Logo
Hamburger Menu Icon
Yoroi Background

Yoroi Blog

ブログ

Warning: Vulnerabilità in EMS Siemens

Proto: N010419. Con la presente Yoroi desidera informarLa relativamente ad una vulnerabilità all’interno dell’Energy Management System (EMS) Spectrum Power di Siemens, sistema utilizzato in varie realtà ad elevata criticità in ambito manufacturing, energy, chimica, alimentare e agricoltura, gestione acque ed infrastrutture critiche. La problematica è nota con l’identificativo CVE-2019-6579. Ricercatori di terze parti hanno infatti […]

Read More

LimeRAT spreads in the wild

Introduction Few days ago, Cybaze-Yoroi ZLab team came across an interesting infection chain leveraging several techniques able to defeat traditional security defences and hiding a powerful inner payload able to seriously threaten its victims. The whole infection chain was originated by a LNK file, a technique used by advanced attackers and APTs too, for this […]

Read More

Yoroi Welcomes "Yomi: The Malware Hunter"

Nowadays malware represents a powerful tool for cyber attackers and cyber criminals all around the world, with over 856 million of distinct samples identified during the last year it is, with no doubt, one of the major kinds of threat that companies and organizations are tackling to keep running their business without losing resources, time, […]

Read More

Ursnif: The Latest Evolution of the Most Popular Banking Malware

Introduction Few days ago, the researchers of ZLab Yoroi-Cybaze dissected another attack wave of the infamous Ursnif malware, also known as Gozi ISFB, an offspring of the original Gozi which source code was leaked in 2014. Ursnif/Gozi is active from over a decade and was one of the most active malwares listed in 2017 and […]

Read More

Ghidra SRE: The AZORult Field Test

Introduction One of the most anticipated moments in the infosec community during the last few months was, with no doubt, the Ghidra public release. On the 5th of March, at the RSA conference, Ghidra has been presented to the public revealing the inner details of the Software Reverse Engineering (SRE) framework that National Security Agency […]

Read More

Grave Vulnerabilità in Magento

Proto: N080319. Con la presente Yoroi desidera informarLa relativamente ad una grave vulnerabilità all’interno di Magento, noto framework per la realizzazione di portali e-commerce in PHP recentemente acquistato da Adobe, tra le dieci tecnologie open-source più popolari nel panorama cibernetico italiano. La criticità è nota con l’identificativo “PRODSECBUG-2198”. La problematica è originata da lacune nella […]

Read More

Decrypting the Qrypter Payload

Introduction During the last weeks, Yoroi’s monitoring operation intercepted some malicious emails required further attention: they were sent to a very few organizations and the contents was specifically tailored for Italian speaking targets. This messages warned the users about imminent summons against them, inviting them to read the attached lawsuit, a not so innocent looking […]

Read More

The Ursnif Gangs keep Threatening Italy

Introduction The Ursnif trojan confirms itself as one of the most active malware threats in cyberspace, even during the past days, when new attack attempts reached several organization across Italy. Cybaze-Yoroi ZLab teams dissected its infection chain to keep tracking the evolution of this persistent malware threat, analyzing its multiple stages, each one with the […]

Read More

Campagna di Attacco Ransomware

Proto: N070319. Con la presente Yoroi desidera informarLa relativamente ad una pericolosa campagna di attacco rivolta ad aziende italiane. Le email intercettate sono appositamente curate per ingannare i malcapitati destinatari simulando l’invio di candidature spontanee per posizioni vacanti. Il documento Office in allegato contiene però codice macro in grado di infettare la macchina bersaglio con […]

Read More

Importante Vulnerabilità in “Ruby on Rails”

Proto: N060319. Con la presente Yoroi desidera informarLa relativamente ad una importante vulnerabilità recentemente scoperta all’interno di Ruby on Rails, diffuso framework per la realizzazione di applicazioni web moderne basate sul paradigma MVC, utilizzato da oltre un milione di siti web in tutto il mondo e più di tre mila in Italia. La criticità è […]

Read More

The Document that Eluded AppLocker and AMSI

Introduction Few days ago, during intel sources monitoring operation, the Cybaze-Yoroi ZLAB team encountered an interesting Office document containing some peculiarities required a deeper analysis: its payload includes techniques suitable to bypass modern Microsoft security mechanisms such as AppLocker, the application whitelisting security feature in place in well-configured Windows OSes, and the newer Anti-Malware Scan […]

Read More

Campagna di Attacco Ursnif in Corso

Proto: N050319. Con la presente Yoroi desidera informarLa relativamente ad una emergente ondata di attacchi rivolta ai danni di organizzazioni ed utenze italiane. I messaggi di posta intercettati contengono documenti Excel malevoli in grado di evadere sistemi perimetrali ed analisi comportamentali, effettuano infatti controlli su configurazioni locali presenti sulla macchina bersaglio prima dell’avvio della catena […]

Read More
1 11 12 13 14 15 37
linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram