Category: research
The Arsenal Behind the Australian Parliament Hack
02/26/2019
Introduction In the past days, an infamous cyber attack targeted an high profile target on the APAC area: the Australian Parliament House. As reported by the Australian prime minister there was no evidence of any information theft and the attack has been promptly isolated and contained by the Australian Cyber Security Centre (ACSC), however the […]
The Long Run of Shade Ransomware
02/19/2019
Introduction Between January and February, a new, intense, ransomware campaign have been observed by many security firms. It spreads Shade/Treshold variants, one of the most dangerous threats in the cyber crime scenario, known since its massive infection into the Russian panorama back in 2015, its expansion has been tracked by several CSIRTs and CERTs all […]
Gootkit: Unveiling the Hidden Link with AZORult
02/12/2019
Introduction In the last days a huge attack campaign hit several organizations across the Italian cyberspace, as stated on bulletin N020219 the attack waves tried to impersonate legit communication from a known Express Courier. However, a deeper analysis by Cybaze-Yoroi ZLAB revealed interesting hidden aspects, spotting a connection between the AZORult toolkit and a particular […]
WhitePaper: Analisi di Collection #1 nel Panorama Cyber Italiano
02/11/2019
Introduzione Gli ultimi anni sono stati caratterizzati da incrementi sostanziali sia nel numero di attacchi informatici registrati sia nei volumi di malware prodotti da organizzazioni criminali. Questa evoluzione porta al consolidamento un'economia sommersa basata sulla compravendita di credenziali di ignari utenti, sulla realizzazione di Malware adHoc e sull’affitto di criminali informatici. Tale commercio avviene in […]
Ursnif: Long Live the Steganography!
02/07/2019
Introduction Another wave of Ursnif attacks hits Italy. Ursnif is one of the most active banking trojan. It is also known as GOZI, in fact it is a fork of the original Gozi-ISFB banking Trojan that got its source code leaked in 2014 updating and evolving Gozi features over the years. Also in this variant, […]
The return of AdvisorsBot
02/01/2019
Introduction In the past days, a new particular sample has been analyzed by the researchers of Cybaze- Yoroi ZLab. As usual, the malware looks like a legitimate e-mail attachment, named as “invoice.doc”. Today, weaponized microsoft office documents with macros, are one of the most common and more effective methods to deliver malware, because they also […]
Sofacy's Zepakab Downloader Spotted In-The-Wild
01/29/2019
In the last weeks, the Cybaze-Yoroi ZLAB investigated a new APT28 campaign discovered in January 2019. The sample has been initially identified by an Italian independent security researcher, who warned the InfoSec community and shared the binary for further analysis. Cybaze-Yoroi ZLab researchers analyzed this sample to extract indicators and investigate their presence into the […]
The Story of Manuel's Java RAT
01/25/2019
Introduction During the last weeks, the Cybaze-Yoroi ZLab researchers identified infection attempts aimed to install RAT malware directed to the naval industry sector. The malicious email messages contained a particular Adwind/JRat variant delivered via several methods tailored to lure the target company. In the recent past, similar attack cases hit this industry, such as the […]
GreyEnergy: Welcome to 2019
01/16/2019
Introduction In the first days of January, an interesting malware sample has been disclosed through the InfoSec community: a potential GreyEnergy implant still under investigation. This kind of threat, previously analyzed by third party firms, contains similarities with the infamous BlackEnergy malware, used in the attacks against the Ukrainian energy industry back in 2015. The […]
The “AVE_MARIA” Malware
01/11/2019
The Cybaze-Yoroi ZLab researchers analyzed phishing attempts spreading in the last days of the past year against an italian organization operating in the Oil&Gas sector. The malicious emails try to impersonate a supplier’s sales office sending invoices and shipping orders confirmations. As usual, the mail conveys malicious Excel files exploiting the popular CVE-2017-11882 vulnerability to […]
The Enigmatic “Roma225” Campaign
12/27/2018
Introduction The Cybaze-Yoroi ZLab researchers investigated a recent espionage malware implant weaponized to target companies in the Italian automotive sector. The malware was spread through well written phishing email trying to impersonate a senior partner of one of the major Brazilian business law firms: “Veirano Advogados”. The malicious email intercepted during the CSDC operations contains […]
Dissecting the Danabot Payload Targeting Italy
12/20/2018
Introduction In the last weeks, a new variant of infamous botnet named Danabot hit Italy. Security firms such as Proofpoint and Eset analyzed other samples of the same threat targeting the Australian landscape back in May 2018 and, more recently, in Italy . The Cybaze-Yoroi ZLab dissected one of these recent Danabot variants spread across […]