Nel panorama in continua evoluzione delle minacce informatiche, LummaC2 si distingue come un infostealer particolarmente insidioso, capace di sottrarre informazioni sensibili attraverso metodi di distribuzione ingannevoli e tecniche di offuscamento avanzate. Questo articolo fornirà un’analisi dettagliata di LummaC2, del suo metodo di distribuzione, delle funzionalità malevole e delle misure di mitigazione per proteggere le infrastrutture IT.

Metodi di Distribuzione Innovativi

Uno degli aspetti più subdoli di LummaC2 è il metodo di distribuzione basato su pagine CAPTCHA false. Gli utenti vengono ingannati da una pagina apparentemente legittima, progettata per simulare una verifica umana tramite il classico pulsante “Non sono un robot”. Tuttavia, cliccando su questo pulsante, viene copiato un comando PowerShell malevolo negli appunti dell’utente.

Se l’utente esegue il comando copiato, si attiva una catena di infezione che culmina con l’installazione di LummaC2. Questo metodo sfrutta la fiducia degli utenti nei confronti dei CAPTCHA, rendendo l’attacco particolarmente efficace.

Questo tipo di distribuzione è stato osservato principalmente su siti web che offrono download di software crackati o in campagne di phishing, enfatizzando la necessità di evitare risorse non affidabili e sospette.

Catena di Infezione Dettagliata

L’intero processo di infezione è caratterizzato da una sequenza articolata e ben orchestrata:

1. Esecuzione del Comando PowerShell: Il comando copiato negli appunti avvia l’esecuzione di un file HTA (HTML Application) tramite “mshta.exe”. Questo file è offuscato per evitare il rilevamento da parte degli antivirus.
2. Decodifica dello Script: Il file HTA contiene uno script offuscato che, una volta eseguito, lancia uno script PowerShell crittografato con AES. Questo livello aggiuntivo di offuscamento serve a complicare ulteriormente l’analisi da parte di esperti di sicurezza.
3. Download del Payload Finale: Lo script PowerShell scarica e installa LummaC2, che avvia immediatamente le sue attività malevole.

Tecniche di Offuscamento Avanzate

LummaC2 implementa una serie di tecniche di offuscamento per eludere i sistemi di sicurezza e le analisi forensi:

• Offuscamento del Flusso di Controllo: Il malware utilizza tecniche di indirezione del flusso di controllo, rendendo difficile la comprensione del codice durante l’analisi statica con strumenti come IDA Pro o Ghidra.
• Evasione delle Sandbox: LummaC2 è in grado di rilevare ambienti virtuali attraverso il monitoraggio di interazioni umane, come i movimenti del mouse, ritardando l’esecuzione in assenza di input reali.

Funzionalità Malevole

LummaC2 è progettato per sottrarre una vasta gamma di dati sensibili:

• Credenziali di Accesso: Esfiltra username e password salvati nei browser web.
• Dati di Criptovalute: Raccoglie chiavi private e informazioni relative ai portafogli digitali, rappresentando una minaccia diretta per gli asset in criptovaluta.
• Moduli ClipBanker: Monitora la clipboard per intercettare indirizzi di portafogli di criptovalute, sostituendoli con quelli controllati dagli attaccanti per reindirizzare transazioni.

Analisi della Struttura di Controllo e Attacco

Un elemento chiave per comprendere l’infrastruttura di LummaC2 è la rappresentazione visiva dei suoi flussi di controllo, come mostrato nell’immagine allegata. L’immagine evidenzia la rete complessa che sostiene il malware e le sue operazioni malevole.

Nodi di Partenza: I Domini Malevoli

• cc.klipjaqemiu.shop: Questo dominio rappresenta uno dei punti di ingresso principali, utilizzato per ospitare i file necessari all’infezione.
• noisercluch.click: Un secondo dominio malevolo coinvolto nella distribuzione del malware, probabilmente utilizzato per il download del payload o per il reindirizzamento a risorse aggiuntive.

LummaC2 Come Nodo Centrale

LummaC2 funge da nodo centrale, coordinando le attività tra i domini malevoli e i server di comando e controllo (C2). Questo approccio decentralizzato rende il malware più resiliente a eventuali interventi di mitigazione.

Indicatori di Compromissione (IoC)

Gli IoC presenti includono indirizzi IP e tecniche specifiche della matrice MITRE ATT&CK, come:

• T1055.003: Injection in processi di runtime.
• T1102.002: Uso di server legittimi compromessi per la comunicazione C2.

Comunicazioni C2

L’immagine mostra chiaramente le connessioni verso server remoti che fungono da punti di comando e controllo. Questi server ricevono i dati esfiltrati e inviano comandi al malware, mantenendo la rete malevola attiva e funzionale.

Modello di Distribuzione come Malware-as-a-Service (MaaS)

LummaC2 è disponibile nei forum del dark web come servizio, rendendolo accessibile anche a cybercriminali con competenze tecniche limitate. I prezzi variano da 250 a 1.000 dollari, a seconda delle funzionalità offerte, contribuendo alla sua diffusione su larga scala.

Strategia di Difesa e Mitigazione

Proteggersi da minacce come LummaC2 richiede un approccio multilivello:

1. Educazione e Consapevolezza: Formare gli utenti a riconoscere tentativi di phishing e a evitare risorse non affidabili.
2. Implementazione di EDR: Soluzioni di Endpoint Detection and Response possono rilevare comportamenti anomali e script offuscati.
3. Bloccare i Domini Malevoli: Configurare soluzioni DNS sicure per impedire l’accesso a domini sospetti come quelli utilizzati da LummaC2.
4. Monitoraggio della Clipboard: Utilizzare strumenti che rilevino e blocchino manipolazioni sospette della clipboard.

LummaC2 rappresenta una minaccia avanzata e in continua evoluzione, combinando tecniche di ingegneria sociale con metodologie sofisticate di offuscamento ed evasione. La sua capacità di adattarsi e sfruttare nuovi vettori di attacco evidenzia l’importanza di una vigilanza costante e di strategie di difesa aggiornate.

L'articolo LummaC2: Il Malware Che Inganna con Falsi CAPTCHA e Ruba il Futuro Digitale proviene da il blog della sicurezza informatica.

Presumably the same DSKY unit installed in the simulator at MIT.
The Display/Keyboard unit – DSKY for short – is the primary way that Apollo-era astronauts communicated with the onboard computers. Not all DSKYs ended up in space, however, with the MIT hosting a simulator that features one of these units. Unfortunately the unit that ended up at [CuriousMarc]’s lab had seen better days, with the assumption being that it was the same DSKY that was installed in a photo of the old simulator. In addition to the busted EL display and two (improper) replacement keys, the insides show signs of damaged modules and possibly worse.

Without bothering to hook the unit up to the (previously restored) guidance computer, a full teardown was begun to assess the full extent of the damage. Considering that the DSKY uses latching relays for memory and two modules were ominously marked as being defective, this made for a tense wait as the unit was disassembled.

Fortunately making new DSKY-style EL displays has first been replicated in 2019, meaning that a replacement is possible. Perhaps surprisingly, the busted display still fires up in the test rig, as a testament to how robust the technology is. At the end of the teardown, the assessment is that the unit can be restored to its original condition, which will be done in the upcoming videos in this series.

youtube.com/embed/JB4x6Uy50sY?…

hackaday.com/2025/01/14/repair…

You have a project that needs something to move. Should you use a stepper motor or a servo motor? [Matthias] has an opinion, and you can hear his thoughts in the video below. One tip we’ll take away from the video: when working with motors, shoot some high-frame-rate video and slow it down to see what’s really happening.

The initial tests looked fine at normal speed. But increasing the frame rate and decreasing the playback speed showed some very interesting things like how much each motor was overshooting. The ability to control this sort of thing is a key differentiator for these kinds of motors.

In addition to a regular stepper, he also looks at a closed-loop stepper, which has some benefits and drawbacks, too, of course. The motors with the encoders were sensitive to magnetic fields, for example.

There is plenty to see in the video, but the bottom line is that your choice of motor will depend on a lot of interlocking factors including how fast you need, how much torque you require, and your desired accuracy. You could probably have guessed that but it is still very illustrative to see them on the bench and get a feel for just how these motors work and how to solve some common issues with them.

If you want to learn more about stepper motors, you are on the right site. Servos, too.

youtube.com/embed/H-nO1F-AO9I?…

hackaday.com/2025/01/14/head-t…

When it comes to DIY projects, nothing beats the thrill of crafting something that rivals expensive commercial products. In the microphone build video below, [Electronoobs] found himself inspired by DIY Perks earlier efforts. He took on the challenge of building a $20 high-quality microphone—a budget-friendly alternative to models priced at $500. The result: an engaging and educational journey that has it’s moments of triumph, it’s challenges, and of course, opportunities for improvement.

The core of the build lies in the JLI-2555 capsule, identical to those found in premium microphones. The process involves assembling a custom PCB for the amplifier, a selection of high-quality capacitors, and designing lightweight yet shielded wiring to minimize noise. [Electronoobs] also demonstrates the importance of a well-constructed metal mesh enclosure to eliminate interference, borrowing techniques like shaping mesh over a wooden template and insulating wires with ultra-thin enamel copper. While the final build does not quite reach the studio-quality level and looks of the referenced DIY Perks’ build, it is an impressive attempt to watch and learn from.

The project’s key challenge here would be achieving consistent audio quality. The microphone struggled with noise, low volume, and single-channel audio, until [Electronoobs] made smart modifications to the shielded wiring and amplification stages. Despite the hurdles, the build stands as an affordable alternative with significant potential for refinement in future iterations.

youtube.com/embed/_j5UO-791_4?…

hackaday.com/2025/01/14/audio-…

We’re opening up shop for Hackaday Europe, so get your tickets now! We’ve managed to get the ticket price down a bit this year, so you can join in all the fun for $145. And if you’re reading this right now, snap up one of the $75 early bird tickets as fast as you can.

Hackaday Europe is going down again in Berlin this year, on March 15th and 16th at MotionLab. It’s going to be a day and a half of presentations, lightning talks, badge hacking, workshops, and more. This is where Hackaday hangs out in person, and it’s honestly just a great time – if your idea of a great time is trading favorite PCB design tricks, crafting crufty code, and generally trading tales of hardware derring-do.

In short, it’s the best of Hackaday, live and in person. Throughout the weekend, all the meals are catered, we’ve got live music at night, and the soldering irons will be warmed up for you. It’s going to be great!

If you’re in town on Friday the 14th, we’ll be meeting up in the evening to get together over some pre-event food and drink, sponsored by Crowd Supply. It’s a nice opportunity to break the ice, get to know the people you’re going to be spending the next 48 hours with, and just mingle without missing that great talk or wonderful workshop.

The Badge

The badge is a showpiece of SAOs – the simple add-ons that we were cheekily calling “Supercon Add Ons” a couple months ago. For Supercon, we just exposed the I2C busses and GPIOs, flashed Micropython on the thing, and let you go wild. For Europe, the badge is going to have re-vamped firmware, and the range of SAOs that we’re including in the bag has gone bonkers.

You see, we held this Supercon Add-On Contest, and the winners were insane. Plus, we’ve got the Supercon-issue touch wheel, LED spiral, and CH32V003 prototyping boards. Did we mention that the badge can flash them through the SAO port?

And we would be remiss if we didn’t encourage you to take the step into making your own SAO to bring and trade with others. An SAO doesn’t have to be complicated to be cool. Just a good idea, and some time spent designing a PCB, getting it fabricated, assembling it, programming it, maybe debugging it, perhaps making a jig and some tooling to help you with the short production run… OK, who are we kidding? It’s a low-stakes, lighthearted look at the full-stack of hardware creation. Pick a meme, or do something unique, and get a small batch made. The experience is worth even more than the smiles you’ll put on all of our faces.

CFP Extended

Procrastineers, rejoice! Today marks the official end of the call for proposals, but since we always do, we’re extending it a bit. If you’ve been thinking about giving a talk, and just never reached activation energy, it’s now or never! Draft up an abstract and get it in before the clock strikes metaphorical midnight on Friday.

Everyone Can Participate

But it’s not just speakers who can bring something to show off at Hackaday Europe 2025. We’ve got lightning talks going on Sunday morning after brunch and before the badge hack showcase. The whole event is an informal show-and-tell anyway, because people always bring whatever they’re working on, or have just finished, to demo to a like-minded crowd. And on that note, if you want to bring something that’s cool but takes up more space than a breadbox, let us know by sending an e-mail to editor@Hackaday.com with [Hackaday Europe] in the subject line. We’ll try to find space for you.

But to join in, you’ve got to be there. Get your tickets now and we’ll see you in Berlin!

16 gennaio, roma, villa medici: reinventare il linguaggio. gastone novelli e la scrittura francese d’avanguardia

slowforward.net/2024/12/22/rei…

#gastonenovelli #andreacortellessa #mireillecallegruber #avanguardia #villamedici #scritturadiricerca #artecontemporanea