Metalized Mylar “space blankets” are sold as a survivalist’s accessory, primarily due to their propensity for reflecting heat. They’re pretty cheap, and [HamJazz] has performed some experiments on their RF properties. Do they reflect radio waves as well as they reflect heat? As it turns out, yes they do.

Any antenna system that’s more than a simple radiator relies on using conductive components as reflectors. These can either be antenna elements, or the surrounding ground acting as an approximation to a conductor. Radio amateurs will often use wires laid on the ground or buried within it to improve its RF conductivity, and it’s in this function that he’s using the Mylar sheet. Connection to the metalized layer is made with a magnet and some aluminium tape, and the sheet is strung up from a line at an angle. It’s a solution for higher frequencies only due to the restricted size of the thing, but it’s certainly interesting enough to merit further experimentation.

As you can see in the video below, his results are derived in a rough and ready manner with a field strength meter. But they certainly show a much stronger field on one side resulting from the Mylar, and also in an antenna that tunes well. We would be interested to conduct a received signal strength test over a much greater distance rather than a high-level field strength test so close to the antenna, but it’s interesting to have a use for a space blanket that’s more than just keeping the sun away from your tent at a hacker camp. Perhaps it could even form a parabolic antenna.

youtube.com/embed/X1sDYBe5wY0?…

Thanks [Fl.xy] for the tip!

hackaday.com/2025/05/15/mylar-…

Last time we talked about how the original PC has a limit of 640 kB for your programs and 1 MB in total. But of course those restrictions chafed. People demanded more memory, and there were workarounds to provide it.

However, the workarounds were made to primarily work with the old 8088 CPU. Expanded memory (EMS) swapped pages of memory into page frames that lived above the 640 kB line (but below 1 MB). The system would work with newer CPUs, but those newer CPUs could already address more memory. That led to new standards, workarounds, and even a classic hack.

XMS

If you had an 80286 or above, you might be better off using extended memory (XMS). This took advantage of the fact that the CPU could address more memory. You didn’t need a special board to load 4MB of RAM into an 80286-based PC. You just couldn’t get to with MSDOS. In particular, the memory above 1 MB was — in theory — inaccessible to real-mode programs like MSDOS.

Well, that’s not strictly true in two cases. One, you’ll see in a minute. The other case is because of the overlapping memory segments on an 8088, or in real mode on later processors. Address FFFF:000F was the top of the 1 MB range.

PCs with more than 20 bits of address space ran into problems since some programs “knew” that memory access above that would wrap around. That is FFFF:0010, on an 8088, is the same as 0000:0000. They would block A20, the 21st address bit, by default. However, you could turn that block off in software, although exactly how that worked varied by the type of motherboard — yet another complication.

XMS allowed MSDOS programs to allocate and free blocks of memory that were above the 1 MB line and map them into that special area above FFFF:0010, the so-called high memory area (HMA).
The 640 kB user area, 384 kB system area, and almost 64 kB of HMA in a PC (80286 or above)
Because of its transient nature, XMS wasn’t very useful for code, but it was a way to store data. If you weren’t using it, you could load some TSRs into the HMA to prevent taking memory from MSDOS.

Protected Mode Hacks

There is another way to access memory above the 1 MB line: protected mode. In protected mode, you still have a segment and an offset, but the segment is just an index into a table that tells you where the segment is and how big it is. The offset is just an offset into the segment. So by setting up the segment table, you can access any memory you like. You can even set up a segment that starts at zero and is as big as all the memory you can have.
A protected mode segment table entry
You can use segments like that in a lot of different ways, but many modern operating systems do set them up very simply. All segments start at address 0 and then go up to the top of user memory. Modern processors, 80386s and up, have a page table mechanism that lets you do many things that segments were meant to do in a more efficient way.

However, MS-DOS can’t deal with any of that directly. There were many schemes that would switch to protected mode to deal with upper memory using EMS or XMS and then switch back to real mode.

Unfortunately, switching back to real mode was expensive because, typically, you had to set a bit in non-volatile memory and reboot the computer! On boot, the BIOS would notice that you weren’t really rebooting and put you back where you were in real mode. Quite a kludge!

There was a better way to run MSDOS in protected mode called Virtual86 mode. However, that was complex to manage and required many instructions to run in an emulated mode, which wasn’t great for performance. It did, however, avoid the real mode switch penalty as you tried to access other memory.

Unreal Mode

In true hacker fashion, several of us figured out something that later became known as Unreal Mode. In the CPU documentation, they caution you that before switching to real mode, you need to set all the segment tables to reflect what a segment in real mode looks like. Obviously, you have to think, “What if I don’t?”

Well, if you don’t, then your segments can be as big as you like. Turns out, apparently, some people knew about this even though it was undocumented and perhaps under a non-disclosure agreement. [Michal Necasek] has a great history about the people who independently discovered it, or at least, the ones who talked about it publicly.

The method was doomed, though, because of Windows. Windows ran in protected mode and did its own messing with the segment registers. If you wanted to play with that, you needed a different scheme, but that’s another story.

Modern Times

These days, we don’t even use video cards with a paltry 1 MB or even 100 MB of memory! Your PC can adroitly handle tremendous amounts of memory. I’m writing this on a machine with 64 GB of physical memory. Even my smallest laptop has 8 GB and at least one of the bigger ones has more.

Then there’s virtual memory, and if you have solid state disk drives, that’s probably faster than the old PC’s memory, even though today it is considered slow.

Modern memory systems almost don’t resemble these old systems even though we abstract them to pretend they do. Your processor really runs out of cache memory. The memory system probably manages several levels of cache. It fills the cache from the actual RAM and fills that from the paging device. Each program can have a totally different view of physical memory with its own idea of what physical memory is at any given address. It is a lot to keep track of.

Times change. EMS, XMS, and Unreal mode seemed perfectly normal in their day. It makes you wonder what things we take for granted today will be considered backward and antiquated in the coming decades.

hackaday.com/2025/05/15/rememb…

Un nuovo nome sta guadagnando rapidamente visibilità nei meandri del cybercrime underground: Machine1337, un attore malevolo attivo sul noto forum XSS[.]is, dove ha pubblicato una serie impressionante di presunte violazioni di dati ai danni di colossi tecnologici e piattaforme popolari, tra cui Microsoft, TikTok, Huawei, Steam, Temu, 888.es e altri ancora.

Il post shock: 4 milioni di account Office 365

Tra le inserzioni più eclatanti figura una pubblicazione che afferma di essere in possesso di 4 milioni di credenziali Microsoft Office 365 e Microsoft 365, vendute al prezzo di 5000 dollari. Nel post viene anche fornito un link per scaricare un campione da 1.000 record, una prassi comune nei mercati underground per “dimostrare” la genuinità del materiale in vendita. L’attore fornisce un contatto Telegram diretto e rimanda al suo canale ufficiale @Machine******. Il post è accompagnato da un’immagine che mostra il logo di Microsoft e frasi promozionali come:

🔥 DAILY LIVE SALES 🔥
📌 Premium Real-Time Phone Numbers for Sale
good luck! 🚀

Una retorica che mescola ironia, branding e un tono apparentemente professionale, tipico degli attori che cercano di affermarsi come “venditori affidabili” nel dark web.

Una raffica di violazioni: da TikTok a Huawei

Nelle ore successive alla pubblicazione dell’annuncio Microsoft, Machine1337 ha pubblicato altri post che dichiarano la compromissione di:

• Huawei – 129 milioni di record
• TikTok – 105 milioni di record
• Steam – 89 milioni di account, postato più volte con aggiornamenti
• Temu – 17 milioni di record
• 888.es – 13 milioni di record

Queste presunte violazioni sembrano essere parte di un’offensiva coordinata per dimostrare la “potenza” del threat actor e attrarre acquirenti nei suoi canali Telegram.

Identità e contatti: l’ecosistema Telegram

Machine1337 si presenta come un attore organizzato. Sul suo canale Telegram, pubblica anche un avviso importante per evitare impersonificazioni:

“Il mio unico contatto ufficiale è: @Energy************
Canale ufficiale: @Machine************
Fate attenzione ai fake. Non sono responsabile per problemi con impostori.”

In un altro messaggio consiglia di visitare un altro canale afferente ad un’altra community underground dove, secondo le sue parole, “real shit goes down there.”

Possibili implicazioni e autenticità

Sebbene la quantità di dati rivendicati sia impressionante, non è possibile confermare al 100% l’autenticità di ogni dump pubblicato, almeno fino a quando non emergono conferme da parte delle aziende coinvolte o da analisi indipendenti OSINT/DFIR.

Tuttavia, la mole e la frequenza degli annunci di Machine1337 suggeriscono o una reale disponibilità di fonti compromesse (es. broker di accesso iniziale, botnet di infostealer) o una manovra di disinformazione e marketing aggressivo per ottenere fondi da utenti del forum XSS.

Il 13 maggio è stato ufficialmente creato il canale Telegram Machine1337, punto centrale della comunicazione del threat actor omonimo. Nel messaggio di benvenuto, l’utente si presenta come Red Teamer, Penetration Tester e Offensive Security Researcher, specificando di essere attualmente impegnato nello studio dell’API Testing e dell’analisi di malware. Il tono è quello di un professionista della sicurezza informatica che si muove però su un doppio binario: da un lato competenze legittime, dall’altro attività chiaramente legate al cybercrime.

Nel canale vengono anche menzionate l’intenzione di collaborare a progetti open source e una sezione “Visitor Count”, in cui probabilmente si monitora l’attività degli utenti. Il canale stesso è legato a un gruppo di discussione (accessibile solo tramite richiesta) e offre una sottoscrizione a pagamento, presumibilmente per accedere ai contenuti premium o ai database completi.

La presenza su Telegram conferma ancora una volta come questo strumento sia uno degli hub preferiti dai threat actor per diffondere i propri contenuti e stabilire un canale diretto con potenziali acquirenti.

Conclusione

Machine1337 si inserisce in una nuova generazione di threat actors che non solo monetizzano i dati rubati, ma costruiscono vere e proprie strategie di branding e marketing per affermarsi nei circuiti del cybercrime.

Con vendite quotidiane pubblicizzate, dump multipli e una presenza su Telegram molto attiva, sarà fondamentale tenere sotto osservazione questa figura nei prossimi mesi.

L'articolo Machine1337: Il threat actor che rivendica l’accesso a 4 milioni di account Microsoft 365 proviene da il blog della sicurezza informatica.

Launching rockets into the sky can be a thrill, but why not make the fall just as interesting? That is exactly what [I Build Stuff] thought when attempting to build a self-landing payload. The idea is to release a can sized “satellite” from a rocket at an altitude upwards of 1 km, which will then fly back down to the launch point.

The device itself is a first-person view (FPV) drone running the popular Betaflight firmware. With arms that swing out with some of the smallest brushless motors you’ve ever seen (albeit not the smallest motor), the satellite is surprisingly capable. Unfortunately due to concerns over the legality of an autonomous payload, the drone is human controlled on the descent.

Using collaborated efforts, a successful launch was flown with the satellite making it to the ground unharmed, at least for the most part. While the device did show capabilities of being able to fly back, human error led to a manual recovery. Of course, this is far from the only rocketry hack we have seen here at Hackaday. If you are more into making the flight itself interesting, here is a record breaking one from USC students.

youtube.com/embed/7yVFZn87TkY?…

Thank you [Hari Wiguna] for the great tip!

hackaday.com/2025/05/15/fpv-dr…

It was such an innocent purchase, a slightly grubby and scuffed grey plastic box with the word “P O L A R O I D” intriguingly printed along its top edge. For a little more than a tenner it was mine, and I’d just bought one of Edwin Land’s instant cameras. The film packs it takes are now a decade out of production, but my Polaroid 104 with its angular 1960s styling and vintage bellows mechanism has all the retro-camera-hacking appeal I need. Straight away I 3D printed an adapter and new back allowing me to use 120 roll film in it, convinced I’d discover in myself a medium format photographic genius.

But who wouldn’t become fascinated with the film it should have had when faced with such a camera? I have form on this front after all, because a similar chance purchase of a defunct-format movie camera a few years ago led me into re-creating its no-longer-manufactured cartridges. I had to know more, both about the instant photos it would have taken, and those film packs. How did they work?

A Print, Straight From The Camera

An instant photograph reveals itself. Akos Burg, courtesy of One Instant.
In conventional black-and-white photography the film is exposed to the image, and its chemistry is changed by the light where it hits the emulsion. This latent image is rolled up with all the others in the film, and later revealed in the developing process. The chemicals cause silver particles to precipitate, and the resulting image is called a negative because the silver particles make it darkest where the most light hit it. Positive prints are made by exposing a fresh piece of film or photo paper through this negative, and in turn developing it. My Polaroid camera performed this process all-in-one, and I was surprised to find that behind what must have been an immense R&D effort to perfect the recipe, just how simple the underlying process was.

My dad had a Polaroid pack film camera back in the 1970s, a big plastic affair that he used to take pictures of the things he was working on. Pack film cameras weren’t like the motorised Polaroid cameras of today with their all-in-one prints, instead they had a paper tab that you pulled to release the print, and a peel-apart system where after a time to develop, you separated the negative from the print. I remember as a youngster watching this process with fascination as the image slowly appeared on the paper, and being warned not to touch the still-wet print or negative when it was revealed. What I was looking at wasn’t a negative printing process as described in the previous paragraph but something else, one in which the unexposed silver halide compounds which make the final image are diffused onto the paper from the less-exposed areas of the negative, forming a positive image of their own when a reducing agent precipitates out their silver crystals. Understanding the subtleties of this process required a journey back to the US Patent Office in the middle of the 20th century.

It’s All In The Diffusion

The illustration from Edwin Land’s patent US2647056.
It’s in US2647056 that we find a comprehensive description of the process, and the first surprise is that the emulsion on the negative is the same as on a contemporary panchromatic black-and-white film. The developer and fixer for this emulsion are also conventional, and are contained in a gel placed in a pouch at the head of the photograph. When the exposed film is pulled out of the camera it passes through a set of rollers that rupture this pouch, and then spread the gel in a thin layer between the negative and the coated paper. This gel has two functions: it develops the negative, but over a longer period it provides a wet medium for those unexposed silver halides to diffuse through into the now-also-wet coating of the paper which will become the print. This coating contains a reducing agent, in this case a metalic sulphide, which over a further period precipitates out the silver that forms the final visible image. This is what gives Polaroid photographs their trademark slow reveal as the chemistry does its job.

I’ve just described the black and white process; the colour version uses the same diffusion mechanism but with colour emulsions and dye couplers in place of the black-and-white chemistry. Meanwhile modern one-piece instant processes from Polaroid and Fuji have addressed the problem of making the image visible from the other side of the paper, removing the need for a peel-apart negative step.

Given that the mechanism and chemistry are seemingly so simple, one might ask why we can no longer buy two-piece Polaroid pack or roll film except for limited quantities of hand-made packs from One Instant. The answer lies in the complexity of the composition, for while it’s easy to understand how it works, it remains difficult to replicate the results Polaroid managed through a huge amount of research and development over many decades. Even the Impossible Project, current holders of the Polaroid brand, faced a significant effort to completely replicate the original Polaroid versions of their products when they brought the last remaining Polaroid factory to production back in 2010 using the original Polaroid machinery. So despite it retaining a fascination among photographers, it’s unlikely that we’ll see peel-apart film for Polaroid cameras return to volume production given the small size of the potential market.

Hacking A Sixty Year Old Camera

Five minutes with a Vernier caliper and openSCAD, and this is probably the closest I’ll get to a pack film of my own.
So having understood how peel-apart pack film works and discovered what is available here in 2025, what remains for the camera hacker with a Land camera? Perhaps the simplest idea would be to buy one of those One Instant packs, and use it as intended. But we’re hackers, so of course you will want to print that 120 conversion kit I mentioned, or find an old pack film cartridge and stick a sheet of photographic paper or even a Fuji Instax sheet in it. You’ll have to retreat to the darkroom and develop the film or run the Instax sheet through an Instax camera to see your images, but it’s a way to enjoy some retro photographic fun.

Further than that, would it be possible to load Polaroid 600 or i-Type sheets into a pack film cartridge and somehow give them paper tabs to pull through those rollers and develop them? Possibly, but all your images would be back to front. Sadly, rear-exposing Instax Wide sheets wouldn’t work either because their developer pod lies along their long side. If you were to manage loading a modern instant film sheet into a cartridge, you’d then have to master the intricate paper folding arrangement required to ensure the paper tabs for each photograph followed each other in turn. I have to admit that I’ve become fascinated by this in considering my Polaroid camera. Finally, could you make your own film? I would of course say no, but incredibly there are people who have achieved results doing just that.

My Polaroid 104 remains an interesting photographic toy, one I’ll probably try a One Instant pack in, and otherwise continue with the 3D printed back and shoot the occasional 120 roll film. If you have one too, you might find my 3D printed AAA battery adapter useful. Meanwhile it’s the cheap model without the nice rangefinder so it’ll never be worth much, so I might as well just enjoy it for what it is. And now I know a little bit more about his invention, admire Edwin Land for making it happen.

Any of you out there hacking on Polaroids?

hackaday.com/2025/05/15/fallin…

Trends

Relative stability from quarter to quarter. The percentage of ICS computers on which malicious objects were blocked remained unchanged from Q4 2024 at 21.9%. Over the last three quarters, the value has ranged from 22.0% to 21.9%.

The quarterly figures are decreasing from year to year. Since Q2 2023, the percentage of ICS computers on which malicious objects were blocked has been lower than the indicator of the same quarter of the previous year. Compared to Q1 2024, the figure decreased by 2.5 pp.

Percentage of ICS computers on which malicious objects were blocked, Q1 2022–Q1 2025

In January–March 2025, the figures were the lowest compared to the same months of the previous four years.

Percentage of ICS computers on which malicious objects were blocked, Jan 2021–Mar 2025

The biometrics sector continues to lead the selected industries / OT infrastructure types. This is the only OT infrastructure type where the percentage of ICS computers on which malicious objects were blocked increased during the quarter.

Threat levels in different regions still vary. In Q1 2025, the percentage of affected ICS computers ranged from 10.7% in Northern Europe to 29.6% in Africa. In eight out of 13 regions, the figures ranged from 19.0% to 25.0%.

The percentage of ICS computers on which denylisted internet resources were blocked continues to decrease. It reached its lowest level since the beginning of 2022. In the first three months of 2025, the corresponding figures were lower than those in January–March of the previous three years.

Percentage of ICS computers on which denylisted internet resources were blocked, Jan 2022–Mar 2025

Changes in the percentage of ICS computers on which initial-infection malware was blocked lead to changes in the percentage of next-stage malware. In Q1 2025, the percentage of ICS computers on which various types of malware spread via the internet and email were blocked increased for the first time since the beginning of 2023.

The internet is the primary source of threats to ICS computers. The main categories of threats from the internet are denylisted internet resources, malicious scripts and phishing pages.

The main categories of threats spreading via email are malicious documents, spyware, malicious scripts and phishing pages.

The percentage of ICS computers on which malicious scripts and phishing pages, and malicious documents were blocked increased in Q1 2025. In January–March, the monthly values in these two categories of threats were higher than in the same months of 2024.

Percentage of ICS computers on which malicious objects were blocked, Jan 2022–Mar 2025

The leading category of malware used for initial infection of ICS computers (see below) is malicious scripts and phishing pages.

Most malicious scripts and phishing pages act as droppers or loaders of next-stage malware (spyware, crypto miners and ransomware). The strong correlation between the values for malicious scripts and phishing pages, and spyware is clearly visible in the graph below.

Percentage of ICS computers on which malicious objects were blocked, Jan 2023–Mar 2025

Similar to malicious scripts and phishing pages, the percentage of ICS computers on which spyware was blocked was higher in the first three months of 2025 than in the same months of 2024.

Percentage of ICS computers on which spyware was blocked, Jan 2022–Mar 2025

The percentage of ICS computers on which miners (web miners and miners in the form of executable files for Windows) were blocked in Q1 2025 also increased.

Statistics across all threats

In Q1 2025, the percentage of ICS computers on which malicious objects were blocked remained at the same level as in the previous quarter: 21.9%.

Percentage of ICS computers on which malicious objects were blocked, Q1 2022–Q1 2025

Compared to Q1 2024, the percentage of ICS computers on which malicious objects were blocked decreased by 2.5 pp. However, it increased from January to March of 2025 when it reached its highest value in the quarter.

Percentage of ICS computers on which malicious objects were blocked, Jan 2023–Mar 2025

Regionally, the percentage of ICS computers on which malicious objects were blocked ranged from 10.7% in Northern Europe to 29.6% in Africa.

Regions ranked by percentage of ICS computers on which malicious objects were blocked, Q1 2025

In six of the 13 regions surveyed in this report, the figures increased from the previous quarter, with the largest change occurring in Russia.

Changes in percentage of ICS computers on which malicious objects were blocked,
Q1 2025

Selected industries

The biometrics sector led the ranking of the industries and OT infrastructures surveyed in this report in terms of the percentage of ICS computers on which malicious objects were blocked.

Ranking of industries and OT infrastructures by percentage of ICS computers on which malicious objects were blocked, Q1 2025

The biometrics sector was also the only OT infrastructure type where the percentage of ICS computers on which malicious objects were blocked increased slightly. Despite this, the long-term trend is clearly downward.

Percentage of ICS computers on which malicious objects were blocked in selected industries

Diversity of detected malicious objects

In Q1 2025, Kaspersky security solutions blocked malware from 11,679 different malware families in various categories on industrial automation systems.

Percentage of ICS computers on which the activity of malicious objects from various categories was blocked

The largest proportional increase in Q1 2025 was in the percentage of ICS computers on which web miners (1.4 times more than in the previous quarter) and malicious documents (1.1 times more) were blocked.

Main threat sources

Depending on the threat detection and blocking scenario, it is not always possible to reliably identify the source. The circumstantial evidence for a specific source can be the blocked threat’s type (category).

The internet (visiting malicious or compromised internet resources; malicious content distributed via messengers; cloud data storage and processing services and CDNs), email clients (phishing emails), and removable storage devices remain the primary sources of threats to computers in an organization’s OT infrastructure.

In Q1 2025, the percentage of ICS computers on which threats from the internet and email clients were blocked increased for the first time since the end of 2023.

Percentage of ICS computers on which malicious objects from various sources were blocked

The rates for all threat sources varied across the monitored regions.

• The percentage of ICS computers on which threats from the internet were blocked ranged from 5.2% in Northern Europe to 12.8% in Africa.
• The percentage of ICS computers on which threats from email clients were blocked ranged from 0.88% in Russia to 6.8% in Southern Europe.
• The percentage of ICS computers on which threats from removable media were blocked ranged from 0.06% in Australia and New Zealand to 2.4% in Africa.

Threat categories

Typical attacks blocked within an OT network are a multi-stage process, where each subsequent step by the attackers is aimed at increasing privileges and gaining access to other systems by exploiting security flaws in industrial enterprises, including OT infrastructures.

It is worth noting that during the attack, intruders often repeat the same steps (TTP), especially when they use malicious scripts and established communication channels with the management and control infrastructure (C2) to move laterally within the network and advance the attack.

Malicious objects used for initial infection

In Q1 2025, the percentage of ICS computers on which denylisted internet resources were blocked decreased to its lowest value since the beginning of 2022.

Percentage of ICS computers on which denylisted internet resources were blocked, Q1 2022–Q1 2025

The decline in the percentage of denylisted internet resources since November 2024 was likely influenced not only by proactive threat mitigation at various levels, but also by techniques used by attackers to circumvent the blocking mechanisms based on the resource’s reputation, thus redistributing the protection burden to other detection technologies.

A detected malicious web resource may not always be added to a denylist because attackers are increasingly using legitimate internet resources and services such as content delivery network (CDN) platforms, messengers, and cloud storage. These services allow malicious code to be distributed through unique links to unique content, making it difficult to use reputation-based blocking tactics. We strongly recommend that industrial organizations implement policy-based blocking of such services, at least for OT networks where the need for such services is extremely rare for objective reasons.

The percentage of ICS computers on which malicious documents as well as malicious scripts and phishing pages were blocked increased slightly, to 1.85% (by 0.14 pp) and 7.16% (by 0.05 pp) respectively.

Next-stage malware

Malicious objects used to initially infect computers deliver next-stage malware – spyware, ransomware, and miners – to victims’ computers. As a rule, the higher the percentage of ICS computers on which the initial infection malware is blocked, the higher the percentage for next-stage malware.

In Q1 2025, the percentage of ICS computers on which spyware and ransomware were blocked decreased, reaching 4.20% (by losing 0.1 pp) and 0.16% (by losing 0.05 pp) respectively. Conversely, the indicator for miners increased. The percentage of ICS computers on which miners in the form of executable files for Windows and web miners were blocked increased to 0.78% (by 0.08 pp) and 0.53% (by 0.14 pp), respectively. The latter indicator reached its highest value since Q3 2023.

Percentage of ICS computers on which web miners were blocked, Q1 2022–Q1 2025

Self-propagating malware

Self-propagating malware (worms and viruses) is a category unto itself. Worms and virus-infected files were originally used for initial infection, but as botnet functionality evolved, they took on next-stage characteristics.

To spread across ICS networks, viruses and worms rely on removable media, network folders, infected files including backups, and network attacks on outdated software, such as Radmin2.

In Q1 2025, the percentage of ICS computers on which worms and viruses were blocked decreased to 1.31% (by losing 0.06 pp) and 1.53% (by losing 0.08 pp), respectively.

AutoCAD malware

AutoCAD malware is typically a low-level threat, coming last in the malware category rankings in terms of the percentage of ICS computers on which it was blocked.

In Q1 2025, the percentage of ICS computers on which AutoCAD malware was blocked continued to decrease (by losing 0.04 pp) and reached 0.034%.

You can find more information on industrial threats in the full version of the report.

securelist.com/industrial-thre…

La casa di moda Dior è stata colpita da una fuga di dati personali dei clienti che ha colpito gli utenti dei negozi online di moda e accessori del marchio. I rappresentanti dell’azienda hanno confermato che si è trattato di un caso di accesso non autorizzato a una parte delle informazioni conservate nel database di Dior Fashion and Accessories. Sebbene l’incidente sia ancora oggetto di indagine, è già noto che gli utenti provenienti dalla Corea del Sud e dalla Cina sono stati colpiti dall’attacco.

Secondo i rappresentanti di Dior, il 7 maggio 2025 è stato registrato un accesso non autorizzato alle informazioni. Poco dopo l’incidente, l’azienda ha avviato misure di contenimento e ha coinvolto esperti di sicurezza informatica terzi per valutare la portata e mitigare le conseguenze. Si sottolinea che i dati di pagamento e le password dei clienti erano conservati in un altro database, che non è stato danneggiato.

Gli avvisi inviati ai clienti cinesi e sudcoreani indicavano che i seguenti dati erano a rischio: nome completo, sesso, numero di telefono, indirizzo e-mail, indirizzo postale, cronologia degli acquisti e preferenze. Una dichiarazione ufficiale è stata pubblicata sulla versione coreana del sito web di Dior, confermando l’accaduto e invitando i clienti a prestare attenzione a possibili attacchi di phishing.

Anche gli utenti cinesi hanno iniziato a ricevere notifiche ufficiali della compromissione dei dati, il che indica la natura internazionale dell’incidente. Nonostante ciò, il numero esatto dei clienti interessati e l’elenco dei Paesi interessati restano sconosciuti. Dior, tuttavia, afferma che sta adottando misure per avvisare i clienti e le autorità di regolamentazione, in conformità con le leggi locali.

I media sudcoreani riferiscono che Dior potrebbe dover affrontare conseguenze legali per non aver informato tempestivamente le autorità di regolamentazione del Paese. Secondo la legislazione locale, le aziende che scoprono una fuga di dati personali devono informare tempestivamente le autorità competenti. Nel caso di Dior, si sostiene che le notifiche non siano state inviate a tutte le autorità necessarie.

I rappresentanti del marchio sottolineano che la sicurezza e la riservatezza dei dati dei clienti restano una priorità. Dior si scusa per ogni inconveniente e preoccupazione che questo incidente possa causare e chiede ai clienti di essere vigili e di segnalare i casi di imitazione del marchio e le richieste sospette di informazioni personali.

Nel frattempo, gli esperti continuano le indagini per determinare le fonti della fuga di notizie e prevenire che incidenti simili si ripetano in futuro.

L'articolo Dior Violata: Gli Hacker Criminali Accedono a Dati Sensibili dei Clienti Asiatici proviene da il blog della sicurezza informatica.

La più grande azienda siderurgica statunitense, Nucor, ha temporaneamente sospeso le attività in diversi suoi stabilimenti dopo che la sua infrastruttura IT interna è stata attaccata. La società lo ha annunciato nel modulo ufficiale 8-K depositato presso la Securities and Exchange Commission (SEC) degli Stati Uniti. Si specifica che l’incidente ha interessato “determinati sistemi informatici”, ma non vengono divulgati dettagli sul tipo di attacco o sui siti interessati.

L’azienda ha sottolineato che l’interruzione delle attività è stata una misura preventiva adottata “in segno di eccessiva cautela”. È attualmente in corso il processo di riavvio degli oggetti arrestati. L’incidente è oggetto di indagine da parte di una società di sicurezza informatica terza e sono coinvolte anche le forze dell’ordine.

Le unità produttive di Nucor in Alabama, Carolina del Sud e Indiana non sono state disponibili per rilasciare dichiarazioni oppure i loro numeri di telefono non erano disponibili.

Nucor gestisce più di 20 acciaierie negli Stati Uniti, nonché decine di impianti di riciclaggio di rottami metallici e di produzione di materiali da costruzione. L’azienda svolge un ruolo fondamentale nelle infrastrutture critiche del Paese e, di conseguenza, rappresenta un potenziale bersaglio sia per gli estorsori sia per i gruppi informatici stranieri.

Secondo gli esperti, gli attacchi a tali strutture possono perseguire sia obiettivi puramente criminali (ad esempio, l’interruzione delle operazioni e l’estorsione) sia obiettivi strategici. Alla conferenza RSA 2025 di maggio si è discusso delle possibili azioni da parte degli hacker cinesi che cercano di infiltrarsi nelle reti americane prima di importanti eventi geopolitici. È stato presentato uno scenario in cui interruzioni di corrente, acqua e comunicazioni paralizzano le infrastrutture civili nel mezzo di una crisi di politica estera.

Le aziende manifatturiere come Nucor sono particolarmente vulnerabili a questo tipo di minacce: i tempi di inattività delle apparecchiature causano perdite significative e hanno ripercussioni a catena sull’intero settore. In passato, incidenti simili hanno avuto gravi conseguenze. Nel 2021, ad esempio, un attacco al Colonial Pipeline ha bloccato quasi la metà della fornitura di carburante alla costa orientale degli Stati Uniti, scatenando il panico e costringendo l’azienda a pagare un riscatto di 5 milioni di dollari.

Si stima che entro il 2023 circa il 70% di tutti gli incidenti relativi ai software di crittografia industriale avesse come target i produttori anziché le aziende di servizi pubblici. Ciò conferma la tendenza a spostare il vettore di attacco verso settori vulnerabili ma critici.

Non è ancora noto quali vulnerabilità siano state sfruttate nell’attacco a Nucor né se si sia trattato di un attacco ransomware. I rappresentanti dell’azienda si sono limitati ad assicurare che i lavori di restauro erano già in corso e hanno promesso di fornire nuovi dettagli man mano che la situazione si evolveva.

L'articolo Nucor, La Più Grande Acciaieria USA si Ferma Dopo L’attacco Informatico proviene da il blog della sicurezza informatica.

You’d think a paper from a science team from Carnegie Mellon would be short on fun. But the team behind LegoGPT would prove you wrong. The system allows you to enter prompt text and produce physically stable LEGO models. They’ve done more than just a paper. You can find a GitHub repo and a running demo, too.

The authors note that the automated generation of 3D shapes has been done. However, incorporating real physics constraints and planning the resulting shape in LEGO-sized chunks is the real topic of interest. The actual project is a set of training data that can transform text to shapes. The real work is done using one of the LLaMA models. The training involved converting Lego designs into tokens, just like a chatbot converts words into tokens.

There are a lot of parts involved in the creation of the designs. They convert meshes to LEGO in one step using 1×1, 1×2, 1×4, 1×6, 1×8, 2×2, 2×4, and 2×6 bricks. Then they evaluate the stability of the design. Finally, they render an image and ask GPT-4o to produce captions to go with the image.

The most interesting example is when they feed robot arms the designs and let them make the resulting design. From text to LEGO with no human intervention! Sounds like something from a bad movie.

We wonder if they added the more advanced LEGO sets, if we could ask for our own Turing machine?

hackaday.com/2025/05/15/welcom…

Registrati al webinar: La sicurezza delle API nell’era dell’intelligenza artificiale

Il nuovo report State of Apps and API Security 2025: How AI Is Shifting the Digital Terrain, parte della serie State of the Internet Report (SOTI) di Akamai, fotografa uno scenario preoccupante per la sicurezza digitale globale: nel 2024 gli attacchi web sono aumentati del 33%, raggiungendo la cifra record di 311 miliardi rispetto all’anno precedente. Un trend in forte ascesa, spinto dalla rapida adozione di applicazioni basate sull’intelligenza artificiale, che stanno ampliando le superfici di attacco e introducendo nuove criticità per la sicurezza. Il report si basa sull’analisi di oltre un terzo del traffico web globale gestito dall’infrastruttura di Akamai, offrendo insight di valore per comprendere le evoluzioni delle minacce e delle vulnerabilità.

API nel mirino: oltre 150 miliardi di attacchi in 12 mesi

Tra i dati più allarmanti emerge la centralità delle API come vettori di attacco: solo tra gennaio 2023 e dicembre 2024 Akamai ha documentato 150 miliardi di attacchi contro le API. In particolare, le API legate a soluzioni di AI sono risultate tra le più esposte, complice una maggiore apertura verso l’esterno e l’utilizzo di sistemi di autenticazione spesso inadeguati. Questa vulnerabilità è aggravata dalla crescente sofisticazione degli attacchi condotti proprio grazie all’intelligenza artificiale, che consente ai cybercriminali di migliorare continuamente le proprie tecniche.

Attacchi DDoS Layer 7: +94% in un anno

Il report segnala anche un’escalation impressionante degli attacchi DDoS a livello applicativo (Layer 7), che nel 2024 hanno superato i 1,1 trilioni a trimestre, con un incremento del 94% rispetto all’inizio del 2023. Un fenomeno favorito dalla persistenza dell’HTTPS flooding come principale vettore di attacco e dalla continua evoluzione dei bot.

Settori più colpiti: e-commerce e high-tech sotto assedio

Non sorprende che i settori più bersagliati siano e-commerce e high-tech:

• Oltre 230 miliardi di attacchi web hanno colpito le aziende e-commerce, rendendolo il settore più esposto.
• Il settore high-tech, invece, è quello più colpito dagli attacchi DDoS Layer 7, con circa 7.000 miliardi di attacchi registrati in 24 mesi.

Tra gli altri trend rilevati:

• Incidenti correlati alla OWASP API Security Top 10 in crescita del 32%.
• Aumenti del 30% negli avvisi di sicurezza legati al framework MITRE, a conferma del crescente uso di tecniche avanzate, automazione e AI per violare le API.
• Sempre più critiche le vulnerabilità legate a API shadow e zombie, in ecosistemi API sempre più complessi e difficili da mappare.

Le raccomandazioni di Akamai per difendersi

Il report include anche una panoramica sulle strategie di mitigazione consigliate, offrendo alle aziende indicazioni pratiche per rafforzare la protezione delle API e delle applicazioni web, nonché strumenti per la valutazione dei rischi e il contrasto alle minacce avanzate basate su AI. Per approfondire, registrati al webinar sulla Sicurezza delle API nell’era dell’AI, live il 29 maggio alle ore 11:30.

L'articolo Attacchi web in aumento del 33%! Le API sono l’obiettivo principale. Iscriviti al Webinar di Akamai proviene da il blog della sicurezza informatica.

Un’onda d’urto tra vulnerabilità, webshell e gruppi ransomware

Il 14 maggio 2025, il team di intelligence di ReliaQuest ha aggiornato la propria valutazione su una pericolosa vulnerabilità: CVE-2025-31324, una falla di tipo “unrestricted file upload” nel componente SAP NetWeaver Visual Composer, che consente l’esecuzione remota di codice (Remote Code Execution – RCE). Sebbene inizialmente classificata come una semplice “remote file inclusion”, ulteriori analisi hanno rivelato che la natura della falla era decisamente più pericolosa: chiunque, senza autenticazione, poteva caricare file JSP malevoli sul server SAP e ottenere l’accesso remoto.

La piattaforma Recorded Future, in una nota pubblicata il 15 maggio, ha confermato che le campagne di attacco condotte dai gruppi ransomware BianLian e RansomEXX (Defray777) hanno sfruttato attivamente questa vulnerabilità, nonostante SAP avesse già rilasciato una patch il 24 aprile. Il componente coinvolto, va detto, è deprecato dal 2015. Ma come sappiamo bene, nella sicurezza informatica ciò che è vecchio non muore mai… spesso resta esposto, ignorato, e tremendamente vulnerabile.

Cosa dicono i dati: IP, domini e infrastrutture dannose

Secondo l’analisi condotta da Insikt Group (Recorded Future), le infrastrutture dannose riconducibili agli attacchi includono:

• Gli indirizzi IP 184.174.96.70 e 184.174.96.74, entrambi classificati con un rischio moderato (30/100).
• Il dominio dns.telemetrymasterhostname.com, associato alle fasi C2 (command and control) dell’attacco, valutato con un rischio molto alto (66/100).
• Il prodotto coinvolto: SAP NetWeaver Visual Composer, con un indice di rischio di 66, e classificato come obiettivo critico dell’infrastruttura malevola.
• La vulnerabilità principale: CVE-2025-31324, che raggiunge un punteggio di rischio massimo pari a 99.

Tutti questi elementi compongono il mosaico tecnico che ha permesso l’esecuzione remota di codice nei sistemi compromessi.

La dinamica dell’attacco: dalle JSP ai payload modulari

Gli attori della minaccia hanno sfruttato l’endpoint /developmentserver/metadatauploader per caricare JSP webshell come helper.jsp, cache.jsp, rrx.jsp, dyceorp.jsp all’interno della directory:

j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/

Queste webshell consentivano il controllo remoto tramite richieste HTTP GET, permettendo una piena esecuzione di comandi sul server vittima.

Nel caso specifico di RansomEXX, l’infrastruttura di attacco si è dimostrata particolarmente sofisticata: dopo l’upload iniziale, gli attori hanno utilizzato MSBuild per compilare e attivare un backdoor modulare denominata PipeMagic. Questa, a sua volta, ha consentito l’iniezione in memoria del noto framework di red-teaming Brute Ratel, all’interno del processo dllhost.exe. Tutto questo è stato eseguito in modalità stealth, grazie alla tecnica Heaven’s Gate, che permette di passare da 32-bit a 64-bit mode aggirando le difese basate su syscall.

Il ruolo della Cina e la minaccia APT sulle infrastrutture critiche

Non meno rilevante è l’altra faccia di questa minaccia: la componente APT (Advanced Persistent Threat). Il gruppo cinese Chaya_004, secondo Forescout, avrebbe compromesso oltre 581 sistemi SAP NetWeaver non aggiornati e individuato altri 1.800 domini in fase di targeting, inclusi ICS (sistemi di controllo industriale) situati in Stati Uniti, Regno Unito e Arabia Saudita. Altri tre gruppi APT, UNC5221, UNC5174 e CL-STA-0048, avrebbero partecipato a campagne simili, come riportato da EclecticIQ.

Questi attacchi indicano un chiaro interesse geopolitico e strategico nei confronti di infrastrutture industriali e sistemi critici occidentali, aggravando l’urgenza di mitigare la vulnerabilità CVE-2025-31324. SAP, parallelamente, ha rilasciato una patch anche per la vulnerabilità CVE-2025-42999, che veniva utilizzata in combinazione per ottenere un impatto maggiore.

Tecniche MITRE ATT&CK associate

Le TTP (Tactics, Techniques, and Procedures) osservate fanno riferimento a una lunga lista di tecniche MITRE ATT&CK, tra cui:

• T1055.003 – Inject into Process
• T1202 – Indirect Command Execution
• T1548.002 – Bypass User Account Control
• T1071.001 – Application Layer Protocol: Web Protocols
• T1190 – Exploit Public-Facing Application
• T1140 – Deobfuscate/Decode Files or Information

Schermata prelevata dalla piattaforma di intelligence di Recorded Future, partner strategico di Red Hot Cyber
Il vettore d’attacco è chiaro: esposizione pubblica, upload di codice malevolo, comandi remoti, iniezione in memoria e persistente presenza in sistemi compromessi. Una perfetta catena d’infezione in stile APT mista a dinamiche ransomware.

Il prezzo della trascuratezza

Questa campagna mostra, ancora una volta, come l’inerzia nella gestione dei software deprecati e il ritardo nell’applicazione delle patch di sicurezza rappresentino il terreno fertile per minacce sempre più sofisticate. Che si tratti di ransomware o cyber spionaggio, la porta d’ingresso è sempre la stessa: vulnerabilità note, ma ignorate.

Questo articolo si basa su informazioni, integralmente o parzialmente tratte dalla piattaforma di intelligence di Recorded Future, partner strategico di Red Hot Cyber e punto di riferimento globale nell’intelligence sulle minacce informatiche. La piattaforma fornisce analisi avanzate utili a individuare e contrastare attività malevole nel cyberspazio.

L'articolo Ransomware su SAP NetWeaver: sfruttato il CVE-2025-31324 per l’esecuzione remota di codice proviene da il blog della sicurezza informatica.