CERT-AGID Reports 170 Malicious Campaigns Affecting Italy in a Week
Summary
CERT-AGID identified 170 malicious campaigns affecting Italy and shared 1,391 IoCs with accredited organizations. Phishing impersonated public services and businesses, while campaigns also distributed multiple malware families through email, SMS, and malicious files.
Key points
- CERT-AGID identified 170 campaigns: 136 targeting Italy and 34 generic campaigns that also affected the country; it provided accredited organizations with 1,391 IoCs.
- The report identified 20 themes used in campaigns. Refund-themed phishing appeared in 65 campaigns, while campaigns impersonating unpaid fines appeared in 25.
- Phishing impersonated the Italian Health Record service to steal personal information and the Business Register to collect company and representative details, including tax codes and IBANs.
- Tax-refund lures impersonating the Revenue Agency sought personal information, tax codes, and payment-card details.
- The report identified 11 malware families affecting Italy, including FormBook, Remcos, MassLogger, BingoMod, SnakeKeylogger, and Grandoreiro.
- Delivery methods included email and SMS, archive files such as ZIP, RAR, and TAR, and malicious Android APK download links.
Article Details
- Publisher
- CERT-AGID
- Report Period
- September 5–11; year not stated
- Scope
- Malicious campaigns observed in the Italian scenario monitored by CERT-AGID.
- Sample Size
- 170 campaigns analyzed
- Key Statistics
- 170 malicious campaigns were observed: 136 with Italian targets and 34 generic campaigns that also affected Italy.
- CERT-AGID identified 1,391 indicators of compromise and made them available to its accredited entities.
- 20 themes were used to deliver malicious campaigns.
- 11 malware families affected Italy during the week.
- Phishing campaigns involved 36 brands.
Malware
AgentTeslaAgentTesla – Rilevata una campagna generica ad argomento “Fattura” distribuita tramite allegati ZIP.BingoModUsato inoltre per veicolare i malware BingoMod, FormBook, Gigabud, MantaxOtax e MassLogger.FormBookUsato inoltre per veicolare i malware BingoMod, FormBook, Gigabud, MantaxOtax e MassLogger.GigabudUsato inoltre per veicolare i malware BingoMod, FormBook, Gigabud, MantaxOtax e MassLogger.GrandoreiroGrandoreiro – Scoperta una campagna generica a tema “Legale” che utilizza archivi ZIP.MantaxOtaxUsato inoltre per veicolare i malware BingoMod, FormBook, Gigabud, MantaxOtax e MassLogger.MassLoggerUsato inoltre per veicolare i malware BingoMod, FormBook, Gigabud, MantaxOtax e MassLogger.NeptuneRatNeptuneRat – Individuata una campagna italiana “Fattura” che abusa di allegati ZIP.RemcosRemcos – Individuate quattro campagne generiche a tema “Delivery”, “Documenti”, “Fattura” e “Pagamenti” veicolate tramite file ZIP, RAR e XLS.SnakeKeyloggerSnakeKeylogger – Scoperte due campagne italiane “Delivery” e “Pagamenti” diffuse via archivi ZIP e RAR.XWormXWorm – Individuate due campagne generiche a tema “Prezzi” e “Pagamenti” che sfruttano file ZIP e JS.