In a recent incident response (IR) case, we discovered highly customized malware targeting Exchange infrastructure within government environments. Analysis of detection logs and clues within the sample suggests that the Exchange server was likely compromised via a known N-day vulnerability. Our in-depth analysis of the malware revealed a sophisticated, multi-functional backdoor that can be dynamically extended with arbitrary functionality through the download of additional modules. Notably, the attackers leveraged several open-source projects to build this backdoor. Once loaded, the backdoor grants the attackers full control over the Exchange server, allowing them to execute a range of malicious activities. To evade detection by security products, the malware employs various evasion techniques and disguises itself as a common server component to blend in with normal operations. Furthermore, it can function as a proxy or tunnel, potentially exposing the internal network to external threats or facilitating the exfiltration of sensitive data from internal devices. Our telemetry data indicates that this malware may be part of an APT campaign targeting high-value organizations, including high-tech companies, in Asia. Our team is currently investigating the scope and extent of these attack activities to better understand the threat landscape.

GhostContainer: the backdoor

The name of this file is App_Web_Container_1.dll. As the file name suggests, it serves as a “container”. It contains three key classes (Stub, App_Web_843e75cf5b63, and App_Web_8c9b251fb5b3) and one utility class (StrUtils). Once the file is loaded by the Exchange service, the Stub class is executed first. It acts as a C2 command parser, capable of executing shellcode, downloading files, running commands, and loading additional .NET byte code. One of the most notable features is that it creates an instance of the App_Web_843e75cf5b63, which serves as a loader for the web proxy class (App_Web_8c9b251fb5b3) via a virtual page injector.

Stub: C2 parser and dispatcher

At the beginning of execution, The Stub class attempts to bypass AMSI (Antimalware Scan Interface) and Windows Event Log. This is accomplished by overwriting specific addresses in amsi.dll and ntdll.dll, which allows evading AMSI scanning and Windows event logging.

Next, it retrieves the machine key from the ASP.NET configuration, specifically the validation key, and converts it to a byte array. The code used to generate the validation key was simply copied from the open-source project machinekeyfinder-aspx. The validation key is then hashed using SHA-256 to ensure it is 32 bytes long, and the resulting byte array is returned for use in AES encryption and decryption (to protect the data transferred between the attacker and the Exchange server).

The malware’s primary functionality is to receive requests from the attacker and parse them as follows:

• Receive the value of x-owa-urlpostdata from the attacker’s request data and then decode it as Base64.
• Utilize the AES key generated above to perform AES decryption on decoded data. The first 16 bytes of the decoded data are used as the initialization vector (IV).
• Decompress the decrypted data and dispatch operations based on the command ID (first byte).

To execute commands, Stub checks if the current user is a system account. If it is not, it attempts to impersonate a user by utilizing a token stored in the application domain’s data storage. This allows the application to perform actions under a different identity.

C2 commands and functionality:

Each time the command is executed, an XML-formatted response is generated, containing the execution result or return value. The value element in the XML starts with a hardcoded string /wEPDwUKLTcyODc4, and the same string is used in another open-source project, ExchangeCmdPy.py, to exploit the Exchange vulnerability CVE-2020-0688.
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTcyODc4[BASE64_ENCODED_RESULT]" />
By further comparing the code of GhostContainer with the ExchangeCmdPy.py open-source project, we observe a high degree of similarity in their entry function structures and keyword strings. This leads us to speculate that the code of the Stub class was developed based on the open-source project. We suspect that the vulnerability exploited in the Exchange attack may be related to CVE-2020-0688.

App_Web_843e75cf5b63: virtual page injector

This class is based on yet another open-source project, PageLoad_ghostfile.aspx, and it is designed to create ghost pages using classes like VirtualProvider. It contains a few classes which inherit from multiple system classes responsible for creating virtual ASPX pages and override some of their methods. It will create a virtual page using the two provided arguments: fakePageName and fakePath. The purpose of this approach is to run a .NET reflection loader (the fake page – see Appendix II) and bypass file checks. The loader is hardcoded into the program as a Base64-encoded .aspx source code.

This fake page is used to locate the web proxy class App_Web_8c9b251fb5b3 in the current domain and execute its static method AppWebInit. As soon as it is created, the attacker starts sending requests to it, which will then be received and parsed by App_Web_8c9b251fb5b3.

App_Web_8c9b251fb5b3: web proxy

App_Web_8c9b251fb5b3 is one core component in the GhostContainer sample, typically loaded indirectly through the fake page (App_Web_843e75cf5b63). This class includes web proxy, socket forwarding, and covert communication capabilities, serving as a typical example of a combined web proxy and tunneling module.

When an instance of this class is created, the static value utcDate is initialized with the current date and time. To identify the current version of the class, the fake page selects and invokes the one with the maximum utcDate value.

There are only two functions in this class. The AppWebInit() function serves as the actual entry point of the module, and it is dynamically invoked through reflection in the fake .aspx page. In the function StrTr, it implements a custom string translation mechanism before decoding Base64-encoded strings.

Again, we linked this algorithm to an open-source project, this time Neo-reGeorg. The function name StrTr and its code are identical. By comparing the code, it becomes clear that this class is a highly customized version of Neo-reGeorg.

The primary behavior of the module is focused on parsing requests the attacker sends to the fake web page. When receiving a request, it first inspects the header. Its further behavior may vary depending on the identified header:

• The Qprtfva header: identifies proxy forwarding requests.
• The Dzvvlnwkccf header: identifies socket communication requests.
• In other cases, the malware will respond with the string "<!-- 5lxBk9Zh7MDCyVAaxD8 -->".

If the header is Qprtfva, the malware establishes a web proxy by completing the following steps:

• Decode a Base64-encoded string to obtain the target URL.
• Clone the original request content (headers other than Qprtfva and body).
• Forward the request to the decoded target address.
• Return the target response content as the local response.

If the header is Dzvvlnwkccf, the malware establishes or manages a long-lived TCP tunnel connection between the internet and intranet. In order to identify and maintain different socket objects simultaneously, it defines a name for each socket object and then saves that name in pairs with the socket object in global storage. The name of the socket is contained in the first 22 bytes of the value of the header Dzvvlnwkccf. The exact activity is contained in the command section of the request, which starts from byte 23. The module accepts the following socket communication commands.

StrUtils: string and XML format processing class

StrUtils looks like a utility class for splitting and trimming strings, as well as splitting, extracting, and unescaping XML elements. However, only a few functions are currently referenced by the other three classes, namely the functions responsible for:

• Splitting the received data into multiple parts
• Trimming the closing character of the file path

We found no references to the XML unescaping functions in any class.

Infrastructure

The GhostContainer backdoor does not establish a connection to any C2 infrastructure. Instead, the attacker connects to the compromised server from the outside, and their control commands are hidden within normal Exchange web requests. As a result, we have not yet identified any relevant IP addresses or domains.

Victims

So far, we have identified two targets of this campaign: a key government agency and a high-tech company. Both organizations are located in the Asian region.

Attribution

The sample used in this APT attack does not share structural similarities with any known malware. It incorporates code from several open-source projects, which are publicly accessible and could be utilized by hackers or APT groups worldwide. As a result, attribution based on code similarity is not reliable. Based on our telemetry, the attack could not be correlated with other attack campaigns because the attackers did not expose any infrastructure.

Conclusions

Based on all the analysis conducted, it is evident that attackers are highly skilled in exploiting Exchange systems and leveraging various open-source projects related to infiltrating IIS and Exchange systems. They possess an in-depth understanding of how Exchange web services operate and show remarkable expertise in assembling and extending publicly available code to create and enhance sophisticated espionage tools. We believe this is a mature and highly professional team. We continue tracking their activity.

Indicators of compromise

01d98380dfb9211251c75c87ddb3c79c App_Web_Container_1.dll

securelist.com/ghostcontainer/…

Machine learning and neural nets can be pretty handy, and people continue to push the envelope of what they can do both in high end server farms as well as slower systems. At the extreme end of the spectrum is [ExploratoryStudios]’s Hermes Optimus Neural Net for a TI-84 Plus Silver Edition.

This neural net is setup as an autocorrect system that can take four character inputs and match them to a library of twelve words. That’s not a lot, but we’re talking about a device with 24 kB of RAM, so the little machine is doing its best. Perhaps more interesting than any practical output is the puzzle solving involved in getting this to work within the memory constraints.

The neural net “employs a feedforward neural network with a precisely calibrated 4-60-12 architecture and sigmoid activation functions.” This leads to an approximate 85% accuracy being able to identify and correct the given target words. We appreciate the readout of the net’s confidence as well which is something that seems to have gone out the window with many newer “AI” systems.

We’ve seen another TI-84 neural net for handwriting recognition, but is the current crop of AI still headed in the wrong direction?

youtube.com/embed/HwAXgKRZZow?…

hackaday.com/2025/07/17/a-neur…

L’operazione internazionale “Eastwood” rappresenta uno spartiacque nella lotta contro il cyberterrorismo. Per la prima volta, un’azione coordinata su scala mondiale ha inferto un colpo durissimo a una delle più attive cellule di hacktivisti filorussi: il collettivo “NoName057(16)”.

Un’operazione che non si è limitata a individuare i responsabili, ma ha decapitato l’infrastruttura criminale dietro migliaia di attacchi contro le democrazie europee.

Un’indagine globale contro il cyber terrorismo

Condotta dalla procura di Roma con il coordinamento della Direzione nazionale antimafia e antiterrorismo, “Eastwood” ha visto il coinvolgimento simultaneo delle autorità di Germania, Stati Uniti, Olanda, Svizzera, Svezia, Francia e Spagna, oltre al contributo fondamentale di Eurojust ed Europol. Al centro dell’indagine, cinque individui ritenuti membri attivi del gruppo “NoName057”, individuati grazie al lavoro sinergico del CNAIPIC (Centro nazionale anticrimine informatico per la protezione delle infrastrutture critiche) e dei reparti della Polizia Postale di sei regioni italiane.

NoName057 non è un semplice gruppo di cybercriminali: è una macchina bellica digitale al servizio della propaganda filorussa, nata nel marzo 2022 all’indomani dell’invasione dell’Ucraina. Il loro obiettivo è sabotare l’infrastruttura informatica delle nazioni europee considerate ostili alla Russia, colpire trasporti, sanità, telecomunicazioni, servizi finanziari, paralizzare governi e istituzioni.

Attraverso canali Telegram criptati, in particolare il famigerato “DDosia Project”, il gruppo reclutava simpatizzanti e coordinava gli attacchi. I membri aderivano scaricando un software dedicato, contribuendo con la potenza di calcolo dei propri dispositivi a sovraccaricare i server di enti pubblici e privati tramite attacchi DDoS (Distributed Denial of Service).

Le indagini hanno smantellato la complessa rete tecnologica che faceva capo a server localizzati principalmente in Russia, con centinaia di nodi intermedi utilizzati per offuscare l’origine dei segnali. Più di 600 server sono stati sequestrati o disattivati. Non solo sono stati emessi cinque mandati di arresto internazionali nei confronti di cittadini russi, ma due di questi sono considerati i vertici operativi del collettivo.

L’accusa è gravissima: associazione con finalità di terrorismo internazionale ed eversione dell’ordine democratico, ex art. 270-bis del codice penale italiano.

Cyberterrorismo e cybercriminalità: linee sottili, frontiere mobili

Il caso NoName057 evidenzia come la linea di demarcazione tra cybercriminalità e cyberterrorismo si sta progressivamente assottigliando.

In teoria, la distinzione esiste. I cybercriminali sono mossi dal profitto: furti di dati, truffe online, estorsioni ransomware. I cyberterroristi agiscono per motivazioni ideologiche o politiche: vogliono terrorizzare, destabilizzare, creare il caos per fini geopolitici o ideologici.

Nella realtà operativa, tuttavia, i confini sono sfumati. Gruppi nati con finalità economiche possono politicizzarsi, cavalcando tensioni internazionali, così come organizzazioni terroristiche possono ricorrere a tecniche tipiche della cybercriminalità – come il ransomware – per autofinanziarsi.

L’emergere del cyberwarfare, delle guerre ibride, della propaganda digitale alimentata da attori statali rende il quadro ancora più opaco. Non esistono più compartimenti stagni. L’hacker attivista, il criminale digitale e il terrorista online spesso si confondono, si sovrappongono, si scambiano strumenti e know-how.

Un ulteriore aspetto critico è che spesso risulta estremamente complesso stabilire se dietro un attacco vi sia la mano di un altro Stato. In questi casi si entra nel campo del cyberwarfare, non del terrorismo classico, e l’attribuzione diventa un’operazione molto difficile. Oltre alla digital forensic serve una sofisticata attività di intelligence, fatta di analisi incrociate, raccolta di fonti e monitoraggi strategici, senza la quale non è possibile distinguere tra l’azione di un gruppo terroristico e quella di attori statali o statalmente sponsorizzati.

A complicare ulteriormente il quadro vi è un’altra criticità operativa. Anche quando gli autori degli attacchi vengono identificati, le indagini internazionali si scontrano con la difficoltà di procedere a una loro estradizione e a un processo in presenza. Non di rado i cyberterroristi si trovano o si rifugiano in Paesi che rifiutano la cooperazione giudiziaria o addirittura li proteggono per ragioni geopolitiche, rendendo inefficaci i provvedimenti giudiziari emessi in ambito europeo o internazionale.

L’evoluzione del terrorismo nell’era digitale

Il cyberterrorismo non è che l’ultima evoluzione della minaccia terroristica tradizionale. Il tratto distintivo rispetto alla semplice criminalità informatica non è lo strumento utilizzato, ma il fine perseguito: panico, destabilizzazione politica, sovversione dell’ordine democratico.

La rivoluzione informatica ha offerto ai gruppi terroristici vantaggi enormi: possibilità di agire a distanza, mantenere l’anonimato, cancellare le tracce, coordinarsi su scala globale con costi minimi.

Nell’ecosistema hacker esistono categorie ben distinte:

• hacktivisti politici, che agiscono per protesta contro governi o multinazionali;
• terroristi informatici, che mettono le proprie competenze al servizio di ideologie radicali;
• cybermercenari, spesso ex membri di servizi segreti o accademici, pronti a vendere le proprie competenze al miglior offerente, sia esso un gruppo criminale o un’organizzazione terroristica.

Non mancano gli esempi di propaganda online, canali criptati, newsgroup estremisti, vere e proprie piattaforme digitali dedicate al reclutamento e al finanziamento occulto. Internet consente ai gruppi terroristici di propagandare le proprie idee con costi irrisori, raggiungendo platee planetarie, e di bypassare i tradizionali sistemi di controllo investigativo.

Cyberterrorismo: il fronte normativo

La guerra al terrorismo informatico si combatte non solo sui server, ma anche nei tribunali. In Italia, la normativa si è evoluta per affrontare il nuovo scenario.

La legge n.547 del 1993 ha introdotto per la prima volta i reati informatici.

La legge 48 del 2008, che ha ratificato la Convenzione di Budapest sulla cyber criminalità, ha armonizzato il quadro normativo con le direttive europee.

• La legge n.438 del 2001 ha rafforzato la disciplina contro il terrorismo internazionale, riformulando l’art. 270-bis c.p.
• Ulteriori aggravanti sono state introdotte nel 2015 con la legge n.43, che punisce più severamente l’addestramento terroristico via internet e l’istigazione tramite strumenti telematici.

In particolare, l’art. 270-quinquies punisce chi diffonde tecniche di addestramento terroristico in rete, mentre l’art. 414 prevede pene più severe per l’apologia e l’istigazione se veicolate attraverso il web.

Una minaccia in continua mutazione

L’operazione “Eastwood” conferma che il cyberterrorismo non è un fenomeno marginale, ma una minaccia concreta e in espansione. Non bastano più firewall e antivirus. Serve una risposta sistemica, che integri tecnologia, intelligence, cooperazione internazionale e un robusto impianto giuridico.

La guerra informatica si combatte in silenzio, tra linee di codice e server anonimi, ma ha effetti devastanti sul mondo reale. E quando a colpire non sono solo criminali, ma organizzazioni motivate da obiettivi politici e geopolitici, il rischio diventa sistemico.

Nel cyberspazio, il terrorismo ha trovato un nuovo campo di battaglia. E il primo passo per contrastarlo è riconoscerne le forme, comprenderne le logiche, rafforzare gli strumenti giuridici e investigativi.

L'articolo Dentro l’Operazione “Eastwood”: tra le ombre del cyberterrorismo e la propaganda proviene da il blog della sicurezza informatica.

Alleen met voldoende ondersteuningsverklaringen (OSV) zetten we de Piratenpartij op het stemformulier. Een OSV heet ook wel een H4-formulier. De periode waarin je een OSV-formulier kunt invullen en ondertekenen op het gemeentehuis is van maandag 1 tot en met vrijdag 12 september. In dit formulier kun je aangeven dat je een ondersteuningsverklaring (OSV) wilt tekenen […]

Het bericht Help mee met ondersteuningsverklaringen verscheen eerst op Piratenpartij.

Remember when President Donald Trump derided the news media and flatly declared that “what they do is illegal” during a speech at the Department of Justice?

Turns out, he meant it.

The Trump administration is increasingly accusing journalists of inciting violence or lawlessness — and possibly breaking the law — by simply reporting the news. It’s now made these claims at least three times, all related to reporting on the government’s immigration crackdown.

It’s bad enough that the administration wants to jail journalists for refusing to reveal their sources or for obtaining and publishing classified information. But these recent accusations seem to raise a third possibility: prosecuting journalists for incitement, the crime of instigating others to break the law.

Unsurprisingly, none of the reporting that the government has attacked comes anywhere close to the legal definition of incitement under the First Amendment. But even baseless accusations aren’t harmless. They can chill reporting and leave the public less informed.

A trio of troubling threats

The most recent example of the Trump administration accusing reporters of incitement for straightforward journalism is its attack on CNN for reporting on ICEBlock, an app that alerts users when Immigration and Customs Enforcement agents are nearby.

In response to a question from The Daily Wire suggesting that CNN’s report was “promoting” ICEBlock, press secretary Karoline Leavitt directly accused CNN of inciting “further violence against our ICE officers.”

Leavitt admitted that she hadn’t actually watched the CNN segment before she made this accusation. If she had, she would have seen that nothing in CNN’s report comes even remotely close to encouraging violence against ICE officers.

Rather, CNN spoke to ICEBlock’s creator, who described how the app works and, crucially, how it could allow people to avoid encountering ICE officers, who have been known to violently attack people and arrest U.S. citizens. The CNN reporter also quoted a warning from the app that said it’s not to be used to interfere with law enforcement or incite violence.

Yet the Department of Justice is reportedly considering prosecuting CNN, and Secretary of Homeland Security Kristi Noem flatly declared, “What they’re doing is illegal.”

Similarly, Federal Communications Commission Chair Brendan Carr strongly implied to Fox News that radio station KCBS had encouraged violence against ICE agents by reporting on an immigration raid in east San Jose earlier this year. KCBS is now the subject of an unconstitutional investigation by the FCC for its report, which the station appears to have removed from its website.

When discussing the KCBS broadcast on Fox, Carr made sure to note both that the area of the city being raided was known for “violent gang activity,” and that the broadcast was made “against the backdrop of Democratic leaders in Congress saying it’s time for people to take fights to the street against Trump’s agenda.” What Carr didn’t mention is that there was no evidence of any violence against ICE agents during or after the raid.

Finally, the White House recently rebuked The New Yorker for its reporting on the Trump administration’s targeting of Democratic lawmakers and their staff who’ve opposed the immigration crackdown, like Rep. LaMonica McIver, who was charged with assaulting a federal officer outside of an immigration detention facility in a case that she’s called “political intimidation.”

In response to the New Yorker’s reporting about these and other incidents, a White House spokesperson said, “It’s alarming Democrats think they can obstruct federal law enforcement, assault ICE agents, or physically push law enforcement officers while charging a cabinet secretary, without consequence—it’s even more alarming that the New Yorker is encouraging this lawless behavior.”

Again, nothing in the New Yorker’s report “encouraged” anything. The magazine relied on regular journalistic techniques for its reporting, such as interviewing sources, and reviewing videos and past reporting to report straightforwardly on what’s happened to Democrats detained or arrested while opposing the Trump administration’s immigration policies.

None of this is incitement

Not only does none of this reporting actually encourage anyone to do anything illegal, it also fails to meet the legal standards for “incitement,” which the First Amendment sets incredibly high.

Under the First Amendment, a person can be found guilty of incitement only if they advocate for imminent lawless action and their speech is likely to incite or produce such action. It also requires intent to induce another to break the law. To protect against governmental overreach and censorship, general advocacy — even of violence or another crime—can’t be criminalized.

Writing a news story about someone else’s conduct, even if their actions are illegal, obviously doesn’t meet this standard. Reporting on something isn’t an endorsement of it, let alone advocacy for others to immediately break the law. Even editorials or op-eds praising illegal conduct would fall under the category of general advocacy, protected by the First Amendment.

But the officials slinging these accusations against the press don’t care as much about the law as they do about chilling reporting. It’s not surprising, then, that they’ve focused on journalism about ICE.

As the public’s approval for Trump’s handling of immigration drops, the government knows that the more people learn about the cruel, illegal, and deadly tactics it’s using to deport their neighbors, the more blowback it will face. It’s counting on its spurious accusations to silence reporting. The only antidote? For journalists to keep reporting.

freedom.press/issues/no-report…