Il Malware Voldemort sfrutta i Fogli di calcolo Google per Attacchi Globali
Proofpoint riferisce che una nuova campagna malware sfrutta Fogli Google per gestire la backdoor Voldemort, progettata per raccogliere informazioni e fornire payload aggiuntivi.
Gli aggressori si spacciano per autorità fiscali in Europa, Asia e Stati Uniti e hanno già attaccato più di 70 organizzazioni in tutto il mondo. Gli hacker compongono le e-mail di phishing in modo tale che corrispondano alla posizione di una determinata organizzazione (per questo gli aggressori si affidano a fonti aperte). Tali messaggi presumibilmente contengono informazioni fiscali aggiornate e collegamenti a documenti pertinenti.
Secondo il rapporto dei ricercatori, la campagna è iniziata il 5 agosto 2024 e gli hacker hanno già inviato più di 20.000 e-mail (fino a 6.000 al giorno). Gli aggressori prendono di mira settori quali assicurazioni, aerospaziale, trasporti, università, finanza, tecnologia, produzione, sanità, automobilistico, ospitalità, energia, governo, media, telecomunicazioni e così via.
Non è chiaro chi si nasconda dietro questa campagna, ma gli esperti di Proofpoint ritengono che l’obiettivo più probabile degli aggressori sia lo spionaggio informatico.
Facendo clic sul collegamento nell’e-mail, i destinatari vengono indirizzati a una pagina di destinazione ospitata da InfinityFree, che utilizza gli URL della cache AMP di Google per reindirizzare le vittime a una pagina con un pulsante “Fai clic per visualizzare il documento”.
Quando si fa clic sul pulsante, la pagina controlla l’User Agent del browser e, se associato a Windows, reindirizza la vittima all’URI search-ms (Windows Search Protocol), che punta all’URI tunneled di TryCloudflare. Gli utenti non Windows vengono reindirizzati a un URL di Google Drive vuoto che non contiene contenuti dannosi.
Se la vittima interagisce con il file search-ms, Esplora risorse visualizza un file LNK o ZIP mascherato da PDF. L’uso dell’URI search-ms è recentemente diventato popolare nelle campagne di phishing perché un file di questo tipo, ospitato su una condivisione WebDAV/SMB esterna, fa apparire come se fosse nella cartella Download locale, invogliando la vittima ad aprirlo.
Di conseguenza, sul computer della vittima viene eseguito uno script Python da un’altra risorsa WebDAV, che raccoglie informazioni di sistema per compilare un profilo. Allo stesso tempo, viene visualizzato un file PDF progettato per mascherare attività dannose.
Lo script carica anche l’eseguibile Cisco WebEx (CiscoCollabHost.exe) e una DLL dannosa (CiscoSparkLauncher.dll) per caricare Voldemort utilizzando il sideloading DLL.
Voldemort stesso è una backdoor scritta in linguaggio C che supporta un’ampia gamma di comandi e azioni sui file, inclusi il furto, l’inserimento di nuovi payload nel sistema e l’eliminazione dei file.
Una caratteristica distintiva di Voldemort è che il malware utilizza Google Sheet come server di controllo, ricevendo nuovi comandi tramite “Sheets” da eseguire sul dispositivo infetto e utilizzandoli anche come archivio per i dati rubati.
Pertanto, ogni macchina infetta registra i propri dati in specifiche celle di Fogli Google, che possono essere identificate da identificatori univoci come l’UUID, che garantisce l’isolamento e la gestione trasparente dei sistemi compromessi.
Per interagire con Fogli Google, Voldemort utilizza l’API di Google con un ID client integrato, un token di aggiornamento, che vengono archiviati nelle sue impostazioni crittografate.
Come notano gli esperti, questo approccio fornisce al malware un canale di controllo affidabile e altamente disponibile e riduce anche la probabilità che questa attività di rete venga notata dalle soluzioni di sicurezza. Poiché Fogli Google è ampiamente utilizzato nelle aziende, anche il blocco del servizio sembra poco pratico.
L'articolo Il Malware Voldemort sfrutta i Fogli di calcolo Google per Attacchi Globali proviene da il blog della sicurezza informatica.
IT threat evolution in Q2 2024. Non-mobile statistics
The statistics presented here are based on detection verdicts by Kaspersky products and services received from users who consented to providing statistical data.
Quarterly figures
In Q2 2024:
- Kaspersky solutions blocked over 664 million attacks from various internet sources.
- The web antivirus reacted to 113.5 million unique URLs.
- The file antivirus blocked over 27 million malicious and unwanted objects.
- Almost 86,000 users encountered ransomware attacks.
- Nearly 12% of all ransomware victims whose data was published on DLSs (data leak sites) were affected by the Play ransomware group.
- Nearly 340,000 users faced miner attacks.
Ransomware
Quarterly trends and highlights
Law enforcement successes
In April 2024, a criminal who developed a packer that was allegedly used by the Conti and Lockbit groups to evade antivirus detection was arrested in Kyiv. According to Dutch police, the arrested individual was directly involved in at least one attack using the Conti ransomware in 2021. The criminal has already been charged.
In May, a member of the REvil group, arrested back in October 2021, was sentenced to 13 years in prison and ordered to pay $16 million. The cybercriminal was involved in over 2,500 REvil attacks, resulting in more than $700 million in total damages.
In June, the FBI announced that it had obtained over 7,000 decryption keys for files encrypted by Lockbit ransomware attacks. The Bureau encourages victims to contact the Internet Crime Complaint Center (IC3) at ic3.gov.
According to the UK’s National Crime Agency (NCA) and the US Department of Justice, the Lockbit group amassed up to $1 billion in its attacks from June 2022 to February 2024.
Attacks exploiting vulnerabilities
The CVE-2024-26169 privilege escalation vulnerability, patched by Microsoft in March 2024, was likely exploited in attacks by the Black Basta group. Some evidence suggests that at the time of the exploitation, this vulnerability was still unpatched, making it a zero-day vulnerability.
In June 2024, a massive TellYouThePass ransomware attack was launched, exploiting the CVE-2024-4577 vulnerability in PHP. This attack targeted Windows servers with certain PHP configurations, including those with the default XAMPP stack. The attackers scanned public IP address ranges and automatically infected vulnerable servers, demanding 0.1 BTC as ransom. Although this is a relatively small amount, the scale of the attacks could have yielded substantial profits. In recent years, this method has not been used as frequently due to its cost for attackers, who prefer instead targeted attacks with the hands-on involvement of operators. However, in this case, the attackers employed the time-tested approach.
Most active groups
Here are the most active ransomware groups based on the number of victims added to their DLSs (data leak sites). In Q2 2024, the Play group was the most active, publishing data on 12% of all new ransomware victims. Cactus came in second (7.74%), followed by Ransom Hub (7.50%).
The percentage of victims of a particular group (according to its DLS) among victims of all groups published on all DLSs examined during the reporting period (download)
Number of new modifications
In Q2 2024, we discovered five new ransomware families and 4,456 new ransomware variants.
Number of new ransomware modifications, Q2 2023 – Q2 2024 (download)
Number of users attacked by ransomware Trojans
In Q2 2024, Kaspersky solutions protected 85,819 unique users from ransomware Trojans.
Number of unique users attacked by ransomware Trojans, Q2 2024 (download)
Geography of attacked users
Top 10 countries and territories targeted by ransomware Trojans
| Country/territory* | % of users attacked by ransomware** | |
| 1 | Pakistan | 0.84% |
| 2 | South Korea | 0.72% |
| 3 | Bangladesh | 0.54% |
| 4 | China | 0.53% |
| 5 | Iran | 0.52% |
| 6 | Libya | 0.51% |
| 7 | Tajikistan | 0.50% |
| 8 | Mozambique | 0.49% |
| 9 | Angola | 0.41% |
| 10 | Rwanda | 0.40% |
*Countries and territories with fewer than 50,000 Kaspersky users were excluded from the calculations.
**Percentage of unique users whose computers were attacked by ransomware Trojans out of all unique Kaspersky product users in that country or territory.
Top 10 most common families of ransomware Trojans
| Name | Verdicts* | Share of attacked users** | |
| 1 | (generic verdict) | Trojan-Ransom.Win32.Gen | 22.12% |
| 2 | WannaCry | Trojan-Ransom.Win32.Wanna | 9.51% |
| 3 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 6.94% |
| 4 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 5.42% |
| 5 | Lockbit | Trojan-Ransom.Win32.Lockbit | 4.71% |
| 6 | (generic verdict) | Trojan-Ransom.Win32.Agent | 2.88% |
| 7 | PolyRansom/VirLock | Virus.Win32.PolyRansom / Trojan-Ransom.Win32.PolyRansom | 2.80% |
| 8 | (generic verdict) | Trojan-Ransom.Win32.Phny | 2.61% |
| 9 | (generic verdict) | Trojan-Ransom.Win32.Crypmod | 2.58% |
| 10 | Stop/Djvu | Trojan-Ransom.Win32.Stop | 2.11% |
*Statistics are based on detection verdicts by Kaspersky products. The information was provided by Kaspersky users who consented to providing statistical data.
**Unique Kaspersky users attacked by the ransomware Trojan family as a percentage of total users attacked by ransomware Trojans.
Miners
Number of new modifications
In Q2 2024, Kaspersky products detected 36,380 new miner variants.
Number of new miner modifications, Q2 2024 (download)
Number of users attacked by miners
In Q2 2024, we detected attacks using miners on 339,850 unique Kaspersky users worldwide.
Number of unique users attacked by miners, Q2 2024 (download)
Geography of attacked users
Top 10 countries and territories targeted by miners
| Country/territory* | % of users attacked by miners** | |
| 1 | Tajikistan | 2.40% |
| 2 | Venezuela | 1.90% |
| 3 | Kazakhstan | 1.63% |
| 4 | Ethiopia | 1.58% |
| 5 | Kyrgyzstan | 1.49% |
| 6 | Belarus | 1.48% |
| 7 | Uzbekistan | 1.36% |
| 8 | Ukraine | 1.05% |
| 9 | Panama | 1.03% |
| 10 | Mozambique | 1.01% |
*Countries and territories with fewer than 50,000 Kaspersky users were excluded from the calculations.
**Percentage of unique users whose computers were attacked by miners out of all unique Kaspersky product users in that country or territory.
Attacks on macOS
In Q2 2024, numerous samples of the spyware Trojan-PSW.OSX.Amos (also known as Cuckoo) were found. This spyware is notable for requesting an administrator password through osascript, displaying a phishing window. Attackers regularly update and repackage this Trojan to avoid detection.
New versions of the LightRiver/LightSpy spyware were also discovered. This Trojan downloads modules from the server with spy and backdoor functionalities. For example, they record the screen or audio, steal browser history, and execute arbitrary console commands.
Top 20 threats to macOS
The percentage of users who encountered a certain malware out of all attacked users of Kaspersky solutions for macOS (download)
The leading active threat continues to be a Trojan capable of downloading adware or other malicious applications. Other common threats include adware and fake “system optimizers” that demand money to “fix” nonexistent issues.
Geography of threats for macOS
Top 10 countries and territories by share of attacked users
| Q1 2024* | Q2 2024* | |
| Spain | 1.27% | 1.14% |
| Mexico | 0.88% | 1.09% |
| Hong Kong | 0.73% | 0.97% |
| France | 0.93% | 0.93% |
| United States | 0.81% | 0.89% |
| Italy | 1.11% | 0.87% |
| United Kingdom | 0.75% | 0.85% |
| India | 0.56% | 0.70% |
| Germany | 0.77% | 0.59% |
| Brazil | 0.66% | 0.57% |
*Percentage of unique users encountering macOS threats out of all unique Kaspersky product users in that country or territory.
There has been a slight increase of 0.1–0.2 p.p. in the share of attacked users in Mexico, Hong Kong, the United Kingdom, and India. Conversely, we see a slight decline in Spain, Italy, and Germany.
IoT threat statistics
In the second quarter of 2024, the distribution of attack protocols on devices targeting Kaspersky honeypots was as follows:
Distribution of attacked services by the number of unique IP addresses of the devices carrying out the attacks, Q1–Q2 2024 (download)
The share of attacks using the Telnet protocol continued to grow, reaching 98%.
Distribution of cybercriminal sessions with Kaspersky honeypots, Q1–Q2 2024 (download)
Top 10 threats delivered to IoT devices
Share of a specific threat downloaded to an infected device as a result of a successful attack, out of the total number of downloaded threats (download)
Attacks on IoT honeypots
For SSH protocol attacks, the share of attacks from China and India increased, while activity from South Korea slightly declined.
| SSH | Q1 2024 | Q2 2024 |
| China | 20.58% | 23.37% |
| United States | 12.15% | 12.26% |
| South Korea | 9.59% | 6.84% |
| Singapore | 6.87% | 6.95% |
| Germany | 4.97% | 4.13% |
| India | 4.52% | 5.24% |
| Hong Kong | 3.25% | 3.10% |
| Russian Federation | 2.84% | 2.33% |
| Brazil | 2.36% | 2.73% |
| Japan | 2.36% | 1.92% |
Telnet attacks from China returned to 2023 levels, while the share from India grew.
| Telnet | Q1 2024 | Q2 2024 |
| China | 41.51% | 30.24% |
| India | 17.47% | 22.68% |
| Japan | 4.89% | 3.64% |
| Brazil | 3.78% | 4.48% |
| Russian Federation | 3.12% | 3.85% |
| Thailand | 2.95% | 2.37% |
| Taiwan | 2.73% | 2.64% |
| South Korea | 2.53% | 2.46% |
| United States | 2.20% | 2.66% |
| Argentina | 1.36% | 1.76% |
Attacks via web resources
The statistics in this section are based on the work of the web antivirus, which protects users at the moment malicious objects are downloaded from a malicious or infected webpage. Cybercriminals intentionally create malicious pages. Web resources with user-created content (such as forums), as well as compromised legitimate sites, can also be infected.
Countries and territories that serve as sources of web-based attacks: Top 10
The following statistics show the distribution of countries and territories that were the sources of internet attacks on users’ computers blocked by Kaspersky products (webpages with redirects to exploits, sites with exploits and other malware, botnet control centers, and so on). Any unique host could be the source of one or more web-based attacks.
To determine the geographical source of web-based attacks, domain names are matched against their actual domain IP addresses, and then the geographical location of a specific IP address (GEOIP) is established.
In Q2 2024, Kaspersky solutions blocked 664,046,455 attacks launched from online resources across the globe. A total of 113,535,455 unique URLs that triggered the web antivirus were recorded.
Distribution of web attack sources by country and territory (Q2 2024) (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of malware infection through the internet faced by user’s computers in different countries and territories, we calculated the share of Kaspersky product users who encountered web antivirus detections during the reporting period for each country and territory. This data indicates the aggressiveness of the environment in which computers operate.
The following statistics are based on the detection verdicts of the web antivirus module, provided by Kaspersky product users who consented to share statistical data.
It’s important to note that only attacks involving malicious objects of the Malware class are included in this ranking. Web antivirus detections for potentially dangerous and unwanted programs, such as RiskTool and adware, were not counted.
| Country/territory* | % of attacked users** | |
| 1 | Moldova | 11.3635 |
| 2 | Greece | 10.8560 |
| 3 | Qatar | 10.4018 |
| 4 | Belarus | 9.8162 |
| 5 | Argentina | 9.5380 |
| 6 | Bulgaria | 9.4714 |
| 7 | South Africa | 9.4128 |
| 8 | Sri Lanka | 9.1585 |
| 9 | Kyrgyzstan | 8.8852 |
| 10 | Lithuania | 8.6847 |
| 11 | Tunisia | 8.6739 |
| 12 | Albania | 8.6586 |
| 13 | North Macedonia | 8.6463 |
| 14 | Bosnia & Herzegovina | 8.6291 |
| 15 | Botswana | 8.6254 |
| 16 | UAE | 8.5993 |
| 17 | Germany | 8.5887 |
| 18 | Slovenia | 8.5851 |
| 19 | Egypt | 8.5582 |
| 20 | Canada | 8.4985 |
*Countries and territories with fewer than 10,000 Kaspersky users were excluded from the calculations.
**Percentage of unique users subjected to web attacks by malicious objects of the Malware class out of all unique Kaspersky product users in that country or territory.
On average during the quarter, 7.38% of the internet users’ computers worldwide were subjected to at least one Malware-category web attack.
Local threats
Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer through infecting files or removable media, or initially made their way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.).
Data in this section is based on analyzing statistics produced by antivirus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The following statistics are based on detection verdicts from the OAS (on-access scan, scanning when accessing a file) and ODS (on-demand scan, scanning launched by a user) antivirus modules, provided by Kaspersky product users who agreed to share statistical data. These statistics take into account malware found directly on users’ computers or on removable media connected to computers, such as flash drives, camera memory cards, phones, and external hard drives.
In the second quarter of 2024, our file antivirus detected 27,394,168 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky users on whose computers file antivirus was triggered during the reporting period. This data reflects the level of infection of personal computers across different countries and territories worldwide.
Note that only attacks involving malicious objects of the Malware class are included in this ranking. Detections of potentially dangerous or unwanted programs such as RiskTool and adware were not counted.
| Country/territory* | % of attacked users** | |
| 1 | Turkmenistan | 44.2517 |
| 2 | Afghanistan | 39.4972 |
| 3 | Cuba | 38.3242 |
| 4 | Yemen | 38.2295 |
| 5 | Tajikistan | 37.5013 |
| 6 | Uzbekistan | 32.7085 |
| 7 | Syria | 31.5546 |
| 8 | Burundi | 30.5511 |
| 9 | Bangladesh | 28.3616 |
| 10 | South Sudan | 28.3293 |
| 11 | Tanzania | 28.0949 |
| 12 | Cameroon | 28.0254 |
| 13 | Niger | 27.9138 |
| 14 | Algeria | 27.8984 |
| 15 | Benin | 27.6164 |
| 16 | Myanmar | 26.6960 |
| 17 | Venezuela | 26.6944 |
| 18 | Iran | 26.5071 |
| 19 | Vietnam | 26.3409 |
| 20 | Congo | 26.3160 |
*Countries and territories with fewer than 10,000 Kaspersky users were excluded from the calculations.
**Percentage of unique users on whose computers local Malware-class threats were blocked, out of all unique Kaspersky product users in that country or territory.
On average, 14.2% of users’ computers worldwide encountered at least one local Malware-class threat during the second quarter.
The figure for Russia was 15.68%.
securelist.com/it-threat-evolu…
IT threat evolution in Q2 2024. Mobile statistics
Quarterly figures
According to Kaspersky Security Network, in Q2 2024:
- 7 million attacks using malware, adware or unwanted mobile software were blocked.
- The most common threat to mobile devices was RiskTool software – 41% of all detected threats.
- A total of 367,418 malicious installation packages were detected, of which:
- 13,013 packages were for mobile banking Trojans;
- 1,392 packages were for mobile ransomware Trojans.
Quarterly highlights
The number of malware, adware or unwanted software attacks on mobile devices climbed relative to the same period last year, but dropped against Q1 2024, with 7,697,975 attacks detected.
Number of attacks on users of Kaspersky mobile solutions, Q4 2022 – Q2 2024 (download)
The decrease is due to a sharp drop in the activity of adware apps, mostly from the covert applications of the AdWare.AndroidOS.HiddenAd family, which opens ads on the targeted device.
In April of this year, new versions of Mandrake spyware were discovered. Distributed via Google Play, these apps used sophisticated techniques to hide their malicious functionality: concealing dangerous code in an obfuscated native library; using certificate pinning to detect attempts to track app network traffic; and multiple methods to check for emulated runtime environments, such as sandboxes.
A Mandrake app on Google Play
Also in Q2, the IOBot banking Trojan was found targeting users in Korea. To install an additional malware component with VNC backdoor functionality, the Trojan’s authors use a technique to bypass Android protection against granting extended permissions to apps downloaded from unofficial sources.
Mobile threat statistics
The number of Android malware samples fell against the previous quarter to the Q2 2023 level, totaling 367,418 installation packages.
Number of detected malicious installation packages, Q2 2023 – Q2 2024 (download)
New trends emerged in the distribution of detected Adware and RiskTool packages: the former significantly decreased in number, while the latter increased. Otherwise, the number of detections remains largely the same.
Distribution of detected mobile apps by type, Q1*–Q2 2024 (download)
*Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.
Among adware, the number of HiddenAd, BrowserAd and Adlo apps dropped sharply, while the number of RiskTool.AndroidOS.Fakapp apps distributed under the guise of pornographic material rose. These apps collect and forward device information to a server, then open arbitrary URLs sent back in response.
Users attacked by the malware or unwanted software as a percentage* of all targeted users of Kaspersky mobile products, Q1*–Q2 2024 (download)
*The sum may be greater than 100% if the same users encountered more than one type of attack.
Despite the prevalence of RiskTool.AndroidOS.Fakapp installation packages, the number of real users who encountered this family showed no noticeable growth. In other words, attackers released many unique samples, but their distribution was limited.
The main changes in the distribution of the share of attacked users were driven by a fall in the activity of HiddenAd adware and a rise in the activity of two RiskTool apps: Revpn and SpyLoan.
TOP 20 most frequently detected mobile malware programs
Note that the malware rankings below exclude riskware and potentially unwanted software, such as RiskTool or adware.
| Verdict | Prev % | New % | Difference in p.p. | Change in ranking |
| DangerousObject.Multi.Generic | 9.82 | 11.44 | +1.61 | +1 |
| DangerousObject.AndroidOS.GenericML | 3.83 | 7.56 | +3.72 | +6 |
| Trojan.AndroidOS.Triada.ga | 5.66 | 6.66 | +1.00 | +2 |
| Trojan.AndroidOS.Fakemoney.v | 8.60 | 6.60 | -2.00 | -1 |
| Trojan.AndroidOS.Boogr.gsh | 6.62 | 6.01 | -0.61 | -1 |
| Trojan.AndroidOS.Triada.fd | 10.38 | 5.89 | -4.49 | -5 |
| Trojan.AndroidOS.Triada.gm | 0.00 | 5.16 | +5.16 | |
| Trojan-Downloader.AndroidOS.Dwphon.a | 5.26 | 2.71 | -2.55 | -2 |
| Trojan.AndroidOS.Generic | 2.08 | 2.59 | +0.51 | +5 |
| Trojan.AndroidOS.Triada.gn | 0.00 | 2.23 | +2.23 | |
| Trojan-Spy.AndroidOS.SpyNote.bz | 3.52 | 1.97 | -1.55 | -2 |
| Trojan-Dropper.AndroidOS.Agent.sm | 2.09 | 1.75 | -0.34 | +1 |
| Trojan.AndroidOS.Triada.gb | 1.34 | 1.72 | +0.37 | +11 |
| Trojan.AndroidOS.Fakemoney.bj | 4.26 | 1.47 | -2.79 | -7 |
| Trojan-Dropper.AndroidOS.Badpack.g | 1.87 | 1.40 | -0.47 | +1 |
| Trojan.AndroidOS.Triada.ex | 2.42 | 1.37 | -1.05 | -5 |
| Trojan-Banker.AndroidOS.Mamont.aq | 0.00 | 1.36 | +1.36 | |
| Trojan-Downloader.AndroidOS.Agent.ms | 1.39 | 1.34 | -0.05 | +5 |
| Trojan.AndroidOS.Triada.gh | 0.00 | 1.31 | +1.31 | |
| Trojan-Downloader.AndroidOS.Agent.mm | 2.12 | 1.29 | -0.83 | -8 |
The generalized cloud verdict DangerousObject.Multi.Generic returned to the top spot, and the cloud AI-delivered verdict DangerousObject.AndroidOS.GenericML also moved up. Also placing highly again were the Fakemoney Trojan, which scams users out of personal data with a promise of easy cash, the pre-installed Dwphon Trojan and modified versions of WhatsApp with built-in Triada modules. The latter include Trojan-Downloader.AndroidOS.Agent.ms.
The Mamont banking Trojan, which steals money by scanning text messages, saw quite a jump in its popularity.
Region-specific malware
This section describes malware whose activity is concentrated in specific countries.
| Verdict | Country* | %** |
| Backdoor.AndroidOS.Tambir.a | Turkey | 99.51 |
| Trojan-Banker.AndroidOS.BrowBot.q | Turkey | 99.30 |
| Trojan-Banker.AndroidOS.BrowBot.a | Turkey | 98.88 |
| Backdoor.AndroidOS.Tambir.d | Turkey | 98.24 |
| Trojan-Banker.AndroidOS.Rewardsteal.dn | India | 98.18 |
| Trojan-Banker.AndroidOS.UdangaSteal.k | India | 97.44 |
| HackTool.AndroidOS.FakePay.c | Brazil | 97.43 |
| Trojan-Banker.AndroidOS.Rewardsteal.c | India | 97.03 |
| Trojan-Banker.AndroidOS.Agent.ox | India | 96.97 |
| Trojan-Spy.AndroidOS.SmsThief.wk | India | 96.92 |
| Trojan-Banker.AndroidOS.Rewardsteal.n | India | 96.74 |
| Trojan-Banker.AndroidOS.UdangaSteal.f | Indonesia | 96.40 |
| Backdoor.AndroidOS.Tambir.b | Turkey | 96.20 |
| Trojan-Dropper.AndroidOS.Hqwar.hc | Turkey | 96.19 |
| Trojan-Banker.AndroidOS.Agent.pp | India | 95.97 |
| Trojan-Banker.AndroidOS.UdangaSteal.b | Indonesia | 95.23 |
| Trojan-Dropper.AndroidOS.Agent.sm | Turkey | 95.11 |
| Trojan-SMS.AndroidOS.EvilInst.f | Thailand | 95.05 |
| Trojan-SMS.AndroidOS.EvilInst.b | Thailand | 94.64 |
| Trojan-Spy.AndroidOS.SmsThief.vb | Indonesia | 94.57 |
| Trojan-Banker.AndroidOS.Coper.b | Turkey | 94.31 |
*Country where the malware was most active.
**Unique users who encountered this Trojan modification in the given country as a percentage of all users of Kaspersky mobile solutions targeted by this modification.
Users in Turkey continue to face banking Trojan attacks. At the same time, the list of malware active in the country remains unchanged: the VNC backdoor Tambir, the text message-stealing Trojan BrowBot and Hqwar banking Trojan packers were already mentioned in a past report.
Indonesia still has the largest concentration of UdangaSteal Trojans for stealing text messages. These are often sent to victims under the guise of wedding invitations. Similar to the last quarter, the payment-simulating app FakePay was widespread in Brazil, while users in Thailand ran into the EvilInst Trojan, which sends paid text messages.
A large number of families centered in India made it to the top. Rewardsteal snatches banking data under the pretense of a money giveaway; SmsThief.wk and Agent.ox steal text messages.
Mobile banking Trojans
The number of new unique installation packages for banking Trojans remains at the same level for the third quarter straight.
Number of installation packages for mobile banking Trojans detected by Kaspersky, Q2 2023 – Q2 2024 (download)
The total number of Trojan-Banker attacks is still on the rise, meaning that each new banking Trojan released by threat actors is increasingly used in attacks.
TOP 10 mobile bankers
| Verdict | Prev % | New % | Difference in p.p. | Change in ranking |
| Trojan-Banker.AndroidOS.Mamont.aq | 0.00 | 14.13 | +14.13 | |
| Trojan-Banker.AndroidOS.UdangaSteal.b | 7.00 | 10.10 | +3.10 | +3 |
| Trojan-Banker.AndroidOS.Bian.h | 10.21 | 7.46 | -2.76 | 0 |
| Trojan-Banker.AndroidOS.GodFather.m | 0.97 | 6.41 | +5.44 | +20 |
| Trojan-Banker.AndroidOS.Faketoken.z | 1.39 | 5.17 | +3.79 | +14 |
| Trojan-Banker.AndroidOS.Mamont.am | 0.00 | 5.12 | +5.12 | |
| Trojan-Banker.AndroidOS.Mamont.o | 4.58 | 5.00 | +0.42 | -1 |
| Trojan-Banker.AndroidOS.Agent.pp | 0.00 | 4.59 | +4.59 | |
| Trojan-Banker.AndroidOS.Agent.eq | 13.39 | 4.51 | -8.88 | -8 |
| Trojan-Banker.AndroidOS.Svpeng.aj | 0.95 | 3.74 | +2.79 | +15 |
Mobile ransomware Trojans
The number of ransomware installation packages decreased compared to Q1 2024 to roughly the same level as a year ago.
Number of installation packages for mobile ransomware Trojans detected by Kaspersky, Q2 2023 – Q2 2024 (download)
In the distribution of attacks, Rasket and Rkor ransomware dropped out of the top, and Pigetrl also fell. Other top-ranking families became markedly more active, not only percentage-wise, but in terms of absolute numbers.
| Verdict | Prev % | New % | Difference in p.p. | Change in ranking |
| Trojan-Ransom.AndroidOS.Svpeng.ac | 11.17 | 52.56 | +41.39 | +3 |
| Trojan-Ransom.AndroidOS.Congur.cw | 10.96 | 52.41 | +41.45 | +3 |
| Trojan-Ransom.AndroidOS.Small.cj | 10.49 | 49.76 | +39.26 | +3 |
| Trojan-Ransom.AndroidOS.Congur.ap | 6.66 | 41.52 | +34.86 | +3 |
| Trojan-Ransom.AndroidOS.Svpeng.ah | 6.03 | 35.62 | +29.59 | +4 |
| Trojan-Ransom.AndroidOS.Congur.bf | 4.15 | 32.98 | +28.83 | +5 |
| Trojan-Ransom.AndroidOS.Svpeng.snt | 5.72 | 25.72 | +20.00 | +3 |
| Trojan-Ransom.AndroidOS.Svpeng.ad | 3.42 | 24.79 | +21.37 | +4 |
| Trojan-Ransom.AndroidOS.Svpeng.ab | 3.32 | 24.60 | +21.28 | +5 |
| Trojan-Ransom.AndroidOS.Pigetrl.a | 15.56 | 12.70 | -2.86 | -8 |
securelist.com/it-threat-evolu…
Il ministro Sangiuliano: “Mai dati a Boccia soldi pubblici né documenti G7”. Ma lei lo sconfessa e pubblica tutto su Instagram
@Politica interna, europea e internazionale
Il ministro della Cultura Gennaro Sangiuliano rompe il silenzio e scrive una lettera al quotidiano La Stampa in cui assicura che il Ministero non ha mai utilizzato soldi pubblici per rimborsare viaggi a Maria Rosaria
IT threat evolution Q2 2024
Targeted attacks
XZ backdoor: a supply chain attack in the making
On March 29, a message on the Openwall oss-security mailing list announced the discovery of a backdoor in XZ, a compression utility included in many popular Linux distributions. The backdoored library is used by the OpenSSH server process sshd. On a number of systemd-based distributions, including Ubuntu, Debian and RedHat/Fedora Linux, OpenSSH is patched to use systemd features and is therefore dependent on the library (Arch Linux and Gentoo are not affected). The code was inserted in February and March 2024, mostly by Jia Cheong Tan – probably a fictitious identity. We suspect that the goal of the attack was to introduce exclusive remote code execution capabilities into the sshd process by targeting the XZ build process; and then to push the backdoored code out to major Linux distributions as a part of a large-scale supply chain attack.
Timeline of events
2024.01.19 XZ website moved to GitHub pages by new maintainer (jiaT75)
2024.02.15 “build-to-host.m4” is added to .gitignore
2024.02.23 two “test files” containing the stages of the malicious script are introduced
2024.02.24 XZ 5.6.0 is released
2024.02.26 commit in CMakeLists.txt that sabotages the Landlock security feature
2024.03.04 the backdoor leads to issues with Valgrind
2024.03.09 two “test files” are updated, CRC functions are modified, Valgrind issue is “fixed”
2024.03.09 XZ 5.6.1 is released
2024.03.28 bug is discovered, Debian and RedHat notified
2024.03.28 Debian rolls back XZ 5.6.1 to version 5.4.5-0.2
2024.03.29 an email is published on the oss-security mailing list
2024.03.29 RedHat confirms backdoored XZ was shipped in Fedora Rawhide and Fedora Linux 40 beta
2024.03.30 Debian shuts down builds and starts process to rebuild them
2024.04.02 XZ main developer acknowledges backdoor incident
While earlier supply chain attacks we have seen in Node.js, PyPI, FDroid, and the Linux kernel consisted mostly of atomic malicious patches, fake packages and typo-squatted package names, this incident was a multi-stage operation that came close to compromising SSH servers on a global scale.
The backdoor in the liblzma library was introduced at two levels. The source code of the build infrastructure that generated the final packages was modified slightly (by introducing an additional file build-to-host.m4) to extract the next stage script hidden in a test-case file (bad-3-corrupt_lzma2.xz). This script, in turn, extracted a malicious binary component from another test-case file (good-large_compressed.lzma) that was linked to the legitimate library during the compilation process to be shipped to Linux repositories. Major vendors in turn shipped the malicious component in beta and experimental builds. The XZ compromise was assigned the identifier CVE-2024-3094 and the maximum severity level of 10.
The attackers’ initial goal was to hook one of the functions related to RSA key manipulation. In our analysis of the hook process, we focused on the behavior of the backdoor inside OpenSSH, specifically OpenSSH portable version 9.7p1 (the latest version). Our analysis revealed a number of interesting details about the backdoor’s functionality.
- The attacker set an anti-replay feature to prevent possible capture or hijacking of the backdoor communications.
- The author used a custom steganography technique in the x86 code to hide the public key.
- The backdoor hooks the logging function to hide its logs of unauthorized connections to the SSH server.
- The backdoor hooks the password authentication function to allow the attacker to use any username/password to log in to the infected server without any further verification. It does the same with public key authentication.
- The backdoor has remote code execution capabilities that allow the attacker to execute any system command on the infected server.
It’s clear that this is a highly sophisticated threat. The attackers used social engineering to gain long-term access to the development environment and extended it with fake human interactions in plain sight. They have extensive knowledge of the internals of open-source projects such as SSH and libc, as well as expertise in code/script obfuscation used to initiate the infection process. A number of things make this threat unique, including the way the public key information is embedded in the binary code itself, complicating the recovery process, and the meticulous preparation of the operation.
Kaspersky products detect malicious objects associated with the attack as HEUR:Trojan.Script.XZ and Trojan.Shell.XZ. In addition, Kaspersky Endpoint Security for Linux detects malicious code in sshd process memory as MEM:Trojan.Linux.XZ (as part of the Critical Areas Scan task).
For more information, read our initial analysis, incident assessment and in-depth hook analysis.
DuneQuixote campaign targeting the Middle East
In February, we discovered a new malware campaign targeting government entities in the Middle East that we dubbed DuneQuixote. Our investigation uncovered more than 30 DuneQuixote dropper samples being actively used in this campaign. Some were regular droppers, while others were manipulated installer files for a legitimate tool called Total Commander. The droppers carried malicious code to download a backdoor that we dubbed CR4T. While we have only identified two of these implants, we strongly believe that there may be more in the form of completely different malware. The group behind the campaign took steps to prevent collection and analysis of its implants and implemented practical and well-designed evasion techniques in both network communications and the malware code.
The initial dropper is a Windows x64 executable file, written in C/C++, although there are DLL versions of the malware that provide the same functionality. Upon execution, the malware initiates a series of decoy API calls that serve no practical purpose. These calls are primarily string comparison functions that are executed without any conditional jumps based on the comparison results. The strings specified in these functions are snippets of Spanish poetry. These vary from one sample to the next, changing the signature of each sample to evade traditional detection methods.
The primary goal of the CR4T implant is to give attackers access to a console for command line execution on the infected computer. It also facilitates the download, upload and modification of files.
We also discovered a Golang version of the CR4T implant that has similar capabilities to the C version. A notable difference of this version is the ability to create scheduled tasks using the Golang Go-ole library, which uses Windows Component Object Model (COM) object interfaces to interact with the Task Scheduler service.
Through the use of memory-only implants and droppers masquerading as legitimate software that mimics the Total Commander installer, the attackers demonstrate above-average evasion capabilities and techniques. The discovery of both C/C++ and Golang versions of the CR4T implant highlights the adaptability and ingenuity of the threat actor behind this campaign.
ToddyCat: punching holes in your infrastructure
The threat actor ToddyCat predominantly targets government organizations in the Asia-Pacific region, primarily to steal sensitive data. In our previous article, we described the tools the attackers use to collect and exfiltrate files (LoFiSe and PcExter). More recently, we examined how this threat actor maintains constant access to compromised infrastructure, the information they are interested in and the tools they use to extract it.
Our investigation revealed that ToddyCat was stealing data on an industrial scale. To steal large volumes of data, attackers need to automate the data harvesting process as much as possible, and provide several alternative means to continuously access and monitor the systems they attack.
ToddyCat used several methods to accomplish this. One was to create a reverse SSH tunnel. They launched this using the SSH client from the OpenSSH for Windows toolkit, along with the library required to run it, an OPENSSH private key file, and a script, a.bat, to hide the private key file. The attackers transferred files to the target host via SMB using shared folders.
The threat actor also made use of the server utility (VPN Server) from the SoftEther VPN package for tunneling. This package is an open-source solution developed as part of academic research at the University of Tsukuba, which allows the creation of VPN connections using a variety of popular protocols, such as L2TP/IPsec, OpenVPN, MS-SSTP, L2TPv3, EtherIP and others.
Another way ToddyCat accessed remote infrastructure was by tunneling to a legitimate cloud provider: an application running on the user’s host with access to the local infrastructure can connect to the cloud through a legitimate agent and redirect traffic or execute specific commands.
Ngrok is a lightweight agent that can redirect traffic from endpoints to cloud infrastructure and vice versa. The attackers installed Ngrok on target hosts and used it to redirect command and control (C2) traffic from the cloud infrastructure to a specific port on those hosts.
They also used Krong, a proxy that uses XOR to encrypt the data passing through it, thereby concealing the content of the traffic to avoid detection.
After creating tunnels on the target hosts using OpenSSH or SoftEther VPN, the threat actor also installed the FRP client, a fast reverse proxy written in Go that allows access from the internet to a local server behind a NAT or firewall.
ToddyCat used various tools to collect data. They used one of the tools, which we named “cuthead” (the name came from the file description field of the sample we found), to search for documents. They used “WAExp”, a WhatsApp data stealer, to search for and collect browser local storage files containing data from the web version of WhatsApp. The attackers also used a tool called “TomBerBil” to steal passwords from browsers.
To protect against such attacks, we recommend that organizations add the resources and IP addresses of cloud services that provide traffic tunneling to the corporate firewall denylist. We also recommend limiting the range of tools administrators can use to remotely access hosts: other tools should either be prohibited or closely monitored as possible indicators of suspicious activity. In addition, employees should avoid storing passwords in browsers, as this helps attackers gain access to sensitive information. Moreover, reusing passwords across services increases the amount of data available to attackers.
Other malware
QakBot attacks with Windows zero-day
In early April we investigated the Windows DWM (Desktop Window Manager) Core Library Elevation of Privilege Vulnerability (CVE-2023-36033), which was previously discovered as a zero-day being exploited in the wild. While searching for samples related to this exploit and attacks using it, we found a curious document uploaded to VirusTotal on April 1. This document caught our attention because it had a descriptive file name indicating that it contained information about a Windows vulnerability.
Inside we found a brief description of a Windows DWM vulnerability and how it could be exploited to gain system privileges – all written in very poor English. The exploitation process described in this document was identical to that used in the previously mentioned zero-day exploit for CVE-2023-36033 – but the vulnerability was different.
The poor quality of the writing, and the fact the document was missing some important details about how to actually trigger the vulnerability, suggested that the vulnerability described was completely made up or was present in code that could not be accessed or controlled by attackers.
However, a quick check revealed that this was a real zero-day vulnerability that could be used to escalate privileges, so we immediately reported our findings to Microsoft. The vulnerability was assigned CVE-2024-30051 and a patch was released as part of Patch Tuesday on May 14.
We also began closely monitoring our statistics for exploits and attacks using this zero-day, and in mid-April we discovered an exploit. We have seen this zero-day used in conjunction with QakBot and other malware, and believe that multiple threat actors have access to it.
Kaspersky products detect the exploitation of CVE-2024-30051 and related malware with the following verdicts:
- PDM:Exploit.Win32.Generic;
- PDM:Trojan.Win32.Generic;
- UDS:DangerousObject.Multi.Generic;
- Win32.Agent.gen;
- Win32.CobaltStrike.gen.
Using the LockBit builder to generate targeted ransomware
Last year, we published our research on the LockBit 3.0 builder. Leaked in 2022, this builder greatly simplified the creation of custom ransomware.
The keygen.exe file generates public and private keys used for encryption and decryption. The builder.exe file generates the variant according to the options set in the config.json file. The whole process is automated by the build.bat script.
The builder also allows attackers to choose exactly what they want to encrypt. If they know enough about the target’s infrastructure, they can create malware tailored to the specific configuration of the target’s network architecture, such as important files, administrative accounts and critical systems.
This has allowed attackers to generate customized versions of this threat to suit their needs, making their attacks more effective.
In February, the international law enforcement task force Operation Cronos gained insight into LockBit’s operations after taking down the group. The operation involved law enforcement agencies from 10 countries. They were able to seize the group’s infrastructure, obtain private decryption keys and create a decryption toolset based on a list of known victim IDs obtained by the authorities. However, just a few days later, the ransomware group announced that it was back in action.
In a recent incident response engagement, we were faced with a ransomware attack that involved a ransomware sample created with the same leaked builder. The attackers were able to find the admin credentials in plain text. They created a custom version of the ransomware that used the account credentials to spread across the network and perform malicious activities, such as killing Windows Defender and deleting Windows Event Logs to encrypt data and cover its tracks. In one of our latest articles, we revisited the LockBit 3.0 builder files and analyzed the steps the attackers took to compromise the network.
Stealers, stealers and more stealers
Stealers are a prominent feature of the threat landscape. They are designed to harvest passwords and other sensitive data from infected computers that can then be used in other attacks, resulting in financial loss to the target. Over the past year we have published a number of public and private reports on newly discovered stealers. We recently wrote reports on Acrid, ScarletStealer and Sys01: the first two are new, the latter has been updated.
Acrid, a new stealer discovered in December 2023, is written in C++ for the 32-bit system, despite the fact that most systems are now 64-bit. Upon closer inspection, it became apparent that the authors had compiled it for a 32-bit environment in order to use the “Heaven’s Gate” technique, which allows 32-bit applications to access the 64-bit space to bypass certain security controls. This malware is designed to steal browser data, local cryptocurrency wallets, files with specific names (wallet.dat, password.docx, etc.) and credentials from installed applications (FTP managers, messengers, etc.). The collected data are zipped and sent to the C2.
Last January, we analyzed a downloader we dubbed “Penguish”. One of the payloads it downloaded was a previously unknown stealer called “ScarletStealer” – an odd stealer, since most of its functionality is contained in other binaries (applications and Chrome extensions) that it downloads. When ScarletStealer is executed, it checks for the presence of cryptocurrencies and crypto wallets by looking for certain folder paths (e.g., %APPDATA%\Roaming\Exodus). If anything is detected, it starts downloading the additional executables using PowerShell. Most ScarletStealer executables are digitally signed. This stealer is very underdeveloped in terms of functionality and contains many bugs, errors, and redundant code. Considering the effort it takes to install the malware through a long chain of downloaders, the last of which is Penguish, it’s strange that it’s not more advanced.
SYS01 (aka Album Stealer and S1deload Stealer), a relatively unknown malware that has been around since at least 2022, has evolved from a C# stealer to a PHP stealer. What hasn’t changed is the infection vector. Users are tricked into downloading a malicious ZIP archive disguised as an adult video via a Facebook page.
The archive contains a legitimate binary that sideloads a malicious DLL. This DLL opens an adult video and executes the next payload, which is a malicious PHP file encoded with ionCube. The executed PHP file calls a script, install.bat, which ultimately executes the next stage by running a PowerShell command. This layer is conveniently named “runalayer” and runs what appears to be the final payload called “Newb”. However, we found a difference between the latest version and the previous publicly disclosed versions of the stealer. The current stealer (Newb) includes functionality to steal Facebook-related data and send stolen browser data to the C2. It also contains backdoor functionality. However, we found that the code that actually collects the browser data sent by Newb is in a different sample named “imageclass”. It is not 100% clear how imageclass was pushed to the system; but looking at the backdoor code of Newb, we concluded with a high degree of certainty that imageclass was later pushed through Newb to the infected machine. The initial ZIP archive also contains another malicious PHP file, include.php: this has similar backdoor functionality to Newb and accepts many of the same commands in the same format.
ShrinkLocker: turning BitLocker into a ransomware utility
During a recent incident response engagement, we discovered ransomware called “ShrinkLocker” that uses BitLocker to encrypt compromised computers. BitLocker is the full-disk encryption utility built into Windows that is designed to prevent data exposure on lost or stolen computers.
ShrinkLocker is implemented as a sophisticated VBScript. If the script detects that it’s running on Windows 2000, XP, 2003 or Vista, it shuts down. However, for later versions of Windows, it runs the appropriate portion of its code for the specific operating system. ShrinkLocker shrinks the computer’s drive partitions by 100MB and uses this slack space to create a boot partition for itself. The malware modifies the registry to configure BitLocker to run with the attacker’s settings. It then disables and removes all default BitLocker protections to prevent key recovery and enables the numeric password protection option. The script then generates this password and initiates encryption of all local drives before sending the password and system information to the attacker’s C2 server. Finally, the malware deletes itself and reboots the system.
If the user tries to use the recovery option while the computer is booting, they will see a message stating that no BitLocker recovery options are available.
ShrinkLocker changes the labels of all system drives to the attacker’s email address instead of leaving a ransom note.
You can read our full analysis of ShrinkLocker here.
securelist.com/it-threat-evolu…
Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant nowgitlab.com/fdroid/fdroidclient…
Search improvements: Sort based on keyword matching and removed alphabetic sort (!889) · Merge requests · F-Droid / Client · GitLab
The search results are pretty unusable currently. So I've changed it to show apps in this order: App name matches keyword, summary matches keyword, description matches keyword. Also,...GitLab
3D Printed RC Crane Has Epic 3-Foot Reach
Have you ever looked out the window at traffic and seen a giant crane driving alone the road? Have you ever wanted a little 3D printed version you could drive for yourself without the risk of demolishing your neighbors house? Well, [ProfessorBoots] has just the build for you.
The build, inspired by the Liebherr LTM 1300, isn’t just a little RC car that looks like a crane. It’s a real working crane, too! So you can drive this thing around, and you can park it up. Then you can deploy the fully working stabilizer booms like you’re some big construction site hot shot. From there, you can relish in the subtle joy of extending the massive three-foot boom while the necessary counterweight automatically locks itself in place. You can then use the crane to lift and move small objects to your heart’s content.
The video describes how the build works in intimate detail, from the gears and linkages all the way up to the grander assembly. It’s no simple beast either, with ten gearmotors, four servos, and two ESP32s used for control. If you really need to build one for yourself, [ProfessorBoots] sells his plans on his website.
We’ve seen great stuff from [ProfessorBoots] before—he’s come a long way from his skid steer design last year. Video after the break.
youtube.com/embed/faC3Yzz9IqI?…
Thanks to [Hudson Bazemore] for the tip!
reshared this
Litigation funds: i pericolosi rapporti tra finanza e giustizia
@Notizie dall'Italia e dal mondo
Il nuovo articolo di @valori@poliversity.it
Negli ultimi anni si sono affermati i litigation funds: anticipano i costi delle class action e, in caso di successo, trattengono parte dei rimborsi
L'articolo Litigation funds: i pericolosi rapporti tra finanza e giustizia proviene da Valori.
imolaoggi.it/2024/08/27/partit…
Elly, per favore, lascia perdere Renzi in Liguria e dai la linea al centrosinistra per la Regione
@Politica interna, europea e internazionale
Questo è un appello, anzi una richiesta pressante, una supplica angosciata rivolta ai dirigenti, nazionali e locali, dei partiti della cosiddetta opposizione, e in particolare al Partito democratico. In particolare mi rivolgo alla segretaria Elly Schlein
Palestinesi denunciano: gravi le condizioni della deputata Khalida Jarrar in carcere in Israele
@Notizie dall'Italia e dal mondo
La parlamentare del Fronte popolare, detenuta senza processo da otto mesi, verrebbe tenuta in uno stretto isolamento e sottoposta a gravi restrizioni nonostante le sue precarie condizioni di salute
L'articolo
Sull’arresto del fondatore di Telegram e le accuse di illiberalismo
[quote]Ma davvero cercare di regolamentare il Web e di responsabilizzarne gli attori sarebbero propositi illiberali? L’arresto, in Francia, del fondatore di Telegram Pavel Durov, l’avvio di un’indagine a suo carico da parte della Commissione europea e la sospensione di X decretata dalla Corte
Deca – Strategia esoterica
“Ogni mio nuovo lavoro rappresenta la summa e la sintesi di tutti quelli realizzati prima, evolvendone nuovamente il significato e la portata artistica. Credo che “Strategia Esoterica” abbia comunque una forza molto superiore perché frutto di una trasmutazione molto potente”- Deca @Musica Agorà
iyezine.com/deca-strategia-eso…
Deca - Strategia esoterica
Deca - Strategia esoterica - “Ogni mio nuovo lavoro rappresenta la summa e la sintesi di tutti quelli realizzati prima, evolvendone nuovamente il significato e la portata artistica.Massimo Argo (In Your Eyes ezine)
LIBRI. Laboratorio Palestina: l’esperienza sul campo si vende in armi
@Notizie dall'Italia e dal mondo
Antony Loeweisten, giornalista investigativo australiano, traccia la linea delle relazioni tra l’industria bellica israeliana e molti paesi del mondo. La vendita di armi emerge come priorità impellente per Tel Aviv a dispetto della natura politica dell’acquirente
L'articolo
Perù: FSC sospende la certificazione alla società di disboscamento, una vittoria per le organizzazioni indigene
@Notizie dall'Italia e dal mondo
La revoca completa della certificazione è stata richiesta dalle organizzazioni indigene peruviane in seguito alla pubblicazione delle immagini che mostrano che l'area è abitata da un
GAZA. Israele costruisce un nuovo corridoio per il controllo permanente
@Notizie dall'Italia e dal mondo
Cominciata a inizio novembre, secondo il Forensic Architecture, la costruzione della strada è costata la distruzione di fattorie, terreni agricoli, abitazioni, frutteti e garantirà alle truppe un accesso sicuro fin dentro Gaza City
L'articolo GAZA. Israele
È disponibile il nuovo numero della newsletter del Ministero dell’Istruzione e del Merito.
Ministero dell'Istruzione
#NotiziePerLaScuola È disponibile il nuovo numero della newsletter del Ministero dell’Istruzione e del Merito.Telegram
Pibiesse, la tipografia che guarda al futuro
@Notizie dall'Italia e dal mondo
Il nuovo articolo di @valori@poliversity.it
La Pibiesse è una tipografia, ma anche un progetto di innovazione sociale che vuole diventare modello per la riqualificazione del territorio
L'articolo Pibiesse, la tipografia che guarda al futuro proviene da Valori.
Aerei e navi nella tassonomia europea: Bruxelles dovrà risponderne in tribunale
@Notizie dall'Italia e dal mondo
Il nuovo articolo di @valori@poliversity.it
Bruxelles etichetta come “investimenti verdi” aerei e navi inquinanti: una coalizione di ong la trascina in tribunale
L'articolo Aerei e navi nella tassonomia europea: Bruxelles dovrà risponderne in tribunale proviene da Valori.
controinformazione.info/lucrai…
Bluesky experiences a massive new wave of signups from Brazil, Premium feeds with sub.club, and much more.
[share author='Laurens Hof' profile='https://fediversereport.com/author/laurenshof/' avatar='https://poliverso.org/photo/206608119366e42c304ffac007248590-5.jpeg?ts=1734620326' link='https://fediversereport.com/last-week-in-fediverse-ep-82/' posted='2024-09-01 18:04:28' guid='08552256-1db60dc7714646e3-cb23b587' message_id='https://fediversereport.com/last-week-in-fediverse-ep-82/']Last Week in Fediverse – ep 82
1 million new accounts on Bluesky as Brazil bans X, and premium feeds with Sub.club, and much much more.
Brazil bans X, and a signup wave to Bluesky
The Brazilian supreme court has banned the use of X in an ongoing legal fight with Elon Musk. The ban follows after a long trajectory of legal issues between the Brazilian government and Musk’s X. In April 2024, the Brazilian court ordered X to block certain X accounts that were allegedly related to the 2023 coup attempt, which Musk refused to do. In that same time period, President Luiz Inácio Lula da Silva opened an account on Bluesky, and there was already an inflow of a Brazilian community into Bluesky. Now, the legal fight has further escalated over X’s refusal to appoint a legal representative in the country, and Musk’s continuing refusal to comply with Brazil’s laws and regulation has resulted in the supreme court banning the use of X in the country altogether.
The ban on X has caused a massive signup wave to Bluesky, with over 1 million new accounts created in just three days, of which the large majority are from Brazil. The user statistics shot up even more than that, suggesting that there are a lot of people with an existing account logging back in as well.
The new inflow of people to Bluesky is having some significant effects on the network, as well as on the state of decentralised social networks more broadly:
- President Lula is putting actual focus on Bluesky. In one of his final posts on X, Luala listed in non-alphabetical order all other platforms that he is active on, and placed Bluesky at the top of the list. Posts by Lula that are placed on Bluesky (134k followers) as well as on Threads (2.4m followers) get more than 5 times as much likes on Bluesky. Today, Lula explicitly asked people on Bluesky what they thought about the platform, in a post that got over 30k likes and counting. It is hard to imagine that the Brazilian government is not paying attention to this all, and is looking which platform(s) the Brazilian community is moving towards in the wake of the ban on X.
- Brazilians are a very active community on the internet (see Orkut), and bring with them their own unique culture to Bluesky. The current decentralised social networks are heavily focused on US politics, judged by top posts on both Mastodon and Bluesky, and beyond shitposts and memes there is surprisingly little space for mainstream pop culture and sports. The Brazilian community does seem to bring a large number of pop culture and sports to Bluesky, significantly diversifying the topics of discussion, and in turn, creating more space for other people who are interested in that in the future. The activity of Brazilians on microblogging can also be seen in the like counts on popular posts of Bluesky: before this week, the most popular posts of any given day usually got around 3k likes, this has sprung up to 30k to 50k likes. Brazilians are so chatty in fact, that currently 81% of the posts on the network are in Portugese, and the amount of accounts of people who post on a given day has gone up from a third to over 50%.
- The Bluesky engineers have build a very robust infrastructure system, and the platform has largely cruised along fine without issues, even when faced with a 15x increase in traffic. This all without having to add any new servers. For third party developers, such as the Skyfeed developer, this increase in traffic did came with downtime and more hardware requirements however. It shows the complications of engineering an open system, while the Bluesky team itself was prepared with their core infrastructure, third party infrastructure, on which a large number of custom feeds rely, was significantly less prepared for the massive increase in traffic.
In contrast, the ban on X in Brazil has made little impact on Mastodon, with 3.5k new signups from Brazil on Mastodon.social. I’d estimate that this week has seen 10k new accounts above average, with 15k new accounts the previous week and 25k in this week. That places Mastodon two orders of magnitude behind Bluesky in signups from Brazil. There are a variety of reasons for this, which deserve their own analysis, this newsletter is long enough as it is. One thing I do want to point out is within fediverse community there are two sub communities that each have their own goals and ideas about the fediverse and growth. Some people responded with the news that most Brazilians went to Bluesky with type of response that indicated that they appreciate the small, quiet and cozy community that the fediverse currently provides, and a distrust of the growth-at-all-costs model for social networks. For other people however, their goal of the fediverse is to build a global network that everyone is a part of and everyone uses (‘Big Fedi’), a view of the fediverse that is also represented in the latest episode of the Waveform podcast (see news below). And if the goal is to build ActivityPub into the default protocol for the social web, it is worth paying attention to what is happening right now in the Brazilian ATmosphere.
The News
Sub.club is a new way to monetise feeds on the fediverse, with the goal of bringing the creator economy to the fediverse. It gives people the ability to create premium feeds that people can only access via a subscription. People can follow this feed from any Mastodon account (work on other fediverse platforms is ongoing). Sub.club handles the payment processes and infrastructure, for which they charge 6% of the subscription fee (compared to 8-12% Patreon charges). Sub.club also makes it possible for other apps to integrate, both IceCubes and Mammoth have this option. Bart Decrem, who is one of the people behind Sub.club, is also the co-founder of the Mastodon app Mammoth. Sub.club also explicitly positions itself as a way for server admins to fund their server. Most server admins rely on donations by their users, often via services like Patreon, Ko-fi, Open Collective or other third party options. By integration payments directly into the fediverse, Sub.club hopes that the barrier for donations will be lower, and more server admins can be financially sustainable.
Newsmast has build a new version of groups software for the fediverse, and the first group is dedicated to the Harris campaign. There are few types of groups available that integrate with Mastodon, such as with Friendica or a.gup.pe. These groups function virtually identical to hashtags, by boosting out posts where the group account is tagged in to everyone who follows the group account. As there is no moderation in these types of group accounts, it allows anyone to hijack the group account. A group account dedicated to a political campaign is especially vulnerable to this. On Mastodon a volunteer Harris Campaign group used a Friendica group for campaign organising, but the limited moderation tools (blocking a user from following the group) that are available are not working, which allowed blocked users to still get their posts boosted by the group account. Newsmast’s version of Groups gives (working) moderation tools, and only boosts top level comments and not replies, to cut down on the noise. For now, the new Group is only available to the Harris Campaign group for testing, but it will come later to Mastodon servers that run the upcoming Patchwork plugin.
Bluesky added quite a number of new anti-toxicity features in their most recent app update. Bluesky has added quote posting controls, allowing people to set on a per-post basis if people can quote the post or not. There is also the option to remove quotes after the fact as well: if you’ve allowed quote posts on a post you’ve made, but someone made a quote post that you do not feel comfortable with, you have the possibility to detach your post. Another update is the possibility to hide replies on your posts. Bluesky already hides comments under a ‘show more’ button if the comment is labeled by a labeler you subscribe to. You now have the option to do so on all comments that are made on your posts, and the hidden comment will be hidden for everyone. Finally, Bluesky has changed how replies are shown in the Following feed, which is an active subject of discussion. I appreciate the comments made by Bluesky engineer Dan Abramov here, who notes there are two different ways of using Bluesky, who each prioritise comments in conflicting ways. As new communities grow on Bluesky, prioritising their (conflicting) needs becomes more difficult, and I’m curious to see how this further plays out.
The WVFRM (Waveform) podcast of popular tech YouTuber MKBHD has a special show about the fediverse, ‘Protocol Wars – The Fediverse Explained!’. It is partially a discussion podcast, partial explainer, and partial interview with many people within the community. They talk with Mastodon’s Eugen Rochko, Bluesky’s Jay Graber, Threads’s Adam Mosseri, and quite some more people. It is worth noting for a variety of reason. The show is quite a good introduction, that talks to many of the most relevant names within the community. MKBHD is one of the biggest names in the tech creator scene, and many people are paying attention to what he and his team is talking about. Furthermore, I found the framing as ‘protocol wars’ interesting, as the popularity of Bluesky in Brazil as an X replacement indicates that there is indeed a race between platforms to be build on top of the new dominant protocol.
Darnell Clayton has a very interesting blog post, in which he discovers that there is a discrepancy in follower count for Threads accounts that have turned on fediverse sharing. Clayton notes that the follower count shown in the Threads app is lower than the one shown in a fediverse client, for both Mastodon and Flipboard. He speculates that this difference is the number of fediverse accounts that follow a Threads account. It should be noted that this is speculation and has not been confirmed, but if this is true, it would give us a helpful indication of how many fediverse accounts are using the connection with Threads. While we’re talking about Threads accounts, Mastodon CEO Eugen Rochko confirmed that the mastodon.social server has made a connection with 15.269 Threads accounts who have turned on fediverse sharing.
The Links
- Threads has figured out how maximise publicity by making minimal incremental updates to their ActivityPub implementation, edition 500.
- A Developer’s Guide to ActivityPub and the Fediverse – The New Stack interviews Evan Prodromou about his new book about ActivityPub.
- FedIAM is a research project where people can use fediverse and Indieweb protocols for logging in.
- You can now test Forgejo’s federation implementation.
- This week’s fediverse software updates.
- Ghost’s latest update on their work on implementing ActivityPub: “With this milestone, Ghost is for the first time exceeding the functionality of a basic RSS reader. This is 2-way interaction. You publish, and your readers can respond.”
- Dhaaga is a multiplatform fediverse client that adds unique client-side functionalities.
- Lotide, a experimental link-aggregator fediverse platform, ceases development.
- A custom QR code generator, which some pretty examples of custom QR codes for your fediverse profile.
- Custom decentralised badges on atproto with badges.blue, a new work in process by the create of atproto event planner Smoke Signal.
- Smoke Signal will be presenting at the next version of the (third party organised) ATproto Tech Talk.
That’s all for this week, thanks for reading.
Ieri avevo in programma un giro per negozi di biciclette per vedere e provare un po' di bici elettriche. Uno di questi si trova a Spandau, che rispetto a casa mia è inculatissima (un'ora di viaggio minimo) per cui ho unito l'utile al dilettevole e con l'occasione sono stata anche a visitare la Cittadella.
Vista dalla Juiliusturm (1230), dicono il più antico edificio preservato di Berlino.
Questa scelta mi ha innanzitutto regalato la conoscenza degli Heilung, band che pesta tantissimo e che suonava la sera stessa proprio nella Cittadella. I tecnici che ne facevano il soundcheck mentre io gironzolavo me li hanno fatti apprezzare. Se amate la musica che pesta tantissimo date loro un orecchio, secondo me possono messere d'accordo gente dai gusti diversi (purché pestino! L'ho detto che pestanopestanopestano?).
Poi va detto che il biglietto di ingresso a 4,50 € stracciati dà accesso a tutti e sei i musei presenti nel complesso, piccoli, diversi, ma tutti meritevoli. Ho saltato solo il Centro d'Arte Contemporanea perché chiuso per allestimento di una mostra.
Prima fermata: la "finestra archeologica"
Qui sono conservati gli scavi archeologici che hanno portato alla luce le tre fasi costruttive della fortificazione. Dal XIII al XVI secolo si vede l'evoluzione dalla prima palizzata in legno, alle mura in pietra medievali, al castello in stile rinascimentale e mattoni rossi oggi visibile. Vengono spiegati anche dettagli ingegneristici, tipo che per costruire i bastionazzi così come sono oggi hanno "sbrodolato" fuori dai confini dell'isoletta su cui era sorto il nucleo originario. Per costruire in acqua hanno praticamente fatto una fitta base di "denti" di legno su cui poi è stata costruita la struttura attuale. Che non sia sprofondato tutto per me ha del miracoloso.
Seconda fermata: il museo civico di Spandau
Qui sono esposti reperti della storia di Spandau: dalle repliche dei documenti ufficiali, agli oggetti di uso comune, al prodotto dell'industria qui storicamente stanziata, al (ovviamente) nazionalsocialismo, alla divisione.
Questi sono giocattoli, che già di per sé mi fa rabbrividire. Alle stuatuine di Hitler e Göring si può alzare il braccino per fargli fare il saluto nazista. Ha un sapore distopico, invece è successo davvero: dei bambini hanno giocato con 'sta roba.
Gironzolando qui ho scoperto che parte di Metropolis è stata girata a Spandau (pensavo solo ai Babelstudios, e invece) e c'è un memoriale di una persona che ha partecipato alla produzione che vorrò leggere per intero. Amo Metropolis!
Terza fermata: la sala d'armi (o come diavolo vogliamo tradurre Exerzierhalle)
Qui sono conservati cannoni. Decine e decine di cannoni. Il più vecchio è del primo '400, il più giovane risale alla Prima Guerra Mondiale.
Immaginate di stare accovacciati qui dietro a sparare al "nemico".
La sala è chiusa e, con il caldo, dentro ristagna un odore che ricorda un'officina meccanica, ma con un "twist" tutto suo. Il mio cervello lo ha etichettato come "odore di guerra", ma non penso che sul campo la puzza fosse quella (o almeno non soltanto quella).
Toccacciando in giro (perché qui è concesso mettere le mani sugli artefatti) ho poi constato come ci sia stata un'epoca, tra '600 e '700, in cui usava mettere motti vari sui cannoni. Questo qua mi ha colpita di più:
Dice:"Saturnus frist (!) die Kind allein ich fress sie aller gros (!) und klein" (grossomodo: "Saturno mangia solo i bambini, io mangio tutti, grandi e piccini". Che detto da un cannone ci sta).
Quarta tappa: il deposito provvigioni
Questo è un edificio del periodo rinascimentale, in parte ricostruito, oggi adibito a galleria che preserva una serie di monumenti scultorei precedentemente sparsi per Berlino dal XVIII al XX secolo. Praticamente un consesso di figure rilevanti per la storia della città (e non solo). Alla fine c'è anche lui: il capoccione di Lenin!
Avete presente il megaprogetto di Hitler per la trasformazione di Berlino nella "Welthauptstadt Germania"? Come doveva diventare una città monumentale, con al centro un ipermega edificio celebrativo? Ecco. Questo plastico rende l'idea di quanto megalomane fosse il progetto di quell'edificio: quella cosina a destra è la porta di Brandeburgo, in scala.
Quinta tappa: la casa del comandante
L'ho vista per ultima, ma, essendo sopra la biglietteria, in realtà si potrebbe vedere anche come prima cosa. Qui sono conservati reperti e documenti della storia della Cittadella, altri dettagli sulle fasi costruttive, ma anche flora e fauna del luogo.
Che dire alla fine di tutto questo? Ma niente, solo che ogni volta che sfioro la storia di questa città il brivido lungo la schiena è assicurato. Qua sono successe cose folli.
(Oh, le bici in tutto questo le ho provate eh. Ho due candidate tra cui decidere).
GAZA. Israele costruisce un nuovo corridoio per il controllo permanente
@Notizie dall'Italia e dal mondo
Cominciata a inizio novembre, secondo il Forensic Architecture, la costruzione della strada è costata la distruzione di fattorie, terreni agricoli, abitazioni, frutteti e garantirà alle truppe un accesso sicuro fin dentro Gaza City
L'articolo GAZA. Israele
Recensione : MELT-BANANA – 3 + 5
MELT-BANANA - 3 + 5
MELT-BANANA - 3 + 5 - "Che cazzo è 'sta roba?!?!?!?" si chiese meravigliato chi vi scrive, quando ha scoperto dell'esistenza, anni fa, dei giapponesi Melt-Banana, dal 1992 tra i principali agitatori della scena/movimento concettuale "Japanoise", vale…Reverend Shit-Man (In Your Eyes ezine)
Il Burkina Faso ha deciso di nazionalizzare le miniere d’oro l L'Indipendente
"L’azione del governo di Ouagadougou rientra in un contesto più ampio, che vede sempre più nazioni africane riappropriarsi delle proprie risorse per orientarne i profitti a beneficio dello sviluppo nazionale e non di società straniere. Una tendenza ancora più marcata in quegli Stati africani desiderosi di riacquisire la propria indipendenza politica e strategica dalle direttive neocoloniali occidentali."
lindipendente.online/2024/08/3…
La morte e la legge
L'articolo La morte e la legge proviene da Fondazione Luigi Einaudi.
reshared this
Ordine marittimo globale. Ecco cosa porta il Cavour (e la Nato) nell’Indo Pacifico
[quote]Cosa è andato a fare il carrier strike group guidato dalla portaerei Cavour fino a Tokyo? La diplomazia navale – certo. Le esercitazioni – senz’altro. Il partenariato col Giappone, trainato dal Gcap – ovviamente. Ma perché? Se lo è chiesto Alessio Patalano – Professore
ivdp.it/articoli/caccia-f16-il…
ivdp.it/articoli/l-globalismo-…
like this
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 reshared this.
Dottor S. likes this.
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 likes this.
Come difendersi dagli attacchi cyber? Parla Galtieri
[quote]In un’era dominata dalla digitalizzazione e dalle crescenti minacce informatiche, diventa essenziale potenziare le capacità nazionali a livello di cybersecurity. E il consolidamento di tali capacità non può non passare per il rafforzamento cibernetico delle piccole e medie imprese, vera struttura portante del tessuto economico
Destra e sinistra? Time out. Un terzo polo avrebbe il 10%, lo spazio c’è
L'articolo Destra e sinistra? Time out. Un terzo polo avrebbe il 10%, lo spazio c’è proviene da Fondazione Luigi Einaudi.
Apple’s Huge “Dual Use” Face Swap App Problem Is Not Going Away
Maybe Apple should ban face swapping apps entirely.Emanuel Maiberg (404 Media)
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕
in reply to 𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 • •RaccoonForFriendica reshared this.
𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕
in reply to 𝔻𝕚𝕖𝕘𝕠 🦝🧑🏻💻🍕 • •RaccoonForFriendica reshared this.