC accounts; a fake portal reportedly used real-time remote control to guide victims and steal personal and banking data.
- A scan of more than 22,000 public-administration index URLs found that 168 of 650 URLs previously flagged as potentially vulnerable had an updated PHP version; further system checks were still needed.
- The report identified 12 malware families affecting Italy, including Remcos, XWorm, FormBook, AgentTesla, and MassLogger, commonly delivered through email attachments.
- Phishing campaigns most often exploited themes including traffic fines, banking, renewals, deliveries, documents, and payments.
Article Details
- Publisher
- CERT-AGID
- Report Period
- 24–30 October (year not stated)
- Scope
- Malicious campaigns affecting Italy and a CERT-AGID review of potentially vulnerable URLs in the Italian Public Administration Index (IPA).
- Sample Size
- 121 campaigns analyzed; 965 IoCs identified.
- Key Statistics
- 121 campaigns were identified: 76 targeting Italy and 45 generic campaigns that also affected Italy.
- 965 indicators of compromise were identified.
- The report covered 23 themes used to deliver malicious campaigns.
- Of 650 URLs initially flagged as potentially vulnerable, 168 (25.8%) were found with an updated PHP version in a later review of more than 22,000 IPA URLs.
- 36 brands were involved in phishing campaigns during the week.
- Recommendations
- Conduct further checks on systems associated with potentially vulnerable URLs; the report says deeper checks remain necessary.
MITRE ATT&CK
Malware
AgentTeslaAgentTesla – Rilevate due campagne generiche a tema “Contratti” e “Ordine”, veicolate per mezzo di allegati TAR e ZIP.DonutLoaderDonutLoader – Rilevata una campagna generica a tema “Prezzi”, veicolata per mezzo di allegato XLS.FormBookFormBook – Rilevate una campagna italiana a tema “Ordine” e due campagne generiche a tema “Aggiornamenti” e “Prezzi”, veicolate per mezzo di allegati ZIP e 7Z.GhostBatMalware veicolati: GhostBat (1), Mirax (1), MrRobot (1), Remcos (1).GrandoreiroRilevate infine altre campagne di GhostBat, Grandoreiro, Guloader, Mirax, MrRobot e SnakeKeylogger che hanno sfruttato i temi “Banking”, “Pagamenti” e “Legale”.GuLoaderMalware veicolati: Guloader (1), Remcos (1), SnakeKeylogger (1).MassLoggerMassLogger – Rilevate due campagne generiche a tema “Ordine” e “Preventivo”, veicolate per mezzo di allegati RAR e TAR.MiraxMalware veicolati: GhostBat (1), Mirax (1), MrRobot (1), Remcos (1).MrRobotMalware veicolati: GhostBat (1), Mirax (1), MrRobot (1), Remcos (1).RemcosMalware veicolati: GhostBat (1), Mirax (1), MrRobot (1), Remcos (1).SnakeKeyloggerMalware veicolati: Guloader (1), Remcos (1), SnakeKeylogger (1).XWormMalware veicolati: XWorm (1).