Statistics across all threats

In Q4 2024, the percentage of ICS computers on which malicious objects were blocked decreased by 0.1 pp from the previous quarter to 21.9%.

Percentage of ICS computers on which malicious objects were blocked, by quarter, 2022–2024

Compared to Q4 2023, the percentage decreased by 2.8 pp.

The percentage of ICS computers on which malicious objects were blocked during Q4 2024 was highest in October and lowest in November. In fact, the percentage in November 2024 was the lowest of any month in two years.

Percentage of ICS computers on which malicious objects were blocked, Jan 2023–Dec 2024

Region rankings

Regionally, the percentage of ICS computers that blocked malicious objects during the quarter ranged from 10.6% in Northern Europe to 31% in Africa.

Regions ranked by percentage of ICS computers where malicious objects were blocked, Q3 2024

Eight of 13 regions saw their percentages increase from the previous quarter.

Regions and world. Changes in the percentage of attacked ICS computers in Q4 2024

Selected industries

The biometrics sector led the surveyed industries in terms of the percentage of ICS computers on which malicious objects were blocked.

Percentage of ICS computers on which malicious objects were blocked in selected industries

In Q4 2024, the percentage of ICS computers on which malicious objects were blocked decreased across most industries, with the exception of the construction sector.

Changes in the percentage of ICS computers on which malicious objects were blocked in selected industries

Diversity of detected malicious objects

In Q4 2024, Kaspersky’s protection solutions blocked malware from 11,065 different malware families of various categories on industrial automation systems.

Percentage of ICS computers on which the activity of malicious objects from various categories was blocked

Main threat sources

The internet, email clients and removable storage devices remain the primary sources of threats to computers in an organization’s technology infrastructure. Note that the sources of blocked threats cannot be reliably identified in all cases.

In Q4 2024, the percentage of ICS computers on which threats from various sources were blocked decreased for all threat sources described in this report. Moreover, all indicators recorded their lowest values for the observed period.

Percentage of ICS computers on which malicious objects from various sources were blocked

Threat categories

Malicious objects used for initial infection

Malicious objects used for initial infection of ICS computers include dangerous internet resources that are added to denylists, malicious scripts and phishing pages, and malicious documents.

In the fourth quarter of 2024, the percentage of ICS computers on which malicious documents and denylisted internet resources were blocked decreased to 1.71% (by 0.26 pp) and 5.52% (by 1.32 pp), respectively and reached its lowest level since the beginning of 2022.

As noted in the Q3 2024 report, the increase in blocked denylisted internet resources was primarily driven by an increase in the number of newly created domain names and IP addresses used by cybercriminals as command-and-control (C2) infrastructure for distributing malware and phishing attacks.

The decline in the percentage of denylisted internet resources in November–December 2024 was likely influenced not only by proactive threat mitigation measures at various levels – from resource owners and hosting providers to ISPs and law enforcement agencies. Another contributing factor was the tendency of attackers to frequently change domains and IP addresses to evade detection in the initial stages, based on lists of known malicious resources.

In practice, this means that until a malicious web resource is identified and added to a denylist, it may not immediately appear in threat statistics, leading to an apparent decrease in the percentage of ICS computers on which such resources were blocked.

However, in Q4, we also saw a rise in the percentage of the next steps in the attack chain – malicious scripts and phishing pages (7.11%), spyware (4.30%), and ransomware (0.21%).

A significant increase in the percentage of malicious scripts and phishing pages in October was driven by a series of widespread phishing attacks in late summer and early fall 2024, as mentioned in the Q3 2024 report. Threat actors used malicious scripts that executed in the browser, mimicking various windows with CAPTCHA-like interfaces, browser error messages and similar pop-ups to trigger the download of next-stage malware: either the Lumma stealer or the Amadey Trojan.

Next-stage malware

Malicious objects used to initially infect computers deliver next-stage malware – spyware, ransomware, and miners – to victims’ computers. As a rule, the higher the percentage of ICS computers on which the initial infection malware is blocked, the higher the percentage for next-stage malware.

The percentage of ICS computers on which spyware (spy Trojans, backdoors and keyloggers) was blocked increased by 0.39 pp from the previous quarter to 4.30%.

The percentage of ICS computers on which ransomware was blocked increased by a factor of 1.3 compared to the previous quarter, reaching 0.21%, its highest value in two years.

The percentage of ICS computers on which miners in the form of executable files for Windows were blocked decreased by 0.01 pp to 0.70%.

And, the percentage of ICS computers on which web miners were blocked decreased by 0.02 pp to 0.39%, reaching its lowest value in the observed period.

Self-propagating malware

Self-propagating malware (worms and viruses) is a category unto itself. Worms and virus-infected files were originally used for initial infection, but as botnet functionality evolved, they took on next-stage characteristics. To spread across ICS networks, viruses and worms rely on removable media, network folders, infected files including backups, and network attacks on outdated software.

In Q4 2024, the percentage of ICS computers on which worms were blocked increased by 0.07 pp and reached 1,37%. The rate of viruses increased by 0.08 pp to 1.61%.

AutoCAD malware

AutoCAD malware is typically a low-level threat, coming last in the malware category rankings in terms of the percentage of ICS computers on which it was blocked.

In Q4 2024, the percentage of ICS computers on which AutoCAD malware was blocked continued to decrease by losing 0.02 pp and reached 0.38%.

You can find the full Q3 2024 report on the Kaspersky ICS CERT website.

securelist.com/ics-cert-q4-202…

The difference between 3D printing and good 3D printing comes down to attention to detail. There are so many settings and so many variables, each of which seems to impact the other to a degree that can make setting things up a maddening process. That makes anything that simplifies the process, such as this computer vision pressure advance attachment, a welcome addition to the printing toolchain.

If you haven’t run into the term “pressure advance” for FDM printing before, fear not; it’s pretty intuitive. It’s just a way to compensate for the elasticity of the molten plastic column in the extruder, which can cause variations in the amount of material deposited when the print head acceleration changes, such as at corners or when starting a new layer.

To automate his pressure advance calibration process, [Marius Wachtler] attached one of those dirt-cheap endoscope cameras to the print head of his modified Ender 3, pointing straight down and square with the bed. A test grid is printed in a corner of the bed, with each arm printed using a slightly different pressure advance setting. The camera takes a photo of the pattern, which is processed by computer vision to remove the background and measure the thickness of each line. The line with the least variation wins, and the pressure advance setting used to print that line is used for the rest of the print — no blubs, no blebs.

We’ve seen other pressure-advanced calibrators before, but we like this one because it seems so cheap and easy to put together. True, it does mean sending images off to the cloud for analysis, but that seems a small price to pay for the convenience. And [Marius] is hopeful that he’ll be able to run the model locally at some point; we’re looking forward to that.

youtube.com/embed/LptiyxAR9nc?…

hackaday.com/2025/03/21/cheap-…

Gli attacchi informatici contro Cisco Smart Licensing Utility sono in aumento, con i ricercatori che hanno recentemente identificato campagne attive che sfruttano due vulnerabilità critiche risolte circa sei mesi fa. Queste falle permettono ai cybercriminali di ottenere accesso non autorizzato a dati sensibili relativi alle licenze e a funzionalità amministrative del software.

Le vulnerabilità, CVE-2024-20439 e CVE-2024-20440, sono state rese pubbliche a settembre 2024 e hanno entrambe un punteggio CVSS di 9,8. La prima consente a un utente remoto non autenticato di accedere al software tramite credenziali hardcoded, creando di fatto una backdoor. La seconda riguarda un file di registro di debug che espone informazioni sensibili, come le credenziali API.

Il ricercatore di sicurezza Nicholas Starke di Aruba (Hewlett Packard Enterprise) ha individuato una password amministrativa statica all’interno delle versioni vulnerabili del software (dalla 2.0.0 alla 2.2.0). Questa credenziale, Library4C$LU, è integrata nell’autenticazione API, permettendo a un attaccante di ottenere privilegi amministrativi se sfruttata con successo.

Gli specialisti del SANS Institute hanno individuato che gli hacker inviano richieste HTTP create ad hoc per sfruttare queste debolezze. In particolare, gli aggressori mirano all’endpoint API in /cslu/v1/scheduler/jobs, utilizzando credenziali hardcoded per autenticarsi.

Decodificando la stringa Base64 nell’intestazione Authorization, emerge che viene usata l’identità cslu-windows-client:Library4C$LU, confermando l’uso delle credenziali scoperte da Starke. Se l’attacco ha successo, gli aggressori ottengono il controllo amministrativo dell’utility, con la possibilità di gestire licenze e accedere a dati sensibili.

Questi attacchi non sono limitati ai prodotti Cisco: lo stesso gruppo di cybercriminali sta cercando di sfruttare anche altre vulnerabilità, come CVE-2024-0305, che colpisce alcuni sistemi DVR.

Secondo Johannes Ullrich, responsabile della ricerca presso SANS, il fatto che dispositivi IoT a basso costo e software aziendali avanzati soffrano di problemi di sicurezza simili, come l’uso di credenziali hardcoded, dimostra quanto siano diffuse queste criticità.

L'articolo Cisco sotto attacco: sfruttate due vulnerabilità critiche nella Smart Licensing Utility! proviene da il blog della sicurezza informatica.

C’è una parola che è diventata quasi un insulto nel dibattito pubblico: socialismo. Un’altra è addirittura un tabù: comunismo.

Eppure, se togliamo per un attimo le etichette, il pregiudizio instillato in quarant’anni anni di berlusconismo, se distogliamo lo sguardo dall’orrenda poltiglia burocratica e sciatta a cui ci ha abituati la compagine progressista, ci accorgiamo che i principi che questi movimenti hanno portato avanti per oltre un secolo sono esattamente quelli di cui oggi abbiamo disperatamente bisogno.

Non parlo di nostalgie, di falci e martelli sventolati per appartenenza, ma di idee. Idee chiare, necessarie.
Sogni da trasformare in utopie, e utopie da trasformare in Futuro - quello maiuscolo - quello che, come l’amore, non vedi l’ora di vedere.

Abbiamo bisogno di un pensiero che rimetta al centro le persone, la società.
Perché oggi il lavoro e i lavoratori sono tornati a essere una merce, qualcosa da svendere al ribasso. Perché il diritto alla salute, all’istruzione, a una casa sono stati trasformati in privilegi sempre più irraggiungibili.

Perché lo Stato sociale, quello che un tempo era un argine alle disuguaglianze, oggi viene smantellato pezzo dopo pezzo nel nome di un “mercato” che, anziché autoregolarsi, concentra ricchezze e potere nelle mani di pochi scaltri.

Abbiamo bisogno di una visione collettiva. Di partiti veri, di intellettuali e politici veri e preparati. Perché stiamo bruciando le energie e il cuore dei pochi giovani dentro istituzioni vecchie e immobili, pesanti e inadeguate a un futuro libero e migliore.

Perché il mito dell’individuo che si fa da solo è servito solo a giustificare le ingiustizie, a colpevolizzare chi rimane indietro.

E invece no, non siamo soli. Non esistiamo fuori dalla comunità, dalla società. Non esistiamo senza diritti, senza solidarietà, senza coscienza, senza l’idea che il benessere del singolo non possa basarsi sul malessere dei molti.

Abbiamo bisogno di un’alternativa al cinismo. Perché la politica di oggi si fonda sull’ignoranza e sulla paura, fomentando la guerra tra poveri attraverso un nazionalismo da bar e un decisionismo da scadente operetta.

Il socialismo e il comunismo italiani hanno sempre parlato di futuro, di cultura, di emancipazione, di una società più equa, più giusta. E quell’idea non è vecchia: è oggi necessaria.

Vecchi sono quelli che si arrogano il diritto di rappresentarla con linguaggi incomprensibili persino a loro stessi.
Vecchio è questo “io” ingombrante, sempre a favore di telecamera, vecchia è la corruzione e la cancellazione della meritocrazia.
Vecchia è l’incapacità di creare tesi, antitesi e sintesi attraverso la collettività e non attraverso un singolo che le faccia calare dall'alto.
Vecchio è vantarsi di slogan ciclostilati, la spocchia borghese di chi non ha idea della vita degli ultimi e nemmeno dei penultimi, eppure straparla di riformismo e di popolo. Vecchia è l'ignoranza e il qualunquismo, la superficialità che diventa stupidità.

Non si tratta di tornare indietro, ma di guardare avanti.

Svegliamoci.
Credere nella giustizia sociale non è utopia.
Pensare di poterne fare a meno, quella sì, è pura follia.

Faccio un salto nel passato anche qui, alla Biennale Arte 2024 di Venezia, la rappresentazione queer era forte e presente, ed è stato potente vederla.

Alcune opere mi hanno colpito particolarmente. Louis Fratino esplora la tensione tra famiglia e desiderio con immagini viscerali, raccontando come le persone LGBTQ+ socializzano da ‘outsider’ e affrontano la violenza della tradizione. Xiyadie documenta la vita queer in Cina dagli anni ’80, con opere intime che parlano di repressione, desiderio e liberazione. In Sewn, la metafora del cucirsi con un filo fatto di sperma e sangue rende fisico il dolore dell’identità negata. Omar Mismar sfida la censura in Libano con Two Unidentified Lovers in a Mirror, forse il mio preferito, dove la riorganizzazione dei volti di due amanti mette in discussione la negazione dell’intimità queer.
Lauren Halsey non lavora sul tema queer nello specifico, ma con la sua installazione monumentale celebra la diaspora nera, creando un ponte tra passato e presente.

Ognuna di queste opere è un atto di resistenza, un modo per riscrivere narrazioni e spazi.
Semplicemente è stato bello vedere così tanta arte queer alla Biennale, non solo come tema, ma come presenza forte e consapevole.

Il tema della Biennale era "Stranieri ovunque" ed era molto presente con opere sulle migrazioni e sui popoli, con tanta rappresentanza di artisti di popolazioni e entie oppresse e marginalizzate. Il rischio di una cornice così internazionale e istituzionale è quello di essere poco incisivi e di essere manipolati, nel mio caso mi ha aiutato a capire di più e ha creato consapevolezza e curiosità su tante altre situazioni anche lontane da noi.
@Arte e Cultura @Cultura
@lgbtqbookstodon group

#arte #biennalevenezia #artequeer

Di Esther Solomon, caporedattrice della versione inglese di Haaretz (quotidiano israeliano)

Esther Solomon, Editor-in-chief, Haaretz English

This week, Israelis woke up to war again, but this time not to the Hamas surprise attack of October 7 but to a conscious decision by their government to restart fighting, against the will of the popular majority, which consistently favors an end to the war and the return of all the hostages. This same week, the Netanyahu government intensified its battles on two other fronts as well: its war on Israeli democracy, and its war on Diaspora Jews.

Prime Minister Netanyahu is baldly exhibiting his 'vision' for the character of his own regime and the principles that govern the Israeli state's behavior at home and abroad. It is a vision that is genuinely revolutionary, in that it rips up and shreds into confetti most of the fundamental values and social contracts that bind the state to its citizens, and the state to the Jewish people outside its borders.

With the Trump administration's backing, but to the consternation of most of the rest of the international community, IDF airstrikes are now raining down on Gaza again. Netanyahu's ministers are using bloodcurdling language, directed at the whole population of Gaza, and not only Hamas.

The declared premise for breaking the cease-fire – that extreme military pressure will force Hamas into capitulation, and will lead to hostages being released alive – is false and illogical. Sixteen months of war has shown that only negotiations bring back significant numbers of hostages alive, that airstrikes kill them, and Hamas, which has repopulated its ranks, has no pangs of conscience to fight to the last Gazan. As Einav Zangauker, warrior mother of hostage Matan, said: "Netanyahu has opened the gates of hell not on Hamas, but on our loved ones."

The real reason for resuming war is to satiate the annexationist warlust of the far right, and win the prime minister more time in power. And both of those reasons factor into the resurgence-on-steroids of the government's judicial coup, now honed to take out the Shin Bet head and the Attorney General, the key remaining gatekeepers of democracy and the rule of law.

There's an urgency to Netanyahu's call to rid himself of these troublesome officials, and it's called Qatargate: the rolling scandal of close aides to Netanyahu allegedly being paid by Doha for positive PR during the war, in which the Shin Bet is a lead investigative agency. In true Trumpist style, and with a nod to his fellow White House populists, Netanyahu took to social media to accuse the "leftist deep state" of conspiring to weaponize the justice system to bring down the right-wing government.

This week there were also dramatic developments in the third front: How the government understands its relationship with Diaspora Jews. Amichai Chikli, the minister in charge of Diaspora relations and Israel's antisemitism czar, is organizing a "combating antisemitism" conference stuffed with representatives of European far-right parties whose antisemitic, neo-Nazi, illiberal record is either a fact of their founding and/or an everyday feature of their activists' rhetoric.

It was an ambush for the high-profile representatives of U.S. and European Jewish communities also invited to attend: To show solidarity with Israel at the cost of their own values and safety. One by one, they have cancelled, from the U.K.'s Chief Rabbi to the head of the ADL: Even Israel's President refused to host the far-right politicians. These are rare, brave moves that may well be a milestone in the breakdown of Israel-Diaspora relations, a sign of how infuriated Diaspora Jews are and how arrogant, cynical and fanatic the Israeli government.

Netanyahu's wars have terrible human costs, but they are also designed to reshape language and the space for dissent. To jumpstart the cease-fire, make war. To save the hostages, bomb them. To save democracy, institute autocracy. To confront antisemitism, welcome antisemites.

Despite their deep fatigue, most Israelis aren't buying it. Forty thousand turned out to protest in Tel Aviv on Tuesday; thousands more in Jerusalem the next day. But Netanyahu has formidable weapons at his disposal, and there is no cease-fire pending for the wars outside and inside Israel's borders.

Dedicato a chi dice che gli scioperi non servono.

[...] prevede l'immediata erogazione di una tantum di 500 euro e un incremento economico medio mensile a regime tra i 220 e i 240 euro

agi.it/economia/news/2025-03-2…