CERT-AGID Reports 202 Malicious Campaigns Affecting Italy in Weekly Review
Summary
CERT-AGID analyzed 202 malicious campaigns affecting Italy, including 162 targeting Italian entities, and shared 1,460 IoCs. Phishing centered on fines, renewals, banking and refunds; 14 malware families were observed.
Key points
- CERT-AGID reported 202 campaigns affecting Italy: 162 with Italian targets and 40 generic campaigns that also affected the country.
- The report lists 1,460 IoCs made available to accredited entities.
- Twenty themes were used in campaigns; fines led with 62 Italian phishing campaigns, followed by renewals with 44.
- The 14 malware families observed included Remcos, FormBook, AgentTesla, LXBaserat, PureLogs, XWorm, BingoMod and Guloader.
- Malware campaigns used ZIP, TAR, XLS, RAR, ISO and other attachments.
- The weekly roundup also noted security updates for two critical PHP vulnerabilities that could allow remote code execution under certain conditions, plus two open-source tools for checking exposure.
Article Details
- Publisher
- CERT-AGID
- Report Period
- 17–23 October; year not stated
- Scope
- Malicious campaigns affecting Italy, including Italian-targeted and generic campaigns.
- Sample Size
- 202 campaigns analyzed.
- Key Statistics
- 202 malicious campaigns were observed: 162 targeting Italy and 40 generic campaigns that also affected Italy.
- 1,460 IOCs were identified and made available to accredited entities.
- 20 themes were used to deliver malicious campaigns.
- 14 malware families affected Italy.
- 34 brands were involved in phishing campaigns.
Malware
AgentTeslaAgentTesla – Rilevate tre campagne generiche “Contratti”, “Preventivo” e “Pagamenti” diffuse con allegati ZIP, RAR e XLS.BingoModImpiegato inoltre per veicolare i malware LXBaserat e Bingomod.BlackHawkRilevate infine diverse campagne generiche Vidar, UCreator, DarkCloud, Grandoreiro, VipKeylogger, BlackHawk che hanno sfruttato i temi “Fattura”, “Banking”, “Delivery”, “Legale”, “Contratti”.DarkCloudRilevate infine diverse campagne generiche Vidar, UCreator, DarkCloud, Grandoreiro, VipKeylogger, BlackHawk che hanno sfruttato i temi “Fattura”, “Banking”, “Delivery”, “Legale”, “Contratti”.FormBookOrdine – Tema sfruttato in 8 campagne 3 italiane e 5 generiche, Identità sfruttate per veicolare i malware Remcos, FormBook, PureLogs e Guloader.GrandoreiroRilevate infine diverse campagne generiche Vidar, UCreator, DarkCloud, Grandoreiro, VipKeylogger, BlackHawk che hanno sfruttato i temi “Fattura”, “Banking”, “Delivery”, “Legale”, “Contratti”.GuLoaderOrdine – Tema sfruttato in 8 campagne 3 italiane e 5 generiche, Identità sfruttate per veicolare i malware Remcos, FormBook, PureLogs e Guloader.LXBaseratImpiegato inoltre per veicolare i malware LXBaserat e Bingomod.PureLogs StealerIndividuate due campagne generiche di PureLogs Stealer diffuse con allegati GZ e TARRemcosOrdine – Tema sfruttato in 8 campagne 3 italiane e 5 generiche, Identità sfruttate per veicolare i malware Remcos, FormBook, PureLogs e Guloader.uCreatorRilevate infine diverse campagne generiche Vidar, UCreator, DarkCloud, Grandoreiro, VipKeylogger, BlackHawk che hanno sfruttato i temi “Fattura”, “Banking”, “Delivery”, “Legale”, “Contratti”.VidarRilevate infine diverse campagne generiche Vidar, UCreator, DarkCloud, Grandoreiro, VipKeylogger, BlackHawk che hanno sfruttato i temi “Fattura”, “Banking”, “Delivery”, “Legale”, “Contratti”.VipKeyloggerRilevate infine diverse campagne generiche Vidar, UCreator, DarkCloud, Grandoreiro, VipKeylogger, BlackHawk che hanno sfruttato i temi “Fattura”, “Banking”, “Delivery”, “Legale”, “Contratti”.XWormuna campagna XWorm “Booking” italiana e “Pagamenti” generica distribuite con allegati ZIP e PDF.