[Ziddy Makes] describes this cute little guy as a biblically-accurate keyboard. For the unfamiliar, that’s a reference to biblically-accurate angels, which have wings (and sometimes eyes) all over the place. They’re usually pretty scary to behold. Don’t say I didn’t warn you.

Image by [Ziddy Makes] via GitHubBut this? This is the opposite of scary. Sure, there are keys everywhere. But it’s just so darn adorable. You know what? It’s those keycaps.

This 16-key macro cube uses a Pro Micro and a system of PH2 5p ribbon cables to connect the four four-key sisterboards to the main board. A 3D-printed base holds all the boards in place. Out of all the switches in the world, [Ziddy] chose Otemu Blues. Clack!

Although it may take some getting used to, this seems like it would be a fun way to input macros. I can see the case for putting some rubber feet on the bottom, otherwise it might scoot around on the desk. That might be cute, but only the first couple of times, you know?

Lexicon Has A Handy Words Layer

[Ewen] wrote in to tell me about Lexicon, a keyboard he designed while reading Marcin Wichary’s most excellent Shift Happens. One idea spawned by the book was a keyboard aimed at writing prose faster and more easily. The result is an input device that marries a stenography-light concept with the BASIC shortcut-having ZX Spectrum.

The key is in those three Space bars. They each produce Space when pressed briefly, but when long-pressed bring up a different layer — Symbols, Function, and Words. “Symbols” refers to the various awesome Unicode symbols that come out of that layer, including neat typographical marks. “Function” comprises the Function keys plus extras.

Image by [Ewen] via GitHubThanks to the special Words layer, the user can quickly input common words such as ‘and’, ‘said’, and ‘she’. So how in the world would the user remember how to do all of that? Well, it’s actually pretty easy. There is one word per key, and they are married up alphabetically. So ‘a’ is for ‘and’, ‘s’ is for ‘said’ and ‘x’ is for ‘she’. Each number key gets you that word spelled out — 1 delivers ‘one’ and 2 gives you ‘two’, and so on.

But [Ewen] didn’t stop there. There’s a whole subset of words that are accessible by combining the Words key with two alpha keys, such as ‘SM’ for ‘some’. Users can easily combine shortcuts to produce longer words, like ‘SM1’ for ‘someone’.

Under the hood of this 65% keyboard, you’ll find an RP2040 running the QMK firmware. Although the Lexicon is not open-source, there’s nothing stopping you from taking this idea and running with it in another language. If you want to get a hold of one, check out [Ewen]’s Etsy for kits and completed boards.

The Centerfold: Keep On Truckin’

Image by [FarmersOnlyJim] via redditMan, this setup is fire! Don’t recognize the color scheme? It’s those hues from the Toyota Racing Development (TRD) days of the 1980s. The keyboard is a Keychron K8 Pro, and [FarmersOnlyJim] custom-dyed those MOA-profile keycaps. The neat part is that [Jim] offers their dye process right there in the comments. Come for the color scheme, and stay for the bunny tax in the gallery.

Do you rock a sweet set of peripherals on a screamin’ desk pad? Send me a picture along with your handle and all the gory details, and you could be featured here!

Historical Clackers: Espionage Via IBM Selectric II

So your girl caught this video by [Retro Tech or Die] and then picked up a Selectric II a few days later for about $5 with the coupon savings. It’s all gummed up inside, and I’ll have to address that on my own as my local shop no longer deals with Selectrics.
Image via YouTube
Anyway, back to the video. We’ve covered this topic before, but it’s been a long time, and this is a nice refresher. The Selectric was a revolutionary typing machine, and the correcting Selectric II a little bit more so. Because of this, government and other offices purchased them in large quantities.

At the height of US-Russian tensions, the Soviets saw an opportunity for espionage in these electromechanical marvels and planted bugs in the Selectric IIs inside the United States embassy in Moscow. It’s surprisingly easy to get inside a Selectric II, and it only took the spies about 30 minutes to open and bug each machine.

Selectric IIs were in use at the embassy from 1982 until 1984 when the bugs were discovered. For more than a year, the Soviets were able to read documents of all sensitivity levels even before officials had laid eyes on them. A tiny sensing device picked up the keystrokes and transmitted them to antennas hidden in the walls. These signals were relayed to a nearby listening station and decoded using probability tables.
Image via YouTube
These bugs were so small that they could only be detected by x-rays. Housed inside a metal bar of the typewriter, they used magnet meters to detect the disturbances as letters were typed. The transmitted signals were disguised inside television broadcast frequencies.

Because of the way the Selectric II is designed internally, the Soviets were only able to get the alphanumeric characters. They could not capture Shift, Space, Backspace, or Tab. Furthermore, they were compressing six bits of information down to four, which made probability tables pretty much the only option.

It’s a fascinating story for sure. And I’ll let you know how it works out with my Selectric II.

ICYMI: This Lovely Wooden Keyboard

Image via YouTube
It’s not often that we describe things as stunning, especially keyboards, which tend to be plastic-based rectangular life forms. But then there’s this wooden keyboard from Hacoa via [ProcessX].

Watch as the beautiful wood is routed out, and stay for the delicate and tedious process that produces each finished keycap.

I must admit that I was a little disappointed (or maybe caught off-guard) to see the lovely wooden keycaps being overlaid on plastic ones, but as one commenter pointed out, the stresses of wood grain running through an MX-style keycap stem would be pretty high.

Speaking of the keycaps, they are finished off with laser-engraved legends which will surely never wear out, but are bound to get, let’s say, seasoned over time. As much as I’d like to know how it feels to type on a wooden keyboard, this kind of project seems incredibly far out of reach. But we’ve certainly seen wooden keyboards before. Yes we have. Even macro pads.

Got a hot tip that has like, anything to do with keyboards? Help me out by sending in a link or two. Don’t want all the Hackaday scribes to see it? Feel free to email me directly.

hackaday.com/2024/11/11/keebin…

Il CERT-AGID ha recentemente rilasciato una nuova versione del tool hashr (v.2.0.1) come software libero e a codice aperto sotto licenza EUPL. Questo strumento, scaricabile gratuitamente dall’apposita pagina, è progettato per la ricerca di file malevoli all’interno di un filesystem confrontando i valori hash dei file riscontrati con una lista di impronte hash già note.

Hashr può essere utilizzato con proprie liste di ricerca oppure, per le Pubbliche Amministrazione accreditate al feed IoC del CERT-AGID, con gli hash derivati dalle campagne malevole registrate che hanno un impatto sul territorio italiano.

Tutte le Pubbliche Amministrazioni possono accreditarsi al feed IoC del CERT-AGID per avere accesso a un flusso in tempo reale di Indicatori di Compromissione (IoC), che elenca e condivide dati su campagne malware e phishing rilevate nelle attività quotidiane di monitoraggio e prevenzione, come ad esempio gli indirizzi IP utilizzati per attività fraudolente, URL di siti malevoli, hash di file dannosi e altre informazioni. Tale servizio, offerto gratuitamente, è rivolto esclusivamente alle Pubbliche Amministrazioni.

In sinergia con il Feed IoC, hashr consente di ricercare file con hash correlati a campagne malevole note o APT analizzati dal CERT-AGID, permettendo di identificare rapidamente i file compromessi. L’uso di hashr risulta particolarmente utile per indagini di sicurezza informatica, analisi forense e verifica dell’integrità dei file su filesystem di grandi dimensioni.

L’utilizzo combinato di hashr e del feed IoC aumenta significativamente la capacità di prevenire ed individuare minacce informatiche, incrementando la sicurezza complessiva delle infrastrutture digitali.

Questi due strumenti forniti da AGID costituiscono un’opportunità per le amministrazioni per migliorare la sicurezza dei propri sistemi IT, per adeguarsi, al contempo, alle indicazioni del Piano Triennale per l’Informatica 2024-2026 e per rafforzare la resilienza digitale complessiva della Pubblica Amministrazione.

Link utili:

• hashr (download e guida)
• Strumenti
• Accreditamento feed IoC

L'articolo Rilasciato Hashr 2.0.1: Il Tool Gratuito del CERT-AGID per Proteggere i Sistemi della PA proviene da il blog della sicurezza informatica.

Secondo un nuovo rapporto dell’Institute for Information Security (CIISec) 2023-24, i professionisti della sicurezza informatica nel Regno Unito guadagnano stipendi significativamente più alti rispetto alla media nazionale ma devono affrontare seri problemi di burnout.

Sulla base di un sondaggio condotto su 311 professionisti, lo stipendio medio nel settore della sicurezza informatica ha raggiunto 87.204 sterline, più del doppio dello stipendio medio del Regno Unito di 34.900 sterline (44.000 dollari). Dalla pubblicazione del primo rapporto CIISec nel 2016-2017, gli stipendi sono aumentati del 29%, da £ 62.144 ($ 78.400) ai livelli attuali. Tenendo conto dell’inflazione, la crescita reale è stata del 7%.

Dinamiche positive si registrano in tutti i segmenti industriali, con circa il 18% dei professionisti che ora guadagna più di £ 150.000 ($ 189.000) all’anno, rispetto ad appena il 7% nel 2016.

Tuttavia, gli alti salari sono accompagnati da gravi rischi professionali. Secondo il sondaggio, il 55% degli intervistati soffre di insonnia a causa dello stress lavorativo e il 39% teme un infarto. Uno specialista su cinque (21%) è considerato oberato di lavoro.

La situazione è aggravata dalla mancanza di personale qualificato. La maggior parte degli intervistati (72%) ha indicato il personale come la principale sfida operativa, mentre i processi e la tecnologia rappresentano una preoccupazione rispettivamente solo per il 17% e l’11%.

La mancanza di diversità nel settore aggrava la carenza di talenti: solo il 19% degli specialisti entra nella professione senza un’istruzione superiore e la percentuale di donne è solo del 10%. In particolare, solo il 41% dei dipendenti prevede di rimanere nella posizione attuale nei prossimi due anni.

Amanda Finch, CEO di CIISec, sottolinea che molte delle sfide del settore, incluso il panorama delle minacce in continua evoluzione, vanno oltre il controllo delle aziende. Tuttavia, le questioni legate al reclutamento e al mantenimento del personale possono essere risolte a livello del datore di lavoro.

Il rapporto presta particolare attenzione all’intelligenza artificiale (AI). Le opinioni sono divise: l’89% ritiene che la tecnologia avvantaggerà gli aggressori e il 71% vede un impatto positivo sui difensori della rete. Quando si pianifica l’uso dell’intelligenza artificiale nel lavoro (85% degli intervistati), è stata identificata una tendenza allarmante: il 44% delle organizzazioni non è consapevole dei rischi associati e non dispone di politiche per l’uso sicuro della tecnologia.

Secondo gli esperti, il settore della sicurezza informatica ha urgentemente bisogno di aumentare la conoscenza delle minacce associate all’intelligenza artificiale, in particolare all’intelligenza artificiale generativa, mentre la tecnologia è nelle sue prime fasi di sviluppo. Particolare attenzione dovrebbe essere prestata alla formazione dei professionisti emergenti che dovranno resistere agli attacchi dell’intelligenza artificiale per i decenni a venire.

L'articolo Il 55% non dorme, il 39% si aspetta un infarto: questo è il prezzo della sicurezza informatica proviene da il blog della sicurezza informatica.

The James Webb Space Telescope’s array of eighteen hexagonal mirrors went through an intricate (and lengthy) alignment and calibration process before it could begin its mission — but the process is far from being a one-and-done. Keeping the telescope aligned and performing optimally requires constant work from its own team dedicated to the purpose.

Alignment of the optical elements in JWST are so fine, and the tool is so sensitive, that even small temperature variations have an effect on results. For about twenty minutes every other day, the monitoring program uses a set of lenses that intentionally de-focus images of stars by a known amount. These distortions contain measurable features that the team uses to build a profile of changes over time. Each of the mirror segments is also checked by being imaged selfie-style every three months.

This work and maintenance plan pays off. The team has made over 25 corrections since its mission began, and JWST’s optics continue to exceed specifications. The increased performance has direct payoffs in that better data can be gathered from faint celestial objects.

JWST was fantastically ambitious and is extremely successful, and as a science instrument it is jam-packed with amazing bits, not least of which are the actuators responsible for adjusting the mirrors.

hackaday.com/2024/11/11/the-co…

Introduction

In a recent incident response case, we discovered a new and notable ransomware family in active use by the attackers, which we named “Ymir”. The artifact has interesting features for evading detection, including a large set of operations performed in memory with the help of the
malloc, memmove and memcmp function calls.
In the case we analyzed, the attacker was able to gain access to the system via PowerShell remote control commands. After that, they installed multiple tools for malicious actions, such as Process Hacker and Advanced IP Scanner. Eventually, after reducing system security, the adversary ran Ymir to achieve their goals.

In this post, we provide a detailed analysis of the Ymir ransomware, as well the tactics, techniques and procedures (TTPs) employed by the attackers.

Analysis

Static analysis

Our analysis began with a basic inspection of the artifact. We started by analyzing its properties, such as the file type, and relevant strings and capabilities, as shown in the table and images below.

File type identification

Although the binary does not raise suspicions of being packed, as its entropy is not high enough, the presence of API calls to functions like
malloc, memmove and memcmp indicates that it can allocate memory to insert malicious code.

Calls for memory operation functions

The binary also suspiciously imports functions, such as
CryptAcquireContextA, CryptReleaseContext, CryptGenRandom, TerminateProcess and WinExec, from operating system libraries. These API calls are typically found in various ransomware samples.

Suspicious malware imports

Even though most of the sample information is unpacked in memory during runtime, we were able to find some useful indicators in the binary strings, including the ransom note filename and contents in a PDF file, encryption extension, PowerShell commands, and some hashes used by the encryption algorithms, as shown in the following images.

PDF contents

PowerShell auto-delete command and encryption hashes

The attacker used the MinGW compiler, a native Windows port of the GNU Compiler Collection (GCC).

Compiler string

The following table shows other useful string indicators we found in the course of our analysis.

One interesting fact is that the PDF creation date was August 31, 2024, which matches the binary compilation timestamp (2024-08-31), as shown in the image below.

Malware compilation timestamp

Static analysis also shows that the PDF used as the ransom note is present in the
.data section of the binary. The information hardcoded in this kind of file is very useful for creating detection rules and indicators of compromise.

PDF file containing a ransom note

After reaching the main function, the malware executes another function with calls to other functions to get system information. To streamline our analysis, we renamed this function to
Get_System_Information:

Malware entry point

Get_System_information function and its sub-functions

The artifact gathers system information by using the API calls listed below.

• GetSystemTimeAsFileTime: retrieves the current system date and time.
• GetCurrentProcessId: gets the current process identifier (PID).
• GetCurrentThreadId: retrieves the identifier of the calling thread.
• GetTickCount: gets the amount of time that the system has been running for in milliseconds. This is used for detecting that the artifact is being debugged.
• QueryPerformanceCounter: retrieves the current value of the performance counter, which can be used for time-interval measurements.

System information gathering

The malware also contains some execution restrictions which are activated when certain parameters are set. For example, the
--path parameter disables self-delete, allowing the attacker to reuse the binary for other directories.

The artifact is not deleted when running with the –path parameter

While reverse-engineering the sample, we found that it borrowed code from functions related to CryptoPP, an open-source cryptographic library written in C++.

CryptoPP functions

The malware also has a hardcoded list of file name extensions to exclude from encryption.

File name extensions to ignore

Dynamic analysis

While running the ransomware, we spotted hundreds of calls to the
memmove function. After analyzing the data, we found that it loaded small pieces of instructions into memory for performing malicious functions. The following image shows a fragment of the malware loading environment variables after calling memmove.

Environment variables loaded into memory

The malware constantly uses the
memmove function while enumerating subdirectories and files inside the affected system, so they can be encrypted later.

Directory enumeration

It also uses
memmove to load strings that contain locations in the victim’s filesystem and are used for comparing with common directory names during runtime.

Strings loaded via memmove

The sample uses the
RtlCopyMemory function from the ntdll.dll library to load additional libraries, such as CRYPTSP.dll, rsaenh.dll, bcrypt.dll and kernelbase.dll.

Runtime loading of DLLs

The artifact uses the stream cipher ChaCha20 algorithm to encrypt files, appending the extension
.6C5oy2dVr6 to each encrypted file.

ChaCha20 encryption

Additionally, it copies the PDF contents from the
.data section and uses the _write and _fsopen functions to generate a ransom note in PDF format within every directory in the affected system.

Ransom note write operation

The ransom note informs the victim about what happened to the affected system and instructs them to contact the attackers for a deal. Although the note mentions that the attackers have stolen the data from the affected machine, the malware does not have any network capabilities for data exfiltration. This leads us to believe that the adversaries would steal data with other means once they obtained access to the computer, such as through HTTP, FTP or cloud storage uploads.

Ransom note fragment

We spotted one odd string, a comment written in the Lingala language. This language is used in the Democratic Republic of the Congo, Republic of the Congo, Angola and the Central African Republic.

Comment in Lingala found during malware execution

Another interesting fact is that the sample searches for PowerShell in each subdirectory as it repeatedly calls the
RtlCopyMemory function. Once PowerShell is located, the malware uses it for deleting itself. In our investigation, we copied powershell.exe into our Desktop folder, so it was used for deleting the sample.

PowerShell binary search

The following diagram shows a summary of the sample’s execution. Note that the only child process created was
powershell.exe — the malware creates a PowerShell instance even if it finds one in the system. Subsequently, PowerShell calls conhost.exe, which is used for running services in the background.

Malicious processes

Process tree

The malware calls PowerShell with the cmdlet
Start-Sleep to wait 5 seconds, and finally, uses the Remove-Item command to delete itself from the machine, as shown in the image below.

PowerShell command execution

YARA rule

Based on our analysis of the sample, we developed the following YARA rule for detecting the threat in real time. The rule considers the file type, relevant strings and library function imports.
import "pe"

rule Ymir
{
meta:
author = "Kaspersky - GERT"
description = "Yara rule for detecting the Ymir ransomware."
target_entity = "file"

strings:
$s1 = "powershell -w h -c Start-Sleep -Seconds 5; Remove-Item -Force -Path"
wide ascii nocase
$s2 = "setup-qtox-x86_64-release.exe" wide ascii nocase
$s3 = "6C5oy2dVr6" wide ascii nocase
$s4 = "INCIDENT_REPORT.pdf" wide ascii nocase
$s5 = "D:20240831154833-06" wide ascii nocase
$s6 = "ChaCha" wide ascii nocase
$s7 = "x64dbg" wide ascii nocase
condition:
(3 of ($s*)) and pe.imports("msvcrt.dll", "memmove")
}

Telemetry

Using the above rule, we were able to query threat intelligence portals and find a similar sample originating from Pakistan. We believe that the attacker used a VPN network or Tor to hide their IP. The artifact we discovered looks like a test binary sent by the attacker to check if it would be detected by security vendors. The sample receives a
--path parameter from the command line, which specifies the directory to be encrypted. However, it neither encrypts the files nor generates a ransom note.

Execution of the test sample

What caught our attention was that this test version of the executable, similarly to the full-featured sample, did not delete itself when executed with the
--path parameter, which made sense, since the adversary might want to select certain directories during the attack.
By comparing the two detections, we concluded that the final sample with the fully enabled encryption features, unlike the test variant, had extended functionality implemented in additional strings. These included the extension appended to the name of the encrypted files (
.6C5oy2dVr6) and the information present in the PDF file generated as a ransom note.

YARA matches comparison

At the time of our research, 12 security vendors including Kaspersky detected the threat.

The ransomware incident

In addition to analyzing the malware, we managed to investigate an incident in Colombia where the Ymir sample was obtained. Our forensic analysis revealed that crucial evidence had been lost through the attacker’s efforts to cover their tracks. We at Kaspersky GERT were able to identify that two days before the ransomware deployment, a new RustyStealer threat was detected on multiple systems, allowing the attackers to control the machines, send commands, and gather information from compromised infrastructure. Malicious activity was detected on a domain controller shortly after, including compromised access on behalf of legitimate users, including one with high privileges. The initial RustyStealer sample was a PE file compiled with Rust and deployed to Windows\Temp under the name
AudioDriver2.0.exe.

This sample, named Trojan.Win32.Sheller.ey by Kaspersky, has the ability of gathering information about the file system. This sample has obfuscated content for obstructing analysis and includes shared modules indicating that the artifact can invoke functions from APIs, such as native Windows DLLs.

This sample also connects to the C2 server 74.50.84[.]181 on port 443, detected by Kaspersky as a host for malicious files since August 2024.

C2 server

The attackers compromised the domain controller and used it to continue infiltrating systems in the targeted infrastructure. They abused compromised credentials gathered by the stealer to hop between systems using WinRM and PowerShell remote control capabilities, and then executed a set of two scripts that were confirmed to be a part of the proxy malware threat SystemBC.

Both scripts use PowerShell to establish a covert channel to the IP address 94.158.244[.]69 on port 443. Based on the strings from the scripts we were able to obtain, we implemented Yara rules for identifying other samples and C2 servers configured with the same codification and spotted in the wild.

One of these scripts was spotted in multiple systems, collected as a script block for PowerShell that included a different approach and a different C2 system (5.255.117[.]134 on port 80). It was probably used to exfiltrate information from the infrastructure according to the following hardcoded functions and their instructions.

• GetServerByFilename,
• SendFile,
• SearchRoot.

GetServerByFilename function

The script establishes communication with the C2 server and sends information, including a specific key that allows the attacker to identify the affected company.

The URI includes a unique key for each victim

Information that will be sent to C2 server

The
SearchRoot function contains a loop that searches for all files that are included in the requested folder and checks for a specific filter: the malware only uploads files with a size greater than 40 KB that were created after a specified date.

Search function

File search procedure

The script is Base64 encoded and passed to the following command for execution.
$selfpath\powershell.exe -Version 5.1 -s -NoLogo -NoProfile -EncodedCommand <B64CMD>
According to our GERT analysis, at the time of the research, there was a service configured at this IP address (5.255.117[.]134) for uploading files that were collected with the SystemBC scripts.

Active webservice

At the same time, multiple creations and executions of the well-known programs Advanced IP Scanner and Process Hacker were alerted on several systems.

• advanced_ip_scanner.exe;
• processhacker-2.39-setup.exe.

Finally, two days after the initial RustyStealer intrusion, attackers deployed the Ymir ransomware by executing remote connections and uploading the payload. Some traces of the execution were detected, in particular those associated with the PowerShell self-destruct script. Also, a part of the ransom note was configured in the registry key field
legalnoticecaption, located in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, which invites the user to look for additional details in the ransom note, named “INCIDENT_REPORT.pdf”:

Part of the ransom note from the registry

Conclusion

A link between malware stealer botnets acting as access brokers and the ransomware execution is evident. The Ymir development represents a threat to all types of companies and confirms the existence of emerging groups that can impact business and organizations with a configurable, robust and well-developed malware. We have seen initial access brokers invade an organization and ensure persistence. Ymir was deployed to the targeted system shortly after. This new ransomware family was configured in a secure scheme, making it impossible to decrypt the files from the targeted system. The group behind this threat has not presented a dedicated leak site or any additional information yet, but we will continue monitoring their activity. Alerts were triggered two days prior to the ransomware incident, and the lack of action on the critical system warnings allowed the attackers to launch the ransomware. This highlights the need for improved response strategies beyond relying solely on endpoint protection platforms (EPP).

Kaspersky products detect this new threat as Trojan-Ransom.Win64.Ymir.gen.

Tactics, techniques and procedures

Below are the Ymir TTPs identified from our malware analysis.

RustyStealer TTPs:

Indicators of Compromise

File Hashes
3648359ebae8ce7cacae1e631103659f5a8c630e
fe6de75d6042de714c28c0a3c0816b37e0fa4bb3
f954d1b1d13a5e4f62f108c9965707a2aa2a3c89 (INCIDENT_REPORT.pdf)
5ee1befc69d120976a60a97d3254e9eb
5384d704fadf229d08eab696404cbba6
39df773139f505657d11749804953be5
8287d54c83db03b8adcdf1409f5d1c9abb1693ac8d000b5ae75b3a296cb3061c
51ffc0b7358b7611492ef458fdf9b97f121e49e70f86a6b53b93ed923b707a03
b087e1309f3eab6302d7503079af1ad6af06d70a932f7a6ae1421b942048e28a

IPs
74.50.84[.]181:443
94.158.244[.]69:443
5.255.117[.]134:80
85.239.61[.]60

securelist.com/new-ymir-ransom…

Luke is a homeless #cat in Iran. He was found dragging himself along the street, crying for help. Many people contributed to his treatment and surgery to help him get back on his feet. He’s a fighter, and he powered through. 😻
Although he’s made significant progress in his recovery, he still needs a home, as he’s too vulnerable to live on the streets. Luke has come a long way because he loves life. If you want to witness and share in that passion for life, bring him into your home.
For information: Shima +39 389 603 7889

Luke è un #gatto randagio in Iran. È stato trovato mentre si trascinava per strada, piangendo per chiedere aiuto. Tante persone hanno contribuito alle sue cure e all’intervento per aiutarlo a rimettersi in piedi. È un combattente e ha lottato con tutte le sue forze. 😻
Anche se ha fatto grandi progressi nella sua guarigione, ha ancora bisogno di una casa, poiché è troppo vulnerabile per vivere in strada. Luke ha fatto tanta strada perché ama la vita. Se vuoi condividere e ammirare questa passione per la vita, accoglilo nella tua casa.
Per informazioni: Shima +39 389 603 7889

Alcuni Procuratori della Procura Speciale contro la corruzione ed il Crimine Organizzato (SPAK) e alti Ufficiali della Polizia albanese (ASP) hanno effettuato una visita di studio in Italia.

La SPAK è un'entità giudiziaria indipendente, incaricata di indagare sulla corruzione e sulla criminalità organizzata ai più alti livelli del governo e della società in Albania. È composto dall'Ufficio investigativo nazionale, dalla Procura speciale e dai tribunali speciali.

La delegazione albanese ha condotto, nel nostro Paese, una visita studio sugli aspetti operativi delle investigazioni finanziarie.

L’attività è stata curata dalla Direzione Investigativa Antimafia (DIA) e organizzata dalla presenza OSCE in Albania nonché dall’Ufficio del Coordinatore per le attività economiche ed ambientali ed il Dipartimento per le minacce transnazionali del Segretariato OSCE, con il supporto dell’Esperto per la Sicurezza e dell’Esperto della Guardia di Finanza presso l’Ambasciata d’Italia a Tirana e del Servizio per la Cooperazione Internazionale di Polizia.

Il principale obiettivo del training è stato quello di sostenere l’Autorità Giudiziaria e la Polizia albanese nelle attività di contrasto al riciclaggio dei capitali illecitamente acquisti, nel settore delle misure di prevenzione patrimoniali in un’ottica di potenziamento e del rafforzamento della lotta al crimine organizzato transnazionale.

La delegazione è stata ricevuta dal Direttore della DIA, Generale di Corpo d’Armata della Guardia di Finanza Michele Carbone (immagine sopra) che nel corso del suo intervento ha sottolineato l’importanza di tali attività perché consentono la conoscenza interpersonale e il rafforzamento della fiducia reciproca, presupposto indispensabile per valorizzare la cooperazione in un settore tanto delicato, come quello del contrasto al crimine organizzato ed all’individuazione dei patrimoni illecitamente accumulati.

Nel corso delle attività è stata riaffermata l’efficacia dell’azione di contrasto alla criminalità organizzata nell’ambito della cooperazione tra i due Paesi, entrambi membri OSCE.

La visita rientra nelle attività svolte dalla presenza OSCE in Albania nel programma di supporto al sistema di law enforcement albanese e del progetto regionale OSCE per rafforzare le capacità di contrasto ai crimini finanziari.

#SPAK #ASP #OSCE #ALBANIA #DIA #GUARDIADIFINANZA #GDF

L'esploratore Henry Stanley saluta David Livingstone, di cui si era posto alla ricerche alla sorgente del fiume Nilo, con la famosa frase “Dr. Livingstone, immagino?"

@Storia
#otd