CERT-AGID Reports 217 Malicious Campaigns Affecting Italy in One Week
Summary
CERT-AGID analyzed 217 malicious campaigns affecting Italy in one week (187 targeting Italy, 30 generic) and shared 1,097 IoCs with accredited entities. Unpaid-fine phishing was prominent; AgentTesla and Remcos were among the malware reported.
Key points
- CERT-AGID analyzed 217 campaigns: 187 targeted Italian entities and 30 generic campaigns also affected Italy; it shared 1,097 IoCs with accredited entities.
- Phishing about unpaid fines appeared in 98 campaigns, using email or SMS that impersonated SEND, PagoPA, ACI, or Telepass.
- The report identified 12 malware families affecting Italy. AgentTesla and Remcos each appeared in one Italian and six generic campaigns.
- Malware delivery commonly used email attachments, including ZIP, GZ, JS, LHA, TAR, and XLAM files for AgentTesla, and ZIP, 7Z, GZ, PDF, RAR, and XLS files for Remcos.
- A CERT-AGID study described how fine-tuning could insert a backdoor into open-weight model weights, remaining inactive during initial checks and activating after a specific MCP server was introduced to make unauthorized outbound HTTPS calls.
Article Details
- Publisher
- CERT-AGID
- Report Period
- October 31–November 6 (year not stated)
- Scope
- Malicious campaigns affecting Italy, including Italian-targeted and generic campaigns; also includes a CERT-AGID study on backdoors in open-weight models.
- Sample Size
- 217 campaigns analyzed
- Key Statistics
- 187 campaigns targeted Italian organizations or users; 30 generic campaigns also affected Italy.
- CERT-AGID identified 1,097 IOCs and made them available to accredited entities.
- Thirty themes were used to deliver campaigns in Italy.
- The “Multe” (fines) theme appeared in 98 Italian phishing campaigns.
Malware
AgentTeslaMalware veicolati: AgentTesla (2), Remcos (2), Mirax (1).AsyncRATMalware veicolati: AsyncRat (1), PapRAT (1), Remcos (1).DCRatdcRat – Rilevata una campagna generica a tema “Altro”, veicolata per mezzo di allegato JS.DonutLoaderRilevate infine altre campagne di DonutLoader, LXBaserat, Mirax, PapRAT, PureLogs Stealer e Ransomware che hanno sfruttato i temi “Pagamenti”, “Banking”, “Contratti”, “Documenti” e “Supporto IT”.FormBookFormBook – Rilevate tre campagne generiche a tema “Contratti”, “Ordine” e “Prezzi”, veicolate per mezzo di allegati RAR e TAR.LXBaseratMalware veicolati: LXBaserat (1), PureLogs Stealer (1), Remcos (1).MiraxMalware veicolati: AgentTesla (2), Remcos (2), Mirax (1).PapRATMalware veicolati: AsyncRat (1), PapRAT (1), Remcos (1).PureLogs StealerMalware veicolati: LXBaserat (1), PureLogs Stealer (1), Remcos (1).Remcos RATMalware veicolati: LXBaserat (1), PureLogs Stealer (1), Remcos (1).XWormXWorm – Rilevate due campagne generiche a tema “Fattura”, veicolate per mezzo di allegato RAR.