Introduction In the past days, an infamous cyber attack targeted an high profile target on the APAC area: the Australian Parliament House. As reported by the Australian prime minister there was no evidence of any information theft and the attack…
Tag: apt
Sofacy’s Zepakab Downloader Spotted In-The-Wild
In the last weeks, the Cybaze-Yoroi ZLAB investigated a new APT28 campaign discovered in January 2019. The sample has been initially identified by an Italian independent security researcher, who warned the InfoSec community and shared the binary for further analysis.…
GreyEnergy: Welcome to 2019
Introduction In the first days of January, an interesting malware sample has been disclosed through the InfoSec community: a potential GreyEnergy implant still under investigation. This kind of threat, previously analyzed by third party firms, contains similarities with the infamous…
Dissecting the MuddyWater Infection Chain
Introduction In the last days of November, some Middle East countries have been targeted by a new wave of attacks related to the Iranian APT group known as “MuddyWater“: their first campaign was observed back in 2017 and more recently Unit42…
New “Cozy Bear” campaign, old habits
Introduction The researchers of the Yoroi-Cybaze ZLab, on 16 November, accessed to a new APT29’s dangerous malware used for the recent attacks against many important US entities, such as military agencies, law enforcement, defense contractors, media companies and pharmaceutical companies. …
Hunting for Sofacy: Lojax Double-Agent Analysis
Introduction A new variant of the infamous APT28 Lojax (aka Double-Agent) has been discovered by the Yoroi-Cybaze ZLab researchers. It is the latest version of the well-known rootkit Double-Agent, previously analyzed by ESET researchers. The behavior of the Lojax sample…
Importanti Aggiornamenti Microsoft Windows
Proto: N041018. Con la presente Yoroi desidera informarLa relativamente al rilascio di importanti aggiornamenti di sicurezza per sistemi operativi Microsoft, all’interno dei quali sono state risolte numerose criticità ad alto impatto, tra cui una vulnerabilità attivamente sfruttata in attacchi 0-day…
Attacchi in corso su Vulnerabilità in Internet Explorer
Proto: N060918. Con la presente Yoroi desidera informarLa relativamente ad emergenti cyber-attacchi volti alla compromissione di client di rete per via dello sfruttamento di vulnerabilità all’interno di Internet Explorer. La criticità in questione è nota con l’identificativo CVE-2018-8373.A seguito della pubblicazione dei…
Attacchi 0-Day su Internet Explorer (Double Kill)
Proto: N040518 Con la presente Yoroi desidera informarLa riguardo al rilevamento dello sfruttamento di vulnerabilità 0-day all’interno del motore VBScript di Microsoft Internet Explorer in recenti campagne di attacco. La problematica è identificata con il codice CVE-2018-8174 e conosciuta…
Importante Vulnerabilità su Adobe Flash Player
Proto: N010218. Con la presente Yoroi desidera informarLa riguardo al recente rilevamento di tentativi di attacco basati sullo sfruttamento di una nuova vulnerabilità zero-day del noto software Adobe Flash Player. La criticità è conosciuta con l’identificativo CVE-2018-4878.A seguito delle…