Non è la prima volta che in Italia infrastrutture critiche vengono messe fuori uso da problemi legati a cavi danneggiati o rotture di fibre ottiche. Episodi simili dimostrano quanto sia urgente investire di più nella resilienza delle reti, garantendo piani di emergenza efficaci. Non si tratta solo di affrontare minacce legate alla sicurezza informatica, come attacchi cyber, ma anche di prevenire e gestire incidenti legati alla normale amministrazione, come lavori stradali o errori tecnici. In un’epoca in cui i servizi digitali sono il cuore pulsante dell’economia e della società, quello che si chiama “single point of failure” non può essere ammesso, soprattutto sotto la pressione delle speso folli del Black Friday.
La società francese di pagamenti digitali Worldline ha dichiarato venerdì che i lavori stradali del gas hanno danneggiato accidentalmente la connessione di rete ai suoi data center in Italia, interrompendo i servizi per i clienti e causando problemi che devono ancora essere risolti.
L’interruzione si è verificata nel pieno dell’intensa stagione degli acquisti del Black Friday.
Worldline ha dichiarato in una nota che i suoi servizi di pagamento sono stati interrotti da giovedì mattina, principalmente in Italia ma anche in altri mercati non specificati.
“La causa dell’interruzione è stata identificata. L’installazione di tubi del gas da parte delle autorità locali ha danneggiato gravemente i cavi e la rete del nostro fornitore. I lavori di ripristino da parte del nostro fornitore dovrebbero iniziare più tardi oggi“, ha affermato la società.
Worldline ha aggiunto che sta lavorando “instancabilmente” per verificare se è possibile riattivare i servizi prima che la sua infrastruttura fisica venga riparata e si è scusata con i consumatori e i negozianti per l’inconveniente.
In una dichiarazione separata, il gruppo italiano di pagamenti Nexi ha confermato che Worldline non ha ancora risolto il problema e ha affermato di aver avviato un’indagine e di riservarsi il diritto di adottare misure per proteggere l’azienda e i suoi clienti.
Anche la Banca d’Italia è intervenuta, affermando che stava monitorando la situazione. “Alcuni dei servizi di pagamento interessati sono stati riattivati, mentre permangono malfunzionamenti per alcuni circuiti di carte di credito e di debito”, ha affermato la banca centrale.
@Politica interna, europea e internazionale “Più di 500mila persone oggi in Italia hanno scelto di essere in piazza per difendere la libertà e i diritti di tutti. E il messaggio molto chiaro è che non solo la piazza non si precetta ma che non siamo qui tutti insieme per difendere l’integrità
Meet the Micro Planck. It’s a simple ortholinear mechanical keyboard in a decidedly compact form factor—measuring just 23 cm wide, 9.5 cm tall, and 2 cm deep. You could probably stuff it in your pocket if you wear baggy jeans. Oh, and if you don’t know what ortholinear means, it just means that the keys are in a straight grid instead of staggered. Kind of like those “keyboards” at the bowling alley.
The build relies on Gateron KS-33 switches installed on a custom PCB, with a ATmega32U4 microcontroller running the popular open source QMK firmware. The keyboard has a USB-C port because it’s 2024, and all the components are wrapped up in a neat 3D printed shell.
Overall, it’s a tasteful design that packs in a lot of functionality. It’s also neat to see a mechanical design used which offers more tactile feedback than the rubber dome designs more typical at this scale. Meanwhile, if you’re cooking up your own nifty keyboard designs, don’t hesitate to let us know what you’re up to!
Per celebrare la fine della "Grande guerra", nel novembre del 1918 il football italiano organizza un grandioso torneo a Milano. Ripercorriamo assieme, se vi va, le tappe di quell'evento.
IL TORNEO MILITARE DELLA VITTORIA (Parte III) Per celebrare la fine della "Grande guerra", nel novembre del 1918 il football italiano organizza un grandioso torneo a Milano. Ripercorriamo assieme, se vi va, le tappe di quell'evento. storiedifootballperduto.blogsp…
The statistics presented here are based on detection verdicts by Kaspersky products and services received from users who consented to providing statistical data.
Quarterly figures
In Q3 2024:
Kaspersky solutions successfully blocked more than 652 million cyberattacks originating from various online resources.
Web Anti-Virus detected 109 million unique links.
File Anti-Virus blocked more than 23 million malicious and potentially unwanted objects.
More than 90,000 users experienced ransomware attacks.
Nearly 18% of all victims published on ransomware gangs’ data leak sites (DLSs) had been hit by RansomHub.
More than 297,000 users experienced miner attacks.
Ransomware
Quarterly trends and highlights
Progress in law enforcement
In August, Spain arrested a cybercriminal who founded Ransom Cartel in 2021 and set up a malvertizing campaign. According to the UK’s National Crime Agency (NCA), this individual also was behind the infamous Reveton ransomware Trojan spread in 2012 — 2014. Reveton was among the most notorious PC screen lockers. This type of cyberextortion predated Trojans, which encrypt the victim’s files.
Two other cybercriminals, arrested earlier and suspected of spreading LockBit, pleaded guilty. In 2020 — 2023, one of them was an active cyberextortionist who attacked organizations in several countries, causing a total of at least $1.9 million in damage. The other one, according to the source, had caused damage estimated at roughly $500,000.
Vulnerability exploitation attacks
Ransomware gangs continue to exploit software vulnerabilities, mostly to penetrate networks and escalate their privileges.
In September the Akira ransomware attacked SonicWall devices powered by SonicOS to exploit the CVE-2024-40766 vulnerability in the operating system, patched in August.
Akira and Black Basta launched ransomware attacks on VMware ESXi by exploiting the CVE-2024-37085 vulnerability in the hypervizor, which allowed escalating privileges.
High-profile incidents
Dark Angels, which operates a DLS known as “Dunghill Leak”, extracted what was probably the largest ransom payment ever: $75 million. Researchers who reported the incident did not mention the organization that paid up. Before that, the highest known ransom paid was $40 million, received by Phoenix ransomware operators from CNA Financial in 2021.
The most prolific groups
The statistics on the most prolific ransomware gangs draw on the number of victims added by attackers to their DLSs during the period under review. The third quarter’s most prolific ransomware gang was RansomHub, which accounted for 17.75% of all victims.
The group’s victims according to its DLS as a percentage of all groups’ published victims during the period under review (download)
Number of new modifications
In Q3 2024, we detected three new ransomware families and 2109 new variants, or half of what we discovered in the previous reporting period.
New ransomware modifications, Q3 2023 — Q3 2024 (download)
Number of users attacked by ransomware Trojans
Despite the decrease in new variants, the number of users encountering ransomware has increased compared to the second quarter. Kaspersky security solutions successfully defended 90,423 individual users from ransomware attacks from July through September 2024.
Unique users attacked by ransomware Trojans, Q3 2024 (download)
Geography of attacked users
TOP 10 countries attacked by ransomware Trojans
Country/territory*
%**
1
Israel
1.08
2
China
0.95
3
Libya
0.68
4
South Korea
0.66
5
Bangladesh
0.50
6
Pakistan
0.48
7
Angola
0.46
8
Tajikistan
0.41
9
Rwanda
0.40
10
Mozambique
0.38
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users. ** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.
We observed a 12% decline in miner-related attacks during the third quarter. Kaspersky solutions worldwide detected this type of malware on 297,485 unique user devices.
Unique users attacked by miners, Q3 2024 (download)
Geography of miner attacks
TOP 10 countries attacked by miners
Country/territory*
%
1
Venezuela
1.73
2
Tajikistan
1.63
3
Kazakhstan
1.34
4
Ethiopia
1.30
5
Uzbekistan
1.20
6
Belarus
1.20
7
Kyrgyzstan
1.16
8
Panama
1.10
9
Bolivia
0.92
10
Sri Lanka
0.87
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users. ** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.
Attacks on macOS
Password stealers were the third quarter’s most noteworthy findings associated with attacks on macOS users. Security researchers discovered two new subscription-based stealers, Banshee Stealer and Ctulhu Stealer, which were being distributed via Telegram channels and dark web forums. These bore a strong similarity to the previously known AMOS Trojan, but they were written in C++ and Go, respectively. Furthermore, an independent security researcher released an analysis of a new version of BeaverTail, another type of information stealer designed to exfiltrate data from web browsers and cryptocurrency wallets. This malware also possessed the capability to install a backdoor on compromised systems.
In addition to the new stealers, the third quarter saw the discovery of a new macOS backdoor. HZ Rat is the macOS-compatible version of a similarly named Windows backdoor. It targets the users of the Chinese messaging services WeChat and DingTalk.
TOP 20 threats to macOS
Unique users* who encountered the threat as a percentage of all users of Kaspersky security solutions for macOS who were attacked (download)
* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.
Adware and other potentially unwanted applications were as usual the most widespread threats for macOS. For example, AdWare.OSX.Angent.ap (9%) adds advertising links as browser bookmarks without the user’s knowledge.
Additionally, a variety of malicious applications were among the most active threats. These included MalChat (5.08%), a modified Telegram client that stole user data, and Amos, a stealer often bundled with cracked software.
Geography of threats to macOS
TOP 10 countries and territories by share of attacked users
Q2 2024*
Q3 2024*
Mainland China
0.47%
1.47%
Hong Kong
0.97%
1.36%
Spain
1.14%
1.21%
France
0.93%
1.16%
Germany
0.59%
0.95%
Mexico
1.09%
0.75%
Brazil
0.57%
0.61%
India
0.70%
0.46%
Russian Federation
0.33%
0.37%
Japan
0.22%
0.36%
** Unique users who encountered threats targeting macOS as a percentage of all unique users of Kaspersky products in the country/territory.
There was a noticeable increase in the percentage of users who encountered macOS threats in mainland China (1.47%) and Hong Kong (1.36%). The metric also increased in Spain (1.21%), France (1.16%), Germany (0.95%), Brazil (0.61%), Russia (0.37%), and Japan (0.36%). Conversely, India (0.46%) and Mexico (0.75%) both experienced a slight decrease. Both the United Kingdom and Italy fell out of the TOP 10 most vulnerable countries.
IoT threat statistics
The distribution of devices that targeted Kaspersky honeypots across protocols went through only minor shifts in Q3 2024. Following a decline in the previous quarter, Telnet attacks witnessed a slight uptick, while SSH-based attacks decreased.
Attacked services by number of unique attacking device IP addresses, Q2 — Q3 2024 (download)
When analyzing the distribution of attacks across different protocols, we observed a slight increase in the share of Telnet, which accounted for 98.69% of all attacks.
Distribution of attackers’ sessions in Kaspersky honeypots, Q2 — Q3 2024 (download)
TOP 10 threats downloaded to IoT devices:
Share of each threat uploaded to an infected device as a result of a successful attack in the total number of uploaded threats (download)
Attacks on IoT honeypots
There was a slight decrease in the percentage of SSH attacks originating in mainland China (22.72%), the United States (11.31%), Singapore (5.97%) and South Korea (4.28%). The freed percentage was distributed across other countries and territories.
Country/territory
Q2 2024
Q3 2024
Mainland China
23.37%
22.72%
United States
12.26%
11.31%
Singapore
6.95%
5.97%
India
5.24%
5.52%
Germany
4.13%
4.67%
South Korea
6.84%
4.28%
Australia
2.71%
3.53%
Hong Kong
3.10%
3.23%
Brazil
2.73%
3.17%
Indonesia
1.91%
2.77%
The percentage of Telnet attacks originating in India (32.17%) increased, surpassing other countries and territories.
Country/territory
Q2 2024
Q3 2024
India
22.68%
32.17%
Mainland China
30.24%
28.34%
Tanzania
0.01%
5.01%
Brazil
4.48%
2.84%
Russian Federation
3.85%
2.83%
South Korea
2.46%
2.63%
Taiwan
2.64%
2.42%
United States
2.66%
2.34%
Japan
3.64%
2.21%
Thailand
2.37%
1.35%
Attacks via web resources
The statistics in this section are based on data provided by Web Anti-Virus, which protects users when malicious objects are downloaded from malicious or infected web pages. Cybercriminals set up malicious pages on purpose. User-generated content platforms, such as forums, and compromised legitimate websites are both susceptible to malware infection.
Countries that serve as sources of web-based attacks: the TOP 10
The following statistics show the geographic distribution of sources of online attacks on user computers that were blocked by Kaspersky products. These attacks included web pages redirecting to exploits, websites hosting exploits and other malware, botnet command and control centers, and so on. Any unique host could be the source of one or more web-based attacks.
To determine the geographical origin of web-based attacks, we mapped the domain names to the domain IP addresses and determined the geographical location of the IP address (GEOIP).
In Q3 2024, Kaspersky solutions blocked 652,004,741 attacks from online resources located around the world. A total of 109,240,722 unique URLs triggered a Web Anti-Virus detection.
Geographical distribution of web-based attack sources, Q3 2024 (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of online malware infection faced by users in various countries and territories, for each country or territory, we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the quarter. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.
These rankings only include attacks by malicious objects that belong in the Malware category. Our calculations do not include Web Anti-Virus detections of potentially dangerous or unwanted applications, such as RiskTool or adware.
Country/territory*
%**
1
Qatar
11.95
2
Peru
11.86
3
Morocco
11.56
4
Algeria
11.52
5
Tunisia
11.24
6
Greece
11.11
7
Ecuador
10.95
8
Bolivia
10.90
9
Serbia
10.82
10
Bahrain
10.75
11
Sri Lanka
10.62
12
Slovakia
10.58
13
Bosnia and Herzegovina
10.29
14
Botswana
10.01
15
Egypt
9.93
16
North Macedonia
9.91
17
Libya
9.87
18
Jordan
9.85
19
Thailand
9.67
20
UAE
9.62
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users. ** Unique users targeted by Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.
On average during the quarter, 7.46% of internet users’ computers worldwide were subjected to at least one Malware-category web attack.
Local threats
Statistics on local infections of user computers are an important indicator. Objects detected as local are those that infiltrated a computer through file or removable media infection or were initially introduced to the computer in a non-obvious form, for example as programs included in complex installers, encrypted files, and so on.
Data in this section is based on analyzing statistics produced by Anti-Virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from OAS (on-access scan) and ODS (on-demand scan) modules, which were consensually provided by users of Kaspersky products. The data includes detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones or external hard drives.
In Q3 2024, Kaspersky File Anti-Virus detected 23,196,497 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in different countries and territories worldwide.
These rankings only include attacks by malicious objects that belong in the Malware category. Our calculations exclude File Anti-Virus detections of potentially dangerous or unwanted applications, such as RiskTool or adware.
Country/territory*
%**
1
Turkmenia
46.00
2
Afghanistan
38.98
3
Yemen
38.43
4
Tajikistan
34.56
5
Cuba
33.55
6
Syria
32.56
7
Uzbekistan
30.45
8
Niger
27.80
9
Burkina Faso
27.55
10
Burundi
27.27
11
Bangladesh
27.24
12
South Sudan
26.90
13
Tanzania
26.53
14
Cameroon
26.35
15
Benin
25.80
16
Vietnam
25.52
17
Iraq
25.15
18
Mali
24.82
19
Belarus
24.81
20
Angola
24.67
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users. ** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.
Overall, 13.53% of user computers globally faced at least one Malware-type local threat during Q3.
According to Kaspersky Security Network, in Q3 2024:
As many as 6.7 million attacks involving malware, adware or potentially unwanted mobile apps were prevented.
Adware was the most common mobile threat, accounting for 36% of all detected threats.
More than 222,000 malicious and potentially unwanted installation packages were detected, of which:
17,822 were associated with mobile banking Trojans.
1576 packages were mobile ransomware Trojans.
Quarterly highlights
Mobile attacks involving malware, adware or potentially unwanted apps dropped by 13% in Q3, to a total of 6,686,375. The figure is still above the early 2023 level.
Attacks on users of Kaspersky mobile solutions, Q1 2023 — Q3 2024 (download)
We attribute this drop to the ongoing decline in the activity of adware, primarily stealthware belonging to the AdWare.AndroidOS.HiddenAd family.
Meanwhile, threat actors had not abandoned their attempts to spread their creations through official app marketplaces. For instance, in the third quarter, we discovered the xHelper Trojan inside the Open Browser app on Google Play.
xHelper acts as a stealthy downloader, installing various apps on the device unbeknownst to the user. These downloaders can introduce both ads and malware onto your phone.
We also discovered many apps infected with the Necro Trojan, both in the Google Play store and outside of it. Necro is a multi-component Trojan with an extensive feature set. It can perform any action on a compromised device: from ad display and malware downloads to automatic subscriptions.
Mobile threat statistics
The number of detected Android malware and potentially unwanted app samples also decreased in the third quarter to 222,444.
Adware (36.28%) and riskware classified as RiskTool (23.90%) continued to dominate the landscape of installed software packages. The share of RiskTool decreased markedly from Q2. Conversely, there was a minor uptick in the proportion of detected adware.
Detected mobile apps by type, Q2* — Q3 2024 (download)
* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.
Compared to the previous quarter, there was a significant decrease in the number of installation packages for the BrowserAd and MobiDash adware. At the same time, there was an increase in the number of unique HiddenAd apps. The spike in new RiskTool.AndroidOS.Fakapp files, seen in the previous quarter, subsided, causing a decline in the overall RiskTool category.
Share* of users attacked by the given type of malicious or potentially unwanted app out of all targeted users of Kaspersky mobile products, Q2 — Q3 2024 (download)
*The sum may exceed 100% if the same users encountered multiple attack types.
Although the number of installation packages for AdWare.AndroidOS.HiddenAd increased, still, as mentioned above, the overall number of attacks by this malware decreased, which was reflected in its incidence on actual devices. Put simply, while cybercriminals released a variety of unique malware types, they were unsuccessful in infecting a large number of users.
Top 20 mobile malware programs
Note that the malware rankings below exclude riskware and potentially unwanted apps, such as adware and RiskTool.
Verdict
%* in Q2 2024
%* in Q3 2024
Difference in p.p.
Change in ranking
DangerousObject.Multi.Generic.
11.44
9.79
-1.65
0
Trojan.AndroidOS.Triada.ga
6.66
9.18
+2.52
+1
Trojan.AndroidOS.Fakemoney.v
6.60
9.12
+2.52
+1
Trojan.AndroidOS.Boogr.gsh
6.01
5.22
-0.79
+1
Trojan.AndroidOS.Triada.gs
0.00
5.05
+5.05
Trojan-Banker.AndroidOS.Mamont.bc
0.14
4.89
+4.75
+180
Trojan-Downloader.AndroidOS.Dwphon.a
2.71
4.74
+2.02
+1
DangerousObject.AndroidOS.GenericML.
7.56
4.45
-3.11
-6
Trojan.AndroidOS.Fakemoney.bw
1.17
4.27
+3.10
+15
Trojan.AndroidOS.Triada.gm
5.16
3.89
-1.27
-3
Trojan-Spy.AndroidOS.SpyNote.bv
1.26
3.68
+2.43
+10
Trojan-Spy.AndroidOS.SpyNote.bz
1.97
2.98
+1.01
-1
Trojan-Downloader.AndroidOS.Agent.mm
1.29
2.67
+1.38
+7
Trojan-Spy.AndroidOS.SpyNote.cc
1.18
2.45
+1.27
+9
Trojan.AndroidOS.Triada.gn
2.23
2.44
+0.20
-5
Trojan.AndroidOS.Generic.
2.59
2.31
-0.27
-7
Trojan-Dropper.Linux.Agent.gen
0.90
1.54
+0.64
+13
Trojan-Downloader.AndroidOS.Necro.f
0.00
1.33
+1.33
Trojan.AndroidOS.Triada.fd
5.89
1.30
-4.60
-13
Trojan-Spy.AndroidOS.SpyNote.ck
0.00
1.25
+1.25
* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.
The list of the most prevalent malware did not see any significant changes compared to the previous quarter. The generalized cloud verdict of DangerousObject.Multi.Generic took its usual top spot, followed by WhatsApp mods with embedded Triada modules, the Fakemoney phishing app which tricked users into providing their personal data by promising easy earnings, the Mamont banking Trojan, and the Dwphon pre-installed malware.
Region-specific malware
This section describes malware types that mostly focused on specific countries.
Verdict
Country*
%*
Trojan-Banker.AndroidOS.BrowBot.q
Turkey
98.80
Trojan-Banker.AndroidOS.Coper.c
Turkey
97.99
Trojan-Banker.AndroidOS.Coper.a
Turkey
97.70
HackTool.AndroidOS.FakePay.c
Brazil
97.36
Trojan-Spy.AndroidOS.SmsThief.ya
India
97.33
Trojan-Banker.AndroidOS.UdangaSteal.f
Indonesia
96.75
Trojan-Dropper.AndroidOS.Agent.sm
Turkey
96.71
Trojan-Banker.AndroidOS.Agent.ox
India
95.85
Trojan-Banker.AndroidOS.Agent.pp
India
95.50
Trojan-Banker.AndroidOS.Rewardsteal.n
India
95.31
Trojan-Banker.AndroidOS.UdangaSteal.k
India
95.17
Backdoor.AndroidOS.Tambir.d
Turkey
95.14
Trojan-Spy.AndroidOS.SmsThief.fs
Turkey
95.10
Backdoor.AndroidOS.Tambir.a
Turkey
94.93
Trojan-Spy.AndroidOS.SmsThief.wk
India
94.87
Trojan-Spy.AndroidOS.SmsThief.xy
India
94.59
Trojan-Banker.AndroidOS.Rewardsteal.gm
India
94.55
Trojan-Banker.AndroidOS.UdangaSteal.b
Indonesia
94.32
Trojan-Dropper.AndroidOS.Hqwar.bf
Turkey
94.31
Trojan-Spy.AndroidOS.SmsThief.vb
Indonesia
94.28
Trojan-Banker.AndroidOS.Coper.d
Turkey
94.17
* The country where the malware was most active. ** Unique users who encountered this Trojan modification in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same modification.
The list of malware types that targeted specific countries was updated with new samples: SmsThief.fs which attacked Turkish users, and SmsThief.ya and SmsThief.xy which both were being spread in India. The first one was associated with an ongoing Coper banker campaign in Turkey, while the other two were SMS spies masquerading as government or banking apps.
In addition, the list includes familiar malware that continued to operate in certain countries: the Tambir backdoor, and the BrowBot and Hqwar Trojans in Turkey, FakePay in Brazil, members of the UgandaSteal family in Indonesia and India, and others.
Mobile banking Trojans
The third quarter saw detected mobile banking Trojans installation packages reach a total of 17,822.
Number of installation packages for mobile banking Trojans detected by Kaspersky, Q3 2023 — Q3 2024 (download)
The majority of the installation packages belonged to the Mamont family, which also dominated real-life cyberattacks.
Top 10 mobile bankers
Verdict
%* in Q2 2024
%* in Q3 2024
Difference in p.p.
Change in ranking
Trojan-Banker.AndroidOS.Mamont.bc
1.47
35.29
+33.82
+21
Trojan-Banker.AndroidOS.Coper.c
0.00
6.61
+6.61
Trojan-Banker.AndroidOS.Agent.rj
0.00
5.53
+5.53
Trojan-Banker.AndroidOS.GodFather.m
6.41
5.40
-1.01
0
Trojan-Banker.AndroidOS.Faketoken.z
5.17
4.67
-0.50
0
Trojan-Banker.AndroidOS.Mamont.aj
0.39
4.44
+4.06
+33
Trojan-Banker.AndroidOS.Svpeng.aj
3.74
3.84
+0.10
+3
Trojan-Banker.AndroidOS.Coper.a
2.35
3.22
+0.86
+7
Trojan-Banker.AndroidOS.Mamont.aq
14.13
2.93
-11.20
-8
Trojan-Banker.AndroidOS.UdangaSteal.b
10.10
2.87
-7.23
-8
* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats.
New APT threat actor targets Russian government entities
In May 2024, we discovered a new APT targeting Russian government organizations. CloudSorcerer is a sophisticated cyber-espionage tool used for stealth monitoring, data collection and exfiltration via Microsoft, Yandex and Dropbox cloud infrastructures. The malware utilizes cloud resources for its C2 (command and control) servers, which it accesses via APIs using authentication tokens. CloudSorcerer also employs GitHub as its initial C2 server. CloudSorcerer functions as separate modules – for communication and data collection – depending on the process it’s running, but executes from a single executable. It leverages Microsoft COM object interfaces to perform its malicious operations.
While the modus operandi of the threat actor is reminiscent of the CloudWizard APT that we reported on in 2023, the malware code is completely different. Consequently, we believe CloudSorcerer is a new threat actor that has emulated a similar approach to interacting with public cloud services.
Two months later, in July 2024, CloudSorcerer launched further attacks against Russian government organizations and IT companies. The campaign, which we dubbed EastWind, used phishing emails with malicious shortcuts attached to deliver malware to target computers. The malware, which received commands via the Dropbox cloud service, was used to download additional payloads.
One of these was an implant called GrewApacha, used by APT31 since at least 2021. The other was an updated version of the backdoor used by CloudSorcerer in its earlier attacks. This one uses LiveJournal and Quora profiles as initial C2 servers.
The latest attacks also use a previously unknown implant with classic backdoor functionality called PlugY. This malware, which is loaded via the CloudSorcerer backdoor, has an extensive command set and is capable of supporting three different protocols for communicating with the C2. The code is similar to that of the DRBControl (aka Clambling) backdoor, which has been attributed to APT27 by several companies.
BlindEagle adds side-loading to its arsenal
In August, we reported a new campaign by Blind Eagle, a threat actor that has been targeting government, finance, energy, oil and gas and other sectors in Latin America since at least 2018. The campaign aligns with the TTPs (Tactics, Techniques and Procedures) and artifacts used by BlindEagle, although the attackers have introduced one new technique to their toolset – DLL side-loading.
The attack starts with phishing emails purporting to be a court order or summons from an institution in Colombia’s judicial system. The email contains a link in the body of the message that is also contained in the attached file, which appears to be a PDF or Word document. Victims are tricked into clicking the link to retrieve documents related to the lawsuit.
These documents are in fact password-protected ZIP or other archives. The archive files contain a clean executable file responsible for initiating the infection process through side-loading, alongside various malicious files used in the attack chain. One of these files carries an embedded loader named HijackLoader, which decrypts and loads the final payload. The final payload is a version of AsyncRAT, one of the Remote Access Trojans (RATs) used by BlindEagle in previous campaigns.
You can read more details about this campaign and the TTPs employed by this threat actor in general here.
Tropic Trooper spies on government entities in the Middle East
The threat actor Tropic Trooper, active since 2011, has historically targeted government, healthcare, transportation and high-tech sectors in Taiwan, the Philippines and Hong Kong. In June 2023, Tropic Trooper initiated a series of persistent campaigns targeting a government body in the Middle East.
We were alerted to the infection in June of this year when our telemetry indicated recurring alerts for a new China Chopper web shell variant discovered on a public web server. China Chopper is widely used by Chinese-speaking actors. The server was hosting a CMS (Content Management System) called Umbraco, an open source CMS platform for publishing content, written in C#. The observed web shell component was compiled as a .NET module of the Umbraco CMS.
Malicious module found inside Umbraco CMS on the compromised server
In the course of our subsequent investigation, we looked for other suspicious detections on this public server and identified several malware sets. These include post-exploitation tools that we have assessed with medium confidence to be related to this intrusion. We also identified new DLL search-order hijacking implants that are loaded from a legitimate vulnerable executable as it lacks the full path specification to the DLL it needs. This attack chain attempted to load the Crowdoor loader, named partly after the SparrowDoor backdoor described by ESET. During the attack, the security agent blocked the first Crowdoor loader, prompting the attackers to switch to a new, previously unreported variant with almost the same impact.
We attribute this activity with high confidence to the Chinese-speaking threat actor known as Tropic Trooper. Our findings show an overlap in the techniques reported in recent Tropic Trooper campaigns. The samples we found also demonstrate a high degree of overlap with samples previously attributed to Tropic Trooper.
The significance of this intrusion is that it involved a Chinese-speaking actor targeting a CMS platform that published studies on human rights in the Middle East, with a particular focus on the situation surrounding the Israel-Hamas conflict. Our analysis revealed that the entire system was the sole target during the attack, suggesting a deliberate focus on this specific content.
From 12 to 21: connections between Twelve and BlackJack groups
In the spring of 2024, posts containing personal data of real individuals began appearing on the -=TWELVE=- Telegram channel. This was soon blocked for violating Telegram’s terms of service, and the group remained inactive for several months. However, during our investigation of an attack in late June, we discovered techniques identical to Twelve’s and the use of C2 servers associated with this threat actor.
The Twelve group was established in April 2023 in the context of the Russian-Ukrainian conflict and has been attacking Russian government organizations ever since. The threat actor specializes in encrypting and then deleting its targets’ data, which suggests that the group’s primary objective is to cause as much damage as possible. Twelve also exfiltrates sensitive information from targeted systems and posts it on the group’s Telegram channel.
Interestingly, Twelve shares infrastructure, utilities and TTPs (Tactics, Techniques and Procedures) with the DARKSTAR ransomware group (formerly known as Shadow or COMET). This indicates that the two may belong to the same syndicate or activity cluster. At the same time, while Twelve’s actions are clearly hacktivist in nature, DARKSTAR adheres to the classic double extortion pattern. This variation in objectives within the syndicate highlights the complexity and diversity of modern cyberthreats.
We also discovered overlapping TTPs with BlackJack, another hacktivist group that emerged in late 2023. This group’s stated aims, from its Telegram channel, is to find vulnerabilities in the networks of Russian organizations and government institutions. The threat actor has claimed responsibility for more than a dozen attacks, and our telemetry also contains information about other undisclosed attacks where indicators point to BlackJack’s involvement.
The group uses only freely available and open source software. This includes the use of the ngrok utility for tunneling, Radmin, AnyDesk and PuTTY for remote access, the Shamoon wiper and a leaked version of the LockBit ransomware. This confirms that this is a hacktivist group that lacks the resources typical of large APT threat actors.
Other malware
How “professional” ransomware groups boost the business of cybercriminals
Cybercriminals who want to get into the ransomware business don’t necessarily need to develop the software themselves. They can find a leaked ransomware variant online, buy ransomware on the dark web, or become an affiliate. In recent months, we have published several private reports detailing exactly this.
In April, IxMetro was hit by an attack that used a still-new ransomware variant dubbed “SEXi”, a group that focuses primarily on ESXi applications. In each of the cases we investigated, the targeted organizations were running unsupported versions of ESXi. This group deploys either LockBit or Babuk ransomware, depending on the platform – Windows or Linux, respectively.
In the majority of cases, the attackers leave a note containing an email address or URL for a leak site. In the case we looked at, the note included a user ID associated with the Session messaging app. The ID belonged to the attackers and was used across a number of different ransomware attacks on a variety of victims. This indicates a lack of professionalism and suggests that the attackers did not have a TOR leak site.
Key Group (aka keygroup777) has utilized no fewer than eight different ransomware families in its relatively short history (since April 2022):
Use of leaked ransomware builders by Key Group
Over the approximately two-year period that the group has been active, it has made minor adjustments to its TTPs with each new ransomware variant. For example, the persistence mechanism was consistently implemented via the registry, though the specific technique differed by family. In most cases, autorun was used, but we’ve also seen them using the startup folder. While Russian-speaking groups typically operate outside Russia, this is not the case with Key Group. Like SEXi’s, Key Group’s operations are not particularly professional. For example, the primary C2 channel is a GitHub repository, which makes the group easier to track, and communication is conducted over Telegram, as opposed to a dedicated server on the TOR network.
Mallox is a relatively new ransomware variant that first came to light in 2021 and kicked off an affiliate program in 2022. It’s unclear how the authors obtained the source code: perhaps they wrote it from scratch, used a published or leaked version, or – as they claim – purchased it. Although it started as a private group running its own campaigns, it launched an affiliate program shortly after its inception. It is noteworthy that the group only engages with Russian-speaking affiliates and does not do business with novices. Affiliates are explicitly instructed to target organizations with a minimum revenue of $10 million and to avoid hospitals and educational institutions. Mallox uses affiliate IDs, making it possible to track affiliate activity over time. In 2023, there were 16 active partners. In 2024, only eight of the original affiliates were still active, with no newcomers. Other than that, Mallox has all the typical Big Game Hunting attributes that other groups have, such as a leak site and a server hosted on TOR.
You can read more about the above threats here. You can also read our full report on Mallox ransomware here. To learn more about our crimeware reporting service, contact us at crimewareintel@kaspersky.com.
HZ Rat backdoor for macOS
In June, we discovered a macOS version of the HZ Rat backdoor. The backdoor was being used to target users of the enterprise messenger DingTalk and the social networking and messaging platform WeChat. Although we do not know the original distribution point for the malware, we were able to locate an installation package for one of the backdoor samples – a file named OpenVPNConnect.pkg.
OpenVPNConnect.pkg on VirusTotal
The samples we discovered almost exactly replicate the functionality of the Windows version of the backdoor with the exception of the payload, which is received in the form of shell scripts from the attackers’ server. We noticed that some versions of the backdoor utilize local IP addresses to connect to the C2, leading us to believe the threat might be targeted. This also suggests that the attackers intend to use the backdoor for lateral movement through the target network.
The data collected about the targets’ companies and contact information could be used to spy on people of interest and lay the groundwork for future attacks. During the course of our investigation, we did not encounter the use of two of the backdoor’s commands (write file to disk and send file to server), so the full scope of the attacker’s intentions remains unclear.
Hacktivist group Head Mare targets Russia and Belarus
Since the start of the Russo-Ukrainian conflict, numerous hacktivist groups have emerged whose main goal is to cause damage to organizations on the opposing side of the conflict. One such group is Head Mare, which targets organizations in Russia and Belarus.
While such hacktivist groups tend to use similar TTPs, Head Mare uses more up-to-date methods to gain initial access. For example, the attackers leveraged a recently discovered vulnerability in WinRAR (CVE-2023-38831) that allowed them to execute arbitrary code on a compromised system via a specially crafted archive. This approach allows the group to more effectively deliver and disguise the malicious payload.
As is the case with most hacktivist groups, Head Mare maintains a public account on the X social network, which it uses to post information about some of its victims.
Head Mare post on X
Head Mare has targeted a variety of industries, including government, energy, transportation, manufacturing and entertainment. The group mainly uses publicly available software, which is typical of hacktivist groups. However, Head Mare’s toolkit also includes custom malware, PhantomDL and PhantomCore, delivered via phishing emails. In addition to its primary goal of causing damage to targeted organizations, Head Mare also deploys LockBit and Babuk ransomware, which demand a ransom for restoring encrypted data.
Loki: a new private agent for the popular Mythic framework
In July, we discovered a previously unknown backdoor called Loki, which was used in a series of targeted attacks against Russian companies in various industries, including engineering and healthcare. From our analysis and information gleaned from open sources, we determined that Loki is a private version of an agent for the open source Mythic framework. This has its origins in an open source framework for post-exploitation of compromised macOS systems, called Apfell. Two years later, several developers joined the project, the framework became cross-platform and was renamed Mythic. Mythic allows the use of agents in any language, for any platform, with the required functionality. Around two dozen agents have been published in the official Mythic repository, including Loki.
The Loki agent we discovered is a Mythic-compatible version of the agent for another framework, Havoc. The Loki modification inherited several techniques from Havoc to make it more difficult to analyze the agent, such as encrypting its memory image, indirectly calling system API functions, searching for API functions by hash and more. However, unlike the agent for Havoc, Loki was split into a loader and a DLL, where the main functionality of the malware is implemented.
Based on our telemetry, and the filenames of infected files, we believe that in several cases Loki was distributed via email, with unsuspecting victims launching the file themselves. More than a dozen companies have encountered this threat, although we believe the number of potential victims may be higher.
There is currently not enough data to attribute Loki to any known group. Rather than using standard email templates to distribute the agent, we think it’s likely that the attackers are approaching each target individually. We have also not found any unique tools on the infected machines that could help with attribution. The attackers seem to prefer using only publicly available traffic tunneling utilities such as gTunnel and ngrok, and the goReflect tool to modify them.
Tusk: unravelling a complex infostealer campaign
The Kaspersky Global Emergency Response Team (GERT) recently identified a complex campaign consisting of several sub-campaigns orchestrated by Russian-speaking cybercriminals. The sub-campaigns imitate legitimate projects, with slight modifications to names and branding, and using multiple social media accounts to enhance their credibility.
All the active sub-campaigns host the initial downloader on Dropbox. This downloader is responsible for delivering additional malware samples to the target’s machine, mostly infostealers (Danabot and StealC) and clippers (which monitor clipboard data). Additionally, the threat actors employ phishing tactics to entice individuals into revealing further sensitive information, such as credentials, which can then be sold on the dark web or used to gain unauthorized access to gaming accounts and cryptocurrency wallets, resulting in direct financial loss.
We identified three active sub-campaigns and 16 inactive sub-campaigns related to this activity, which we dubbed “Tusk”. In the three active sub-campaigns we analyzed, the threat actor uses the word “Mammoth” (a slang word used by Russian-speaking threat actors to refer to victims) in log messages of initial downloaders. Analysis of the inactive sub-campaigns suggests that they are either old campaigns or campaigns that haven’t started yet.
Our report includes our analysis of the three most recently active sub-campaigns – TidyMe, RuneOnlineWorld and Voico.
These campaigns underscore the persistent and evolving threat posed by cybercriminals who are adept at mimicking legitimate projects to deceive victims. By capitalizing on user trust in well-known platforms, these attackers effectively deploy a range of malware designed to steal sensitive information, compromise systems, and ultimately reap financial gain.
The use of social engineering techniques such as phishing, coupled with multi-stage malware delivery mechanisms, demonstrates the advanced capabilities of the threat actors involved. Their use of platforms like Dropbox to host initial downloaders, along with the deployment of infostealer and clipper malware, suggests a coordinated effort to evade detection and maximize the impact of their operations.
The similarities between different sub-campaigns and the shared infrastructure across them indicates a well-organized operation, potentially linked to a single actor or group with specific financial motives.
The discovery of 16 inactive sub-campaigns further illustrates the dynamic and adaptable nature of the threat actor’s operations.
In May, we discovered a campaign exclusively targeting victims in Italy, which is quite unusual, as cybercriminals typically broaden their range of targets to maximize their profits. However, in this campaign, the attackers check at various stages of the infection chain to ensure that only people in Italy are infected.
The final payload of the infection is a new RAT (Remote Access Trojan) called SambaSpy, a full-featured RAT developed in Java and obfuscated using the Zelix KlassMaster protector. The malware includes an extensive list of functions, including file system management, process management, keylogging, screen grabbing and webcam control.
The attackers lure their targets with phishing emails disguised as messages from a real estate agency. If the target clicks the link in the message, they are redirected to a malicious website that checks the system language and browser. If the potential victim’s system is set to Italian and they open the link in Edge, Firefox or Chrome, they receive a malicious PDF file that infects their device with either a dropper or a downloader. The difference between the two is minimal: the dropper installs the Trojan immediately, while the downloader first downloads the necessary components from the attackers’ servers. Those who don’t meet these criteria are redirected to the website of an Italian cloud-based solution for storing and managing digital invoices.
SambaSpy infection chain 1
SambaSpy infection chain 2
While we don’t yet know which cybercriminal group is behind this sophisticated attack, circumstantial evidence indicates that the attackers speak Brazilian Portuguese. We also know that they’re already expanding their operations to Spain and Brazil, as evidenced by malicious domains used by the same group in other detected campaigns.
@Notizie dall'Italia e dal mondo Dal 13 al 21 novembre scorso si è svolta nelle acque del Golfo di Taranto, l’esercitazione bilaterale italo-marocchina denominata ITA-MOR 24 L'articolo Italia-Marocco. Partnership militare pagineesteri.it/2024/11/29/med…
Muore a Bruxelles Giacomo Puccini, uno dei maggiori e più significativi operisti di tutti i tempi.
Tra le sue opere più famose La bohème (1896), Tosca (1900), Madama Butterfly (1904) e Turandot (1924). Quest'ultima non completata perché il compositore si spense stroncato da un tumore alla gola (era un fumatore accanito) prima di terminarla.
Ecco una descrizione dell'immagine: Ritratto in bianco e nero di un uomo con i baffi, vestito con un abito scuro a doppiopetto, le braccia incrociate sul petto. Indossa una camicia chiara e un cravattino scuro. L'uomo appare serio e posato.
TL;DR come si usa la funzione Channels di #Friendica?
Ho provato a usare la funzione Impostazioni > Channels in Friendica per personalizzare alcune #timeline.
A parte quelle predefinite (Ultimi messaggi, latest creation ecc.) non sono mai riuscito a crearne una nuova che effetivamente mostrasse una timeline con una selezione di post.
Ho provato a farne una senza alcun tipo di filtro, che accettasse tutte le lingue e che semplicemente "pescasse" i post da una cerchia.
In teoria mi aspettavo di vedere gli stessi post che vedo cliccando sulla cerchia. In pratica, invece, ottengo comunque una timeline vuota.
Hai ragione. La visibilità delle timeline è gestira malissimo 🤣
Diciamo che dopo averle impostate, Per poterle vedere, devi consentirme La visualizzazione nella sezione visualizzazione o display al link seguente: poliverso.org/settings/display
Dissi che la Russia avrebbe distrutto l'Ucraina e così è stato. Adesso devo dare un'altra pessima notizia: la Russia ha appena iniziato. Le politiche della Nato non hanno fatto bene all'Ucraina.
Sto provando #raccon per #friendica e devo dire che come al solito su smartphone un app fatta bene fa la differenza... Quest'app potrebbe spingermi ad usare friendica finalemte. Anche perché onestamente lo trovo molto più potente e completo di #mastodon che già uso
passerei volentieri da mastodon a friendica, più che altro perché il limite di 500 caratteri mi sta strettino. Ma in caso secondo te potrei migrare da una piattaforma all'altra senza perdere lo storico di post, contatti etc.?! Ho sentito che potrebbe essere possibile ma non sono sicuro...
quella brutta è che lo storico Dei tuoi messaggi non lo potresti portare dal vecchio account al nuovo account neanche se passassi da Mastodon a Mastodon. L'unica cosa che potresti fare è una sorta di redirect che fa in modo che i tuoi follower vengano trasferiti sul nuovo account. NB: non si tratta di crudeltà da parte degli sviluppatori, ma di un limite intrinseco del Fediverso, 😅. Tuttavia puoi importare tutti i tuoi contatti, sia esportando da Mastodon quelli che segui e (in maniera più complicata) quelli che ti seguono, e importare tutto su Friendica alla voce"Import Contacts" delle impostazioni!
la notizia bella è che nessuno ti obbliga a buttare via il tuo vecchio account Mastodon! Al di là del fatto che sia #RaccoonForFriendica, sia le altre app attualmente usate come Fedilab o Tusky, possono gestire più account, non è mai necessario eliminare il vecchio account. Anzi, come spiego in questo post, un account Friendica può essere utilizzato benissimo anche insieme a un account Mastodon. E d'altra parte, sebbene Friendica sia infinitamente più potente e completo rispetto a Mastodon, l'immediatezza di scrivere un messaggio con mastodon è proprio l'aspetto che caratterizza quella piattaforma.
Naturalmente, se hai bisogno di supporto ulteriore, sono a disposizione 😅
Anche grazie alle limitazioni volutamente imposte dal suo staff di sviluppo, Mastodon è un software relativamente semplice da usare e questa semplicità è diventata uno dei punti di forza di Mastodon ripetto ai tanti social del Fediverso.
Questo è uno dei motivi per cui il numero di utenti che usa Friendica è infinitamente più ridotto di quelli che utilizzano Mastodon, eppure è chiaro che chi non ha usato Friendica ha perso l'opportunità di conoscere bene le reali potenzialità offerte dai social del Fediverso.
Vediamo allora perché un utente Mastodon che vuole mantenere il proprio account Mastodon potrebbe decidere di aprire un nuovo account Friendica.
1) Scrivere post più lunghi, formattati e con immagini in linea e poi ricordarsi di ricondividerli con il proprio account Mastodon, in modo che tutti i follower Mastodon ne abbiano visibilità 2) Rispondere ad alcune discussioni con un messaggio più lungo che consenta di esprimere opinioni più argomentate 3) Impostare il proprio account Friendica per fare in modo che ricondivida automaticamente i post pubblicati dal proprio account Mastodon (sì, da Friendica possiamo farlo allo stesso modo rispetto a quando condividiamo i feed RSS che il nostro account può seguire) 4) Creare un gruppo Friendica (una cosa a metà tra una lista di distribuzione e un gruppo Facebook) da usare per invitare i propri contatti a delle discussioni di gruppo 5) creare un account collettivo che possa essere gestito, attraverso la funzione "delega", da altri utenti della stessa istanza Friendica 6) utilizzare alcune funzionalità di ricerca avanzata (i canali) e di ricondivisione dei contenuti ricercati per rimanere aggiornati su alcuni temi 7) mantenere un account di riserva in caso di problemi (indisponibilità o chiusura del server, sospensione, etc) 8) imparare che al mondo non esiste solo il microblogging e che vi sono sistemi più versatili e ricchi di funzionalità rispetto a Mastodon
Tutto chiaro? Per qualsiasi dubbio, siamo a disposizione!
di Paolo Ferrero - Voglio esprimere il mio pieno appoggio allo sciopero generale e un grazie ai lavoratori e alle lavoratrici che vi parteciperanno ed alle organizzazioni sindacali che l’hanno indetto: Cgil, Uil, Adl, Cobas, Cub, Sgb. Mai come questa volta lo sciopero generale è opportuno e giusto! – La situazione in cui versa il [...]
di Paolo Ferrero - Voglio esprimere il mio pieno appoggio allo sciopero generale e un grazie ai lavoratori e alle lavoratrici che vi parteciperanno ed alle o
Keeping up with links shared on your feeds with Sill, a new open protocol with Leaf, and PeerTube is starting to test their mobile app.
The News
Sill is a new app that aggregates the most popular links that are posted in your network. Sill connects to both your Mastodon and Bluesky accounts, and gives a combined overview of all the networks, as well as the option to filter the links. It not only shows you the links, but also shows you what people you follow have posted about these links, and sends you a daily email update. Creator Tyler Fisher describes Sill as an open-source passion project, and says he wants to make it sustainable, and is thus thinking about potential ways to make revenue. Fisher also says that he is ‘committed to always keeping the basic Sill web client free’.
The Leaf Protocol is a newcomer in the space of decentralised protocols, a peer-to-peer federation protocol. The Leaf protocol is working towards what they call an ‘agentic fediverse’. The Leaf Protocol is developed in tandem with the product named Weird, which provides people with a simple homepage on the internet. Underneath this website is Leaf, which provides the possibility of federation with other versions of Weird, as well as other potential products. The team has written here on how Leaf compares to ActivityPub and ATProto, as well as about capabilities and identity to see how it holds up to Christine Lemmer-Webber’s ‘recipe for making the “Correct Fediverse IMO (TM)”‘.
One of PeerTubes main goals for 2024 is to release a mobile app. PeerTube has now started testing the first versions of the app, available for both Android and iOS. They note that the app is still under active development, with some features missing.
Ghost’s latest update on their work on implementing ActivityPub shows that they are working on two different types of readers: an inbox for long-form content, and a feed for short-form.
Tigray – Il 28 e 29 novembre 2020, le forze eritree hanno effettuato uccisioni sistematiche ad Axum, andando porta a porta e uccidendo migliaia di civili. I
@Politica interna, europea e internazionale Vannacci stupito dalle parole di Fedez: “Sono lusingato” Vannacci si è mostrato sorpreso dalle parole che Fedez ha speso nei suoi confronti dichiarandolo superiore, quantomeno a livello comunicativo, alla segretaria del Pd Elly Schlein. Ospite del programma radiofonico
#NoiSiamoLeScuole questa settimana è dedicato a due Nuove Scuole, la “P. Zuffardi” di Fornovo di Taro (PR) e la Scuola dell’infanzia di Lugagnano Val D'Arda (PC), che saranno costruite ex novo, e al Liceo “Cassinari” di Piacenza che, con i fondi #PNR…
#NoiSiamoLeScuole questa settimana è dedicato a due Nuove Scuole, la “P. Zuffardi” di Fornovo di Taro (PR) e la Scuola dell’infanzia di Lugagnano Val D'Arda (PC), che saranno costruite ex novo, e al Liceo “Cassinari” di Piacenza che, con i fondi #PNR…
L'articolo proviene da #Euractiv Italia ed è stato ricondiviso sulla comunità Lemmy @Intelligenza Artificiale Il crescente volume di contenuti generati dall’intelligenza artificiale provenienti dalla Russia rappresenta una sfida significativa per la
@Politica interna, europea e internazionale Sciopero generale 29 novembre, orari e servizi garantiti: le informazioni Dalla scuola ai trasporti fino alla sanità: domani, venerdì 29 novembre 2024, Cgil e Uil hanno proclamato uno sciopero generale per protestare contro la manovra finanziaria del
Il fatto è ormai noto, avendo troneggiato sulle prime pagine dei giornali di ieri. Maggioranza e opposizione, o quantomeno il Pd, col favore del governo hanno provato a far passare un emendamento
In questa prospettiva, le fratture delle colonne di Arnaldo Pomodoro denunciano una sconosciuta fragilità della materia adrianomaini.altervista.org/in…
@Notizie dall'Italia e dal mondo Così ha scritto il giornale Yediot Ahronot dando voce alla contestazione degli israeliani nei confronti del premier Netanyahu. Hezbollah dall'altra parte del confine celebra quella che considera una vittoria. L'articolo Israele in Libano: «Dalla vittoria totale alla resa totale» proviene
@Notizie dall'Italia e dal mondo Due cittadini libanesi sono stati feriti nel sud dagli spari dell'esercito israeliano che ancora occupa diverse aree e tenta di impedire il ritorno degli sfollati. A Gaza i bombardamenti causano decine di vittime. L'ONU accusa
Negli accordi della tregua era previsto il NON rientro degli sfollati, inoltre l'IDF ha detto chiaro e tondo che se qualcuno viola gli accordi della tregua si sarebbero usate le armi da fuoco. E così è stato. Il titolo del post è fuorviante.
Esentare le aziende del settore della difesa dalle tasse per incrementare la produzione militare e incoraggiare le società straniere a investire nel Paese. È la proposta che arriva dal governo del Marocco, che ha di recente approvato una proposta di
L’India vuole entrare a far parte del club delle grandi potenze e per farlo punta sulle capacità militari strategiche. Nuova Delhi sta ultimando la costruzione di una nuova base navale nel golfo del Bengala, la quale avrà il compito di ospitare la futura flotta di sottomarini
Si riattiva il fronte siriano. Notizie di attacchi di HTS e FSA verso Aleppo. Alcuni villaggi conquistati e pare che gli islamisti si siano spinti sino a 9 km da Aleppo. L'esercito siriano starebbe contrattaccando. Certamente vi è dietro l'idea di sfruttare l'impegno russo in Ucraina pensando che ciò impedisca alla Russia di sostenere un secondo fronte, tanto più lontano da casa. Secondo me c'è dietro anche la mano turca: il doppiogiochista Erdogan non ha mai fatto mistero di volersi prendere Aleppo con tutto il nord della Siria e starà "sondando il terreno" in tal senso.
A short introduction: I’ve been writing these Last Week newsletters for a while, and they consists of a News section and a Links section. The News section focuses on the social side of the network, along with the more impactful tech news. The Links section gives all the links to other articles, tech and tools that are relevant to the network. Bluesky is growing so much now that it is not really feasible for me to include both sections in a single newsletter; so today you’ll get all the Links, and tomorrow I’ll send out all the News that has happened in the ATmosphere.
Enjoy, I’m sure there is more than enough interesting links in here.
The Links
Bluesky has been doing community outreach this week:
A second Twitch livestream for Q&A with COO Rose Wan, CTO Paul Frazee and CEO Jay Graber. Hip hop artist Flavor Flav also joined in as a cheerleader for Bluesky.
Paul Frazee and Emily Liu (who does communications for Bluesky) held a Reddit AMA
Bluesky engineer Bryan Newbold wrote a reply to Lemmer-Webber’s article.
While viewpoints differ on decentralisation from a technical perspective, they are in agreement that Bluesky and the ATmosphere is currently not decentralised in a social sense: the vast majority of people exclusively use Bluesky’s infrastructure. This echoes what I wrote about Bluesky and decentralisation here last week. The concept of Relays remains a significant part of the discussion of whether or not Bluesky is decentralised. Because of the increased load on the Relay due to the amount of new people joining, Bluesky stopped taking in posts from the fediverse bridge for a few days this week, indicating the amount of power that Bluesky has over the network.
PDSls, the tool which allows you to inspect and see every PDS on the network, has gotten a variety of updates. You can now log in, and edit and delete posts from your own PDS. Edited posts mostly do not show up on Bluesky anymore, barring some exceptions. For other services such as Picosky or WhiteWind edits do show up.
More organisations are playing with the concept of letting people set their handle on their subdomain, with Newgrounds and Neocities, as well as itch.io already providing the option last week.
Bluesky Tools
AT Orbital Laser is a tool to instantly block and account, as well as all that account’s followers, similar to Blockenheimer.
OpenVibe is an cross-platform app that supports Bluesky, Mastodon, Threads and Nostr. Their latest update supports for tagging users on multiple platforms.
Clearsky, the tool that allows you to see information such as blocks, as well as lists and starter packs you are on, is back online after it had been offline for a while due to increased network traffic.
ATProto allows everyone to tap into the ‘firehose’, the eventstream that broadcasts every single event on the network. This allows anyone to build tools and visualisations that utilise this data, ranging from serious and helpful to deeply silly. Last week I already covered a long list, and here are some more:
That’s all for this week, thanks for reading! You can subscribe to my newsletter to receive the weekly updates directly in your inbox below, and follow this blog @fediversereport.com and my personal account @laurenshof.online.
L’innovazione e le nuove capacità tecnologiche saranno la chiave per il trasporto aereo commerciale del futuro. Questi temi saranno al centro dell’evento organizzato dall’Enac con il Dipartimento per la Trasformazione digitale dedicato alla mobilità
Il recente traguardo raggiunto dal sistema a pilotaggio remoto Falco Xplorer di Leonardo rappresenta una svolta fondamentale in panorama in continua evoluzione come quello dell’aviazione europea. All’aeroporto di Trapani Birgi, il dimostratore Eudaas
Il ministro leghista Matteo Salvini ha tradito le classi lavoratrici rimangiandosi l’impegno a cancellare la legge Fornero. Non è mai stato dalla parte di chi lavora e non a caso torna ad attaccare il diritto di sciopero precettando i dipendenti del trasporto pubblico in occasione dello sciopero generale di otto ore indetto da Cgil e Uil e da sindacati di base Cobas, SgB, Cub, Adl per il 29 novembre.
Questa volta Salvini gioca di sponda con la Presidente della commissione di garanzia sul diritto di sciopero nei servizi essenziali, non a caso nominata dal governo, accogliendo il suo invito a limitare lo sciopero, deliberato, guarda caso, in ottemperanza ai diktat contro lo sciopero “selvaggio” lanciati dallo stesso ministro sui social.
Con questo nuovo atto intimidatorio il ministro leghista cerca di diritti dei cittadini utenti e quelli di chi lavora per nascondere le responsabilità sue e del governo per i pesanti disservizi dei trasporti, i gravi problemi di sicurezza delle reti, i tagli dei trasfermenti agli enti territoriali che peggioreranno ulteriormente il trasporto pubblico locale.
Dopo l’analogo provvedimento dello scorso anno, il ddl sicurezza e le misure disumane contro i migranti con questo ennesimo atto liberticida il governo punta a impedire la giusta rivolta sociale contro l’aggravamento delle politiche liberiste di cui questa manovra è solo l’anticipazione.
Con la legge di bilancio si avvia un grande rilancio dell’austerità neoliberista per colpire ulteriormente i diritti, lo stato sociale, la sanità, la scuola, l’università, i servizi pubblici.
Questo governo di ciarlatani usa la demagogia razzista per distrarre le classi popolari dalle sue politiche classiste. Mentre continuano a crescere profitti non si fa nulla a sostegno di salari e pensioni già tra i più bassi d’Europa e da tempo salassati da inflazione. Non si contrasta la precarizzazione del lavoro. Si rifiuta di approvare una legge per il salario minimo per porre fine alla vergogna dei salari da fame. In assenza di un piano per l’occupazione centinaia di migliaia di giovani continuano ogni anno a emigrare. È stato cancellato il reddito di cittadinanza facendo crescere a dismisura le povertà e le disuguaglianze. Si dice che i soldi non ci sono, ma si aumentano le spese militari a sostegno della lobby delle armi e delle guerre, non si tassano le grandi ricchezze, i superprofitti, si favorisce l’evasione fiscale, si fa pagare meno a chi ha più.
La migliore risposta è l’impegno per una grande riuscita dello sciopero generale del 29 novembre e per fare in modo che sia l’inizio di una grande stagione di lotte indispensabile per riconquistare diritti nella società e nei luoghi di lavoro.
Rifondazione Comunista invita a scioperare e a partecipare alle manifestazioni convocate dai sindacati.
Maurizio Acerbo, segretario nazionale e Antonello Patta, responsabile nazionale lavoro del Partito della Rifondazione Comunista/Sinistra Europea
Bene ha fatto il gruppo parlamentare The Left- La Sinistra a votare contro la Commissione guidata da Ursula Von der Leyen che nel suo discorso ha confermato la linea guerrafondaia e per il riarmo che accompagna il nefasto impianto antipopolare e antisociale del Patto di Stabilità. La governance neoliberista europea non costituisce un argine all’estrema destra ma è la porta attraverso la quale viene legittimata se disponibile alla guerra. Lo conferma la nomina di Fitto che sarà democristiano ma rappresenta il partito erede del fascismo. Assai grave che il Pd abbia accettato di votare insieme a Fratelli d’Italia e per una Commissione dal programma guerrafondaio e draghiano nel momento in cui è emerso un largo dissenso nei gruppi ma forte è stato il dissenso tra socialisti (25 contro e 18 astenuti) e tra i verdi (20 contro e 6 astenuti), rimpiazzati da 34 membri del gruppo di Meloni, ECR. Schlein dovrebbe tenere a mente che brutta fine fece Bersani seguendo indicazioni del Quirinale. Guerra e austerità sono il terreno su cui cresce in Europa l’estrema destra. La pessima Commissione Von Der Leyen, figlia della guerra e delle procedure non democratiche che favoriscono il peggiore trasformismo, è stata approvata dal Parlamento Europeo ma fortunatamente perde consensi. Non solo la Commissione prende 30 voti in meno della Presidente. Meloni dunque si accoda a quella UE che ha sempre criticato confermando che i sovranisti sono una variante dei neoliberisti, una delle due tendenze di politiche al servizio del grande capitale. A tenere insieme questa maggioranza c’è il collante del sostegno alla guerra con la Russia, una follia imperialista che rischia di portarci allo scontro diretto e al conflitto nucleare. Ancora una volta il metodo intergovernativo impedisce che la dialettica si svolga in un quadro democratico e spinge a cooptazioni trasformiste. L’unica cosa positiva è che il voto mostra crepe tra verdi e socialisti. Positivo che i verdi italiani – al contrario della maggioranza del gruppo – votino contro. Rifondazione Comunista e il partito della Sinistra Europea propongono un’Europa di pace e diritti radicalmente alternativa a quella rappresentata da Ursula von der Leyen e dalla sua commissione.
Maurizio Acerbo, segretario nazionale del Partito della Rifondazione Comunista – Sinistra Europea
Io sono Synth, è un anno ormai che sono nel #Fediverse e ho deciso di espandermi su Friendica per esplorarne le possibilità dato che è un po' di tempo che nutro curiosità per questo software.
Questo account non è il mio main, quello lo potete trovare su Misskey.social sul mio profilo @synthBirba , quello rimarrà il mio profilo "generico" ITA/ENG, qui vorrei concentrarmi nel comunicare esclusivamente in italiano e con persone che parlano la stessa lingua.
Ho scelto questa istanza perchè mi è capitato diverse volte di interagire con utenti che vengono da qui ^^
Presto farò l'annuncio anche sul mio main su Misskey per confermare il "collegamento" degli account (e sempre presto spero di approdare su PixelFed per caricare foto di gatti e quel che capita!)
Spero di trovarmi bene, di conoscere sempre più gente e di interagire in maniera interessante anche per voi c:
"We have data on the performance of >50k engineers from 100s of companies. ~9.5% of software engineers do virtually nothing: Ghost Engineers.”#Overemployment
Altbot
in reply to storiaweb • • •Altbot
in reply to storiaweb • • •