CERT-AGID Reports 178 Malicious Campaigns Targeting Italy in the Week of Oct. 3–9
Summary
CERT-AGID tracked 178 malicious campaigns affecting Italy during Oct. 3–9 and shared 1,233 indicators of compromise with accredited entities. Phishing, malware delivery, and WhatsApp account-takeover scams were among the reported threats.
Key points
- CERT-AGID identified 178 campaigns: 143 targeting Italy and 35 generic campaigns that also affected the country; it provided accredited entities with 1,233 IoCs.
- Phishing campaigns used themes including banking, tax refunds, unpaid fines, and account renewals, impersonating organizations such as the Italian Revenue Agency and PagoPA.
- A phishing page impersonating the Italian Revenue Agency-Collection and AgID attempted to steal victims’ email addresses and passwords.
- The WhatsApp “ballerina” scam used messages from known contacts and a fake voting site to trick victims into authorizing an attacker-controlled device on their account.
- Fourteen malware families were observed, including Remcos, FormBook, AsyncRAT, GuLoader, SnakeKeylogger, and Android malware distributed through SMS links.
- The CERT also published a study on delayed-activation prompt injection, in which an instruction may remain dormant until a specified conversational trigger appears.
Article Details
- Publisher
- CERT-AGID
- Report Period
- 3–9 October; year not stated
- Scope
- Malicious campaigns affecting Italy, including Italian-targeted and generic campaigns; phishing and malware activity.
- Sample Size
- 178 campaigns analyzed
- Key Statistics
- CERT-AGID reported 178 malicious campaigns: 143 with Italian targets and 35 generic campaigns that also affected Italy.
- The report says 1,233 indicators of compromise were identified and made available to accredited entities; the indicators are not listed in the supplied article.
- 25 themes were used to deliver campaigns in Italy.
- 14 malware families affected Italy during the week.
- 42 brands were involved in phishing campaigns.
Malware
AgentTeslaRilevate infine diverse campagne italiane PureRat, QuasarRAT e StrRat e alcune generiche AgentTesla, PhantomStealer, ScreenConnect che hanno sfruttato i temi “Delivery”, “Documenti” e “Preventivo”.AsyncRATAsyncRat – Rilevate due campagne generiche “Contratti” e “Delivery”, distribuite entrambe con archivi RAR.FormBookImpiegato inoltre per veicolare i malware FormBook, Herodotus, MidnightMimosa e Novinarya.GuloaderGuloader – Osservate due campagne generiche a tema “Preventivo” e “Delivery” diffuse con allegati RAR e R11 contenenti script malevoli.HerodotusImpiegato inoltre per veicolare i malware FormBook, Herodotus, MidnightMimosa e Novinarya.MidnightMimosaImpiegato inoltre per veicolare i malware FormBook, Herodotus, MidnightMimosa e Novinarya.NovinaryaImpiegato inoltre per veicolare i malware FormBook, Herodotus, MidnightMimosa e Novinarya.PhantomStealerRilevate infine diverse campagne italiane PureRat, QuasarRAT e StrRat e alcune generiche AgentTesla, PhantomStealer, ScreenConnect che hanno sfruttato i temi “Delivery”, “Documenti” e “Preventivo”.PureRatRilevate infine diverse campagne italiane PureRat, QuasarRAT e StrRat e alcune generiche AgentTesla, PhantomStealer, ScreenConnect che hanno sfruttato i temi “Delivery”, “Documenti” e “Preventivo”.QuasarRATRilevate infine diverse campagne italiane PureRat, QuasarRAT e StrRat e alcune generiche AgentTesla, PhantomStealer, ScreenConnect che hanno sfruttato i temi “Delivery”, “Documenti” e “Preventivo”.RemcosRemcos – Scoperte due campagne italiane a tema “Delivery” e “Preventivo” e sette campagne generiche “Preventivo”, “Delivery”, “Documenti” e “Prezzi” veicolate per mezzo di allegati GZ, BAT, XLS, 7Z, ZIP e RAR.SnakeKeyloggerSnakeKeylogger – Scoperte due campagne generiche ad argomento “Contratti” e “Prezzi” veicolate attraverso archivi RAR e ZIP.StrRatRilevate infine diverse campagne italiane PureRat, QuasarRAT e StrRat e alcune generiche AgentTesla, PhantomStealer, ScreenConnect che hanno sfruttato i temi “Delivery”, “Documenti” e “Preventivo”.
Products
AndroidIndividuate tre campagne generiche Herodotus, MidnightMimosa e Novinarya a tema “Banking”, distribuite tramite SMS contenenti link per il download di APK malevoli per dispositivi Android.WhatsAppIl messaggio malevolo arriva su WhatsApp da un contatto conosciuto e contiene un link che conduce a un falso portale di votazione.