Dalla Newsletter di Haaretz
Satellite images show a new militia operating in southern Gaza in an area under IDF control, and a former Israeli defense minister claimed Israel is arming an ISIS-affiliated militia in Gaza to counter Hamas. In response, PM Netanyahu's office said the country is "working to defeat Hamas in various ways."
Se fosse vero sarebbe l'ennesima prova di quanto Israele sia sceso in basso.
reshared this
Supercon 2024: From Consultant to Prototyper On A Shoestring Budget
Many engineers graduate from their studies and head out into the workforce, seeking a paycheck and a project at some existing company or other. Often, it’s not long before an experienced engineer begins to contemplate striking out on their own, working as a skilled gun-for-hire that makes their own money and their own hours.
It’s a daunting leap, but with the promise of rich rewards for those that stick the landing. That very leap is one that our own Dave Rowntree made. He came to Supercon 2024 to tell us what the journey was like, and how he wound up working on some very special shoes.
The Journey
youtube.com/embed/dxB8GEvKevc?…
Dave’s talk begins right at the start of his career. He graduated from college around the turn of the millenium, and headed right into to the big game. He landed a job at Phillips Semiconductors, and dived into what was then a rapidly-developing field—digital television! He quickly learned a great deal about embedded programming, but found the actual electronics skills he’d picked up during his studies weren’t being put to much use. Sadly, redundancies struck his company, and he was forced to pivot to stick around. A spot opened up in the IC test and manufacturing support group, and he jumped in there, before later decamping to a fabless semiconductor company as a test engineer. He then used his education and experience to leverage a leap into the design side of things, which brought the benefit of allowing him to join the royalty program.
Things were on the up for Dave, right until the redundancy train came around once again. The inconvenience, combined with a lack of jobs in his field in the UK, pushed him to consider a major lifestyle change. He’d strike out on his own.
At this time, he explains how he tangled with the many challenges involved in working for one’s self. Not least of which, the difficulty of actually establishing a functional business in the UK, from bureaucratic red tape to handling the necessary marketing and financials.
He found his first jobs by working with so-called “innovation companies”—which provide services to those looking for design help to bring their ideas to life. These companies generally lacked engineering staff, so Dave’s services proved valuable to this specific market. It provided Dave some income, but came with a problem. After several years, he realized he had no public portfolio of work, because everything he’d worked on was under a non-disclosure agreement of some form or other.
Eventually, he realized he’d ended up in a “box.” He’d become “the PCB guy,” finding his work stagnating despite having such a broad and underexploited skillset. This didn’t sit right, and it was time for change once again. “I’m just thinking I don’t want to be a PCB guy,” Dave explains. “I want to do it all.” Thus was born his push into new fields. He built an arcade machine, art installations, and kept working to push himself out of his comfort zone.
Eventually, something exciting came down the line that really inspired him. “Some guys wanted me to build something, and it was totally oddball,” he says. “They wanted me to put an airbag in a basketball shoe.” The concept was simple enough—the airbag was intended to deploy to protect the wearer if excessive ankle roll was detected. Building the shoe in real life would be the perfect opportunity for him to stretch his abilities.
Despite his initial misgivings around the idea of putting explosives in shoes, the team behind the idea were able to twist Dave’s arm. “If I want to break out of the box of being just a PCB guy, maybe this is it,” he thought. “Why the hell not!”
The rest of Dave’s talk covers how the project came to break him out of his design funk, and how he’s tackling the difficult engineering problems involved. Even more joyously, he’s able to talk openly about it since there’s no NDA involved. He compares plans to use pyrotechnic devices versus stored gas systems, tears down commercial shoes for research, and even his journey into the world of scanning feet and making his own force sensors. As much as he was leveraging his existing skill base, he’s also been expanding it rapidly to meet the new challenges of a truly wild shoe project.
Dave’s talk is an inspiring walk through how he developed a compelling and satisfying engineering career without just going by the book. It’s also an enjoyable insight into the world of weird airbag shoes that sound too fantastical to exist. If you’ve ever thought about leaving the career world behind and going out on your own, Dave’s story is a great one to study.
hackaday.com/2025/06/05/superc…
Un Database AT&T da 3GB viene Venduto nel Dark Web: 73 Milioni di Record a Rischio
Negli ultimi giorni, su due noti forum underground specializzati nella compravendita di dati trafugati e metodi fraudolenti, sono comparsi tre post separati (ma identici nel contenuto), riguardanti un presunto leak di dati appartenenti ad AT&T.
Secondo quanto riportato dagli utenti coinvolti, il file conterrebbe oltre 73 milioni di record per un totale di 3 GB compressi, contenenti dati potenzialmente sensibili appartenenti a clienti AT&T.
Disclaimer: Questo rapporto include screenshot e/o testo tratti da fonti pubblicamente accessibili. Le informazioni fornite hanno esclusivamente finalità di intelligence sulle minacce e di sensibilizzazione sui rischi di cybersecurity. Red Hot Cyber condanna qualsiasi accesso non autorizzato, diffusione impropria o utilizzo illecito di tali dati. Al momento, non è possibile verificare in modo indipendente l’autenticità delle informazioni riportate, poiché l’organizzazione coinvolta non ha ancora rilasciato un comunicato ufficiale sul proprio sito web. Di conseguenza, questo articolo deve essere considerato esclusivamente a scopo informativo e di intelligence.
Due post, stesso contenuto
I thread sui un forum underground (che coincidono con quanto pubblicato anche su un noto forum chiuso in lingua russa), pubblicati a distanza di poche ore l’uno dall’altro, presentano lo stesso titolo:
“AT&T Division Database [New Link]” o “AT&T 70M Customer Records (2024)”. Entrambi descrivono un archivio massivo con i seguenti dettagli:
- Linee: 73.481.539
- Formato: file compresso (.zip) da circa 3 GB
- Contenuto: presumibilmente dati personali o aziendali collegati ad AT&T
Gli autori: USD e WHT
Il primo post è stato condiviso da un utente chiamato WHT, mentre il secondo ad USD.
Non è la prima volta che AT&T viene associata a incidenti di sicurezza o presunte fughe di dati. Tuttavia, al momento non vi è alcuna conferma ufficiale da parte dell’azienda riguardo a questo specifico leak. Se autentico, un file di queste dimensioni potrebbe rappresentare una seria minaccia alla privacy di milioni di utenti, con impatti che spaziano da phishing mirato e SIM swapping, fino a frodi su larga scala.
Il record apparentemente esfiltrato riportato all’interno di più post nei canali underground sembrerebbe essere il seguente:
- Full names
- Dates of birth
- Phone numbers
- Email addresses
- Physical addresses
- Social Security numbers (SSNs)
Il fatto che lo stesso leak venga pubblicato da più forum e in più varianti è indicativo di una distribuzione virale all’interno delle community cybercriminali.
La presenza di sample visibili e la mole di dati dichiarata rendono questa fuga di informazioni particolarmente degna di attenzione. Resta ora da verificare la reale autenticità del database e, se confermata, sarà fondamentale monitorare l’eventuale impatto sulla clientela AT&T e sulle infrastrutture correlate.
Come nostra consuetudine, lasciamo sempre spazio ad una dichiarazione dell’organizzazione qualora voglia darci degli aggiornamenti su questa vicenda e saremo lieti di pubblicarla con uno specifico articolo dando risalto alla questione.
RHC monitorerà l’evoluzione della vicenda in modo da pubblicare ulteriori news sul blog, qualora ci fossero novità sostanziali. Qualora ci siano persone informate sui fatti che volessero fornire informazioni in modo anonimo possono accedere utilizzare la mail crittografata del whistleblower.
L'articolo Un Database AT&T da 3GB viene Venduto nel Dark Web: 73 Milioni di Record a Rischio proviene da il blog della sicurezza informatica.
Notizie
Dazi, nuova stretta di Trump | ISPI
Trump lo aveva annunciato la scorsa settimana ad un comizio e oggi è accaduto: i dazi sulle importazioni di acciaio e alluminio negli USAISPI
DragonForce ransomware mette in ginocchio il retail UK: cosa insegna alle aziende italiane
@Informatica (Italy e non Italy 😁)
DragonForce, una gang ransomware poco conosciuta in Italia ha messo fuori uso colossi del retail britannico. Ma il vero problema non è dove hanno colpito, ma come ci sono riusciti. E cosa succederebbe se toccasse a noi? Un’utile
Informatica (Italy e non Italy 😁) reshared this.
Non fidarti del codice prodotto dalle AI! Un bug Giurassico del 2010 infetta anche GPT-4
E se le intelligenze artificiali producessero del codice vulnerabile oppure utilizzassero librerie e costrutti contenenti bug vecchi mai sanati? Si tratta di allucinazione o apprendimento errato?
Una vulnerabilità risalente a quindici anni fa, pubblicata per la prima volta come Gist su GitHub nel 2010 , continua a infettare progetti open source, tutorial e persino modelli linguistici di grandi dimensioni. Nonostante gli avvertimenti degli sviluppatori del 2012, 2014 e 2018, un esempio del codice vulnerabile è migrato nella documentazione di MDN e nelle risposte di Stack Overflow, per poi finire nei dati di training di LLM.
Il ricercatore Yafar Akhundali dell’Università di Leida e i suoi colleghi hanno sviluppato un sistema automatizzato in grado di individuare, sfruttare e correggere questa vulnerabilità nei progetti GitHub. Il lavoro è descritto in un preprint su arXiv intitolato “Eradicating the Unseen: Detecting, Exploiting, and Remediating a Path Traversal Vulnerability across GitHub”.
Questo è un caso di CWE-22, una tipica vulnerabilità di path traversal in cui un costrutto può essere utilizzato per accedere a directory al di fuori dell’area consentita. In pratica, questo può portare sia a perdite di file che ad attacchi DoS tramite overflow di memoria.
Gli autori hanno condotto un test che ha coinvolto Claude, Gemini, GPT-3.5, GPT-4, GPT-4o e diverse modalità Copilot. Quando ai modelli è stato chiesto di scrivere un server semplice senza librerie di terze parti, 76 richieste su 80 hanno restituito codice vulnerabile. Anche richiedendo direttamente la versione “sicura”, 56 esempi su 80 sono rimasti vulnerabili. GPT-3.5 e Copilot (bilanciato) hanno ottenuto prestazioni particolarmente scarse, non generando una singola variante sicura.
Il sistema automatizzato sviluppato dal team è in grado di analizzare repository pubblici, riprodurre un attacco in un ambiente sandbox e, se una vulnerabilità viene confermata, generare e inviare automaticamente una patch. Per generare le patch viene utilizzato il protocollo GPT-4 e le notifiche relative ai risultati vengono inviate via email agli autori del progetto, in modo da non divulgare pubblicamente le vulnerabilità.
Dei 40.546 repository, il sistema ha identificato 41.870 file vulnerabili. Dopo averli filtrati con l’analisi statica, ne sono rimasti 8.397, di cui 1.756 vulnerabili. Sono state generate e inviate 1.600 patch valide. Tuttavia, il numero totale di progetti che hanno applicato le correzioni è stato di soli 63, meno del 15% di quelli che hanno ricevuto una notifica.
Secondo Akhundali, il motivo della scarsa risposta è che molti progetti vengono abbandonati o il codice vulnerabile non raggiunge l’ambiente di produzione. Tuttavia, questo non riduce il rischio: se la vulnerabilità viene sfruttata, può portare alla compromissione del sistema.
Gli autori osservano: gli LLM oggi stanno diventando non solo uno strumento di generazione di codice, ma anche un canale per la distribuzione di vulnerabilità. Persino i modelli più diffusi producono con sicurezza soluzioni non sicure, pur dichiarando di essere protetti.
Data la crescita degli “agenti di programmazione” e la pratica del “vibe coding”, la fiducia cieca negli assistenti AI senza analizzarne l’output è la strada diretta verso gli incidenti .
L'articolo Non fidarti del codice prodotto dalle AI! Un bug Giurassico del 2010 infetta anche GPT-4 proviene da il blog della sicurezza informatica.
Maxar sbarca in Europa. Ecco perché l’accordo con Saab è importante
@Notizie dall'Italia e dal mondo
Il colosso dell’intelligence satellitare Usa, Maxar Technologies, entra nel mercato della difesa europea. La recente espansione della collaborazione tra Maxar Intelligence e Saab, azienda della difesa svedese, segna un passo significativo verso la trasformazione e l’ammodernamento del
Notizie dall'Italia e dal mondo reshared this.
A Steady Vacuum For The Fastest Cassette Tape Drive Ever
If you think of a 1960s mainframe computer, it’s likely that your mental image includes alongside the cabinets with the blinkenlights, a row of reel-to-reel tape drives. These refrigerator-sized units had a superficial resemblance to an audio tape deck, but with the tape hanging down in a loop either side of the head assembly. This loop was held by a vacuum to allow faster random access speeds at the head, and this fascinates [Thorbjörn Jemander]. He’s trying to create a cassette tape drive that can load 64 kilobytes in ten seconds, so he’s starting by replicating the vacuum columns of old.
The video below is the first of a series on this project, and aside from explaining the tape drive’s operation, it’s really an in-depth exploration of centrifugal fan design. He discovers that it’s speed rather than special impeller design that matters, and in particular a closed impeller delivers the required vacuum. We like his home-made manometer in particular.
What he comes up with is a 3D printed contraption with a big 12 volt motor on the back, and a slot for a cassette on the front. It achieves the right pressure, and pulls the tape neatly down into a pair of loops. We’d be curious to know whether a faster motor such as you might find in a drone would deliver more for less drama, but we can see the genesis of a fascinating project here. Definitely a series to watch.
Meanwhile, if your interest extends to those early machine rooms, have a wallow in the past.
youtube.com/embed/avpn8rIkkRY?…
Burn after reporting: Leak investigations and the press
We exposed as a lie the Trump administration’s basis for repealing restrictions on surveilling journalists to investigate leaks. The “fake news” that the administration claimed to be combating — reports that the intelligence community disputed its claim that the Venezuelan government directed the activities of the Tren de Aragua gang in the United States – was, in fact, 100 percent accurate.
But just in case that bombshell and the widespread news coverage that followed doesn’t shame the administration into changing course, Freedom of the Press Foundation (FPF) hosted a discussion about past efforts by the government to out reporters’ sources and what journalists should expect when federal prosecutors come after their newsgathering.
Our panelists would know better than most. Former New York Times reporter and Pulitzer Prize-winner James Risen fought a seven-year battle against attempts by both the George W. Bush and Barack Obama administrations to force him to testify and reveal his sources in a leak investigation. He detailed the Obama administration’s endless litigation against him, while at the same time it engaged in secret digital surveillance of his communications.
Ryan Lizza, the founder and editor of Telos.news and a former reporter at Politico, CNN, and The New Yorker, also joined to discuss his reporting on the Obama administration’s overreach in secretly spying on Fox News reporter James Rosen, as well as efforts by former U.S. representative and current Trump sycophant Devin Nunes to obtain Lizza’s communications from tech companies in separate litigation.
And Lauren Harper, Daniel Ellsberg chair on government secrecy at FPF, discussed the aforementioned revelations about the Trump administration’s false pretexts for cracking down on leaks, which she obtained through the Freedom of Information Act.
youtube.com/embed/5_SDsXS5s8g?…
Risen started by laying out the stakes that emerged after 9/11. “Basically everything about the American conduct in the war on terror was classified,” he explained. “Everything that we now take for granted about our body of knowledge about how the United States conducts warfare in the 21st century came through leaks or unauthorized disclosures of one form or another.”
Lizza agreed, adding that critics of the Iraq War in the current administration would not have been able to mount their criticisms without leaks. Politicians, he explained, use leaked information to form the basis for their political platforms and then turn against leakers when they’re the ones in power.
Harper disputed the administration’s apparent belief that the solution to leaks is more secrecy, not less. “Upwards of 90% of information that is classified ought not to be. So I think in some ways, we can look at leaks as a response to a broken classification system,” she said.
Risen observed that the Obama administration finally backed down from forcing him to testify not due to the law but due to bad press. Lizza had similar impressions from his coverage of the Rosen case, explaining that his reporting “got the ear of some people in the Obama administration who did not like being accused of attacking the First Amendment and going after reporters.”
As Risen explained, when the government comes after journalists it’s often not about finding out who they’re talking to, it’s about “having a chilling effect on journalism in general and making sure everybody is afraid of the government.” Added Risen, “They’ll go after journalists not because they need them, but because they want to punish them and set an example.”
It remains to be seen whether the Trump administration will respond to public shaming like Obama did, but we won’t know unless we try. First, the press needs to avoid surveillance, by implementing digital security best practices when storing data and communicating electronically with sources, but also, as Risen said, going “off the grid” and communicating face-to-face whenever possible.
When that fails and the government comes after journalists’ sources anyway, it’s imperative that the press stand up for itself and its sources, by raising alarms about the risks to investigative reporting and press freedom when the government is able to snoop into reporters’ notebooks and emails. Caving to the pressure only encourages more retaliation.
Cyberwarfare tra Cina e Taiwan: nuove frontiere della tensione geopolitica
@Informatica (Italy e non Italy 😁)
Negli ultimi anni, la cybersicurezza è diventata uno dei principali teatri di scontro tra le grandi potenze mondiali. L’ultimo episodio, riportato dal The Straits Times, vede le autorità cinesi offrire una taglia di 10.000 yuan per la cattura di 20 presunti
Informatica (Italy e non Italy 😁) reshared this.
Guerre e Nato, niente 5% ma accelerazione sull’industria della difesa
@Notizie dall'Italia e dal mondo
Se le scelte della Russia “preoccupano”, come ha spiegato il ministro della Difesa Guido Crosetto a margine della ministeriale Nato a Bruxelles, allora l’Ue deve prepararsi a nuove valutazioni, come l’assunto che difesa e industria della difesa devono accelerare radicalmente, ma senza poter contare sul 5%
Notizie dall'Italia e dal mondo reshared this.
Nuovo attacco alla supply chain: i cybercriminali impersonano i team IT per colpire Salesforce
@Informatica (Italy e non Italy 😁)
Appare in ambito frodi mirate un focus particolare sulle piattaforme cloud business-critical come Salesforce. Un recente allarme lanciato dal Google Threat Intelligence Group (GTIG) mette in luce una campagna sofisticata
Informatica (Italy e non Italy 😁) reshared this.
Dati off-chain e on-chain: come possono prevenire le frodi in criptovaluta
@Informatica (Italy e non Italy 😁)
Con la diffusione dei pagamenti in criptovaluta e dei sistemi di pagamento peer-to-peer (P2P) come PayPal, Venmo, Zelle, Revolut e Wise, i malfattori trovano sempre più modi per sfruttare la frammentazione. Ecco i nuovi strumenti che aiutano a
Informatica (Italy e non Italy 😁) reshared this.
Screens of Death: From Diagnostic Aids to a Sad Emoji
There comes a moment in the life of any operating system when an unforeseen event will tragically cut its uptime short. Whether it’s a sloppily written driver, a bug in the handling of an edge case or just dumb luck, suddenly there is nothing more that the OS’ kernel can do to salvage the situation. With its last few cycles it can still gather some diagnostic information, attempt to write this to a log or memory dump and then output a supportive message to the screen to let the user know that the kernel really did try its best.
This on-screen message is called many things, from a kernel panic message on Linux to a Blue Screen of Death (BSOD) on Windows since Windows 95, to a more contemplative message on AmigaOS and BeOS/Haiku. Over the decades these Screens of Death (SoD) have changed considerably, from the highly informative screens of Windows NT to the simplified BSOD of Windows 8 onwards with its prominent sad emoji that has drawn a modicum of ridicule.
Now it seems that the Windows BSOD is about to change again, and may not even be blue any more. So what’s got a user to think about these changes? What were we ever supposed to get out of these special screens?
Meditating On A Fatal Error
More important than the color of a fatal system error screen is what information it displays. After all, this is the sole direct clue the dismayed user gets when things go south, before sighing and hitting the reset button, followed by staring forlorn at the boot screen. After making it back into the OS, one can dig through the system logs for hints, but some information will only end up on the screen, such as when there is a storage drive issue.
The exact format of the information on these SoDs changes per OS and over time, with AmigaOS’ Guru Meditation screen being rather well-known. Although the naming was the result of an inside joke related to how the developers dealt with frequent system crashes, it stuck around in the production releases.
Interestingly, both Windows 9x and ME as well as AmigaOS have fatal and non-fatal special screens. In the case of AmigaOS you got a similar screen to the Guru Meditation screen with its error code, except in green and the optimistic notion that it might be possible to continue running after confirming the message. For Windows 9x/ME users this might be a familiar notion as well :
In this series of OSes you’d get these screens, with mashing a key usually returning you to a slightly miffed but generally still running OS minus the misbehaving application or driver. It could of course happen that you’d get stuck in an endless loop of these screens until you gave up and gave the three-finger salute to put Windows out of its misery. This was an interesting design choice, which Microsoft’s Raymond Chen readily admits to being somewhat quaint. What it did do was abandon the current event and return to the event dispatcher to give things another shot.
A characteristic of these BSODs in Windows 9x/ME was also that they didn’t give you a massive amount of information to work with regarding the reason for the rude interruption. Incidentally, over on the Apple side of the fence things were not much more elaborate in this regard, with OS X’s kernel panic message getting plastered over with a ‘Nothing to see here, please restart’ message. This has been quite a constant ever since the ‘Sad Mac’ days of Apple, with friendly messages rather than any ‘technobabble’.
This quite contrasts with the world of Windows NT, where even the already trimmed BSOD of Windows XP is roughly on the level of the business-focused Windows 2000 in terms of information. Of note is also that a BSOD on Windows NT-based OSes is a true ‘Screen of Death’, from which you absolutely are not returning.
These BSODs provide a significant amount of information, including the faulting module, the fault type and some hexadecimal values that can conceivably help with narrowing down the fault. Compared to the absolute information overload in Windows NT 3.1 with a partial on-screen memory dump, the level of detail provided by Windows 2000 through Windows 7 is probably just enough for the average user to get started with.
It’s here interesting that more recent versions of Windows have opted to default to restarting automatically when a BSOD occurs, which renders what is displayed on them rather irrelevant. Maybe that’s why Windows 8 began to just omit that information and opted to instead show a generic ‘collecting information’ progress counter before restarting.
Times Are Changing
Although nobody was complaining about the style of BSODs in Windows 7, somehow Windows 8 ended up with the massive sad emoji plastered on the top half of the screen and no hexadecimal values, which would now hopefully be found in the system log. Windows 10 also added a big QR code that leads to some troubleshooting instructions. This overly friendly and non-technical BSOD mostly bemused and annoyed the tech community, which proceeded to brutally make fun of it.
In this context it’s interesting to see these latest BSOD screen mockups from Microsoft that will purportedly make their way to Windows 11 soon.
These new BSOD screens seem to have a black background (perhaps a ‘Black Screen of Death’?), omit the sad emoji and reduce the text to an absolute minimum:
What’s noticeable here is how it makes the stop code very small on the bottom of the screen, with the faulting module below it in an even smaller font. This remains a big departure from the BSOD formats up till Windows 7 where such information was clearly printed on the screen, along with additional information that anyone could copy over to paper or snap a picture of for a quick diagnosis.
But Why
The crux here is whether Microsoft expects their users to use these SoDs for informative purposes, or whether they would rather that they get quickly forgotten about, as something shameful that users shouldn’t concern themselves with. It’s possible that they expect that the diagnostics get left to paid professionals, who would have to dig into the memory dumps, the system logs, and further information.
Whatever the case may be, it seems that the era of blue SoDs is well and truly over now in Windows. Gone too are any embellishments, general advice, and more in-depth debug information. This means that distinguishing the different causes behind a specific stop code, contained in the hexadecimal numbers, can only be teased out of the system log entry in Event Viewer, assuming it got in fact recorded and you’re not dealing with a boot partition or similar fundamental issue.
Although I’ll readily admit to not having seen many BSODs since probably Windows 2000 or XP — and those were on questionable hardware — the rarity of these events makes it in my view even more pertinent that these screens are as descriptive as possible, which is sadly not a feature that seems to be a priority for mainstream desktop OSes. Nor for niche OSes like Linux and BSD, tragically, where you have to know your way around the Systemd journalctl tool or equivalent to figure out where that kernel panic came from.
This is definitely a point where the SoD generated upon a fiery kernel explosion sets the tone for the user’s response.
La difesa europea, il mondo che cambia e la necessità di adeguarsi. L’appello di Crosetto
@Notizie dall'Italia e dal mondo
Sul tema della Difesa, l’Italia rischia di figurare come la “bella addormentata d’Europa”. Questo quanto emerso da un sondaggio, condotto da Cluster17, in nove Paesi europei sui temi della Difesa e delle spese militari. Benché allineati alla media degli europei,
Notizie dall'Italia e dal mondo reshared this.
sul lettino nel corridoio di casa al mare
sul lettino nel corridoio di casa al mare
Sul lettino nel corridoio di casa al mare senza sapere se volare se strisciare nelle vacanze estive riuscivo ad immaginare di essere li...ordinariafollia
Gli USA vogliono il creatore di RedLine. 10 milioni per chi tradisce l’hacker del più noto infostealer
Il Dipartimento di Stato americano ha annunciato una ricompensa fino a 10 milioni di dollari per informazioni sugli hacker che lavorano per governi stranieri e sono collegati al malware RedLine, nonché sul presunto creatore di questo malware, Maxim Rudometov. La ricompensa copre anche informazioni sull’utilizzo di RedLine in attacchi informatici contro infrastrutture critiche negli Stati Uniti.
Il programma Rewards for Justice specifica espressamente che le informazioni devono riguardare attacchi informatici condotti su indicazione o sotto il controllo di governi stranieri e che violano il Computer Fraud and Abuse Act statunitense. Di particolare interesse sono i partecipanti a operazioni informatiche che utilizzano il malware RedLine, un popolare infostealer utilizzato per rubare le credenziali degli utenti.
Il Dipartimento di Stato ha osservato che chiunque abbia informazioni sui soci di Rudometov, sulle loro attività informatiche dannose o sull’uso del malware RedLine dovrebbe contattare Rewards for Justice tramite un canale di messaggistica basato su Tor .
Le autorità statunitensi ritengono che Maxim Rudometov fosse lo sviluppatore e l’amministratore dell’intera infrastruttura di RedLine Infostealer. Nell’ottobre 2024, è stato incriminato nell’ambito dell’Operazione Magnus, un’operazione internazionale durante la quale le forze dell’ordine statunitensi e i loro partner stranieri hanno condotto un’operazione su larga scala per bloccare contemporaneamente le attività di due servizi: RedLine e META, che operavano secondo il modello malware-as-a-service (MaaS).
Secondo il Dipartimento di Giustizia degli Stati Uniti, Rudometov gestiva i server di RedLine, riceveva e riciclava i proventi tramite wallet di criptovalute e interagiva direttamente con il codice e la distribuzione del malware. Durante l’indagine, sono stati accertati i suoi collegamenti con i principali canali di distribuzione, inclusi gli account Telegram utilizzati per promuovere e vendere malware agli utenti finali. Ad oggi, sono stati identificati oltre 1.200 server utilizzati per gestire le botnet RedLine e META.
L’operazione ha coinvolto anche la polizia olandese e l’agenzia Eurojust.
Due sospettati sono stati arrestati in Belgio e tre server e due domini utilizzati come nodi di controllo sono stati sequestrati. Tuttavia, non è stato confermato ufficialmente se Rudometov sia stato arrestato.
Se riconosciuto colpevole, potrebbe rischiare fino a 35 anni di carcere per frode su dispositivi di accesso, associazione a delinquere finalizzata a commettere intrusioni informatiche e riciclaggio di denaro.
L'articolo Gli USA vogliono il creatore di RedLine. 10 milioni per chi tradisce l’hacker del più noto infostealer proviene da il blog della sicurezza informatica.
“AI alla prova dei fatti”: al via il ciclo di webinar di Start Magazine e Icinn
L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
Chi parteciperà al primo webinar “AI alla prova dei fatti”che si terrà startmag.it/eventi/ai-alla-pro…
Informatica (Italy e non Italy 😁) reshared this.
Trasparenza nella PA: profili privacy e ruolo di DPO, RCPT e OIV
@Informatica (Italy e non Italy 😁)
L'Anac ha avviato il nuovo ciclo di attestazione annuale sull’assolvimento degli obblighi di pubblicazione imposti dal Decreto trasparenza. Ecco gli aspetti di attenzione nelle verifiche effettuate, i profili privacy e il ruolo fondamentale del DPO, del
Informatica (Italy e non Italy 😁) reshared this.
Una folla eterogenea si unisce nelle strade contro i tagli di Milei
@Notizie dall'Italia e dal mondo
Pensionati, insegnanti, scienziati, medici, persone con disabilità e movimenti femministi chiedono al governo argentino di fermare l'austerità fiscalehttps://pagineesteri.it/2025/06/05/america-latina/una-folla-eterogenea-si-unisce-nelle-strade-contro-i-tagli-di-milei/
Notizie dall'Italia e dal mondo reshared this.
SEGUI QUI LA FLOTILLA. Madleene si avvicina a Gaza, tra minacce e salvataggi in mare
@Notizie dall'Italia e dal mondo
Segui il percorso e gli aggiornamenti dalla Madleen, l'imbarcazione della Freedom Flotilla diretta verso Gaza per rompere l'assedio israeliano e portare cibo e medicine alla popolazione palestinese.
L'articolo SEGUI QUI LA FLOTILLA.
Notizie dall'Italia e dal mondo reshared this.
Ma quanto mi costa la privacy? Al contrario, il GDPR conviene.
@Privacy Pride
Il post completo di Christian Bernieri è sul suo blog: garantepiracy.it/blog/gdprconv…
Se pensi che un professionista sia troppo caro, aspetta di vedere quanto ti verrà a costare l'esserti affidato ad un dilettante. Il CNIL, il Garante francese, ha pubblicato uno studio che analizza i costi del GDPR. Non un semplice bilancio
reshared this
Giorgia Gastaldon, Emilio Villa e l'esperienza di "Appia Antica" (in "Studi di Memofonte", XIII, dicembre 2014, pp. 245-261)
academia.edu/10058821/Emilio_V…
Nell'estate del 1959 veniva dato alle stampe il primo numero di «Appia Antica. Atlante di Arte Nuova», «rivista di selezione poetica e di qualificazione ideologica di quella produzione artistica che si testimonia in qualche senso attiva o attuale» [...]
Poliversity - Università ricerca e giornalismo reshared this.
Piko, Your ESP32 Powered Fitness Buddy
Over on Hackaday.io there’s a fun and playful write-up for a fun and playful project — the Piko, an ESP32 powered smartwatch.
Our hackers [Iloke Alusala], [Lulama Lingela], and [Rafael Cardoso] teamed up to design and manufacture this wrist-worn fitness wearable. Made from an ESP32 Beetle C6 and using an attached accelerometer with simple thresholds the Piko can detect if you’re idle, walking, jogging, or sprinting; and at the same time count your steps.
The team 3D printed the requisite parts in PLA using the printer in their university makerspace. In addition to the ESP32 and printed parts, the bill of materials includes a 240×240 IPS TFT LCD display, a LIS331HH triple-axis accelerometer, a 200 mAh battery, and of course, a watch strap.
Demonstrating splendid attention to detail, and inspired by the aesthetic of the Tamagotchi and pixel art, the Piko mimics your current activity with a delightful array of hand-drawn animations on its display. Should you want to bring a similar charm to your own projects, all the source is available under the MIT license.
If you’re interested in smartwatch technology be sure to check out our recent articles: Smartwatches Could Flatten The Curve Of The Next Pandemic and Custom Smartwatch Makes Diabetes Monitoring Easier For Kids.
youtube.com/embed/1BNUNgcb1k0?…
Leadership italiana per la stabilità del Medio Oriente. Abagnara alla guida di Unifil
@Notizie dall'Italia e dal mondo
Mercoledì, il Segretario Generale delle Nazioni Unite, António Guterres, ha annunciato la nomina del generale di Divisione dell’Esercito Italiano Diodato Abagnara a Capo missione e comandante della Forza interinale delle Nazioni Unite in Libano (Unifil). Abagnara subentra al
Notizie dall'Italia e dal mondo reshared this.
L’ombra di Kaspersky: servizi segreti svizzeri nel caos e dati riservati trasmessi in Russia
@Informatica (Italy e non Italy 😁)
Il caso dei dati riservati del Fis, trasmessi per anni a Kaspersky, sospetta di legami con il Cremlino, ha sollevato gravi dubbi sulla sicurezza dei dati svizzeri e sulla dipendenza da fornitori esterni, oltre a
Informatica (Italy e non Italy 😁) reshared this.
Crisi automotive, tra la scure dei dazi e lo scacco di Pechino
@Politica interna, europea e internazionale
Licenziamenti, delocalizzazioni, chiusure. La crisi globale dell’automotive si inasprisce e le tensioni commerciali tra Washington e Pechino propagano i loro effetti sino a Bruxelles, stringendo in una doppia morsa il mercato europeo delle quattro ruote, già messo in ginocchio da
Politica interna, europea e internazionale reshared this.
La rabbia non basta
di Lea Melandri - Cosa sta succedendo ai giovani uomini? Siamo di fronte a un profondo analfabetismo affettivo? Chi se ne occupa? Perché il richiamo all'”Rifondazione Comunista
Sorveglianza Ovunque! La Corea del Nord ha il suo smartphone … ma ti spia in ogni tocco
Uno smartphone contrabbandato dalla Corea del Nord ha rivelato quanto profondamente il regime di Kim Jong-un controlli la vita quotidiana dei cittadini, fino alle parole che digitano. Nonostante la sua somiglianza esteriore con i dispositivi moderni, il telefono era uno strumento di censura digitale totale.
La BBC ha pubblicato un video che mostra il dispositivo.
All’accensione, lo schermo accoglie l’utente con una bandiera nordcoreana animata. L’interfaccia assomiglia a quella dei modelli Huawei o Honor, ma non è noto se siano ufficialmente forniti al Paese. In ogni caso, il software del telefono è stato chiaramente riprogettato: alcune funzioni sono state tagliate e la sorveglianza è integrata nel sistema.
Una delle caratteristiche più sorprendenti era la sostituzione automatica delle parole ritenute discutibili dalle autorità. Ad esempio, inserendo il termine sudcoreano “oppa” (un indirizzo rivolto a un fratello o a un fidanzato), la parola veniva automaticamente modificata in “compagno“. Il sistema visualizzava anche un avviso: “oppa” può essere utilizzato solo per un fratello maggiore.
Un’altra regola linguistica è la sostituzione dell’espressione “Corea del Sud” con “Stato fantoccio”. Questa sostituzione è in linea con la retorica ufficiale di Pyongyang, che nega la legittimità di Seul e sottolinea “l’ostilità del Sud capitalista”.
Ancora più allarmante era la funzione di screenshot segreto : il telefono scattava uno screenshot ogni cinque minuti e lo salvava in una cartella nascosta a cui l’utente non aveva accesso. Gli esperti sospettano che questi screenshot vengano utilizzati dai servizi di sicurezza per analizzare le attività degli utenti.
Il telefono è finito nelle mani di giornalisti tramite Daily NK, una pubblicazione sudcoreana specializzata nella copertura degli eventi nella RPDC. Dopo un’analisi, la BBC ha confermato che la sorveglianza è integrata nel firmware, non nelle singole applicazioni. L’intervento dell’utente diventa impossibile senza un hack completo del sistema.
Negli ultimi anni, gli smartphone sono diventati più comuni in Corea del Nord. Tuttavia, rimangono isolati dalla rete globale e soggetti a un’intensa sorveglianza governativa. Parallelamente al controllo tecnologico, il Paese dispone di una speciale forza di polizia giovanile, le cosiddette “squadre antiviolenza”. Fermano adolescenti e giovani per strada, controllano il contenuto dei loro telefoni, cercano linguaggio “pericoloso”, canzoni sudcoreane, serie TV o persino tracce di comunicazioni con parenti all’estero.
Il contrabbando di file multimediali attraverso il confine continua nonostante la minaccia di incarcerazione. Il più delle volte, serie TV, film e programmi entrano nel Paese su chiavette USB nascoste in confezioni di noodle o riso. La distribuzione è effettuata non solo da corrieri privati, ma anche da ONG internazionali che supportano l’accesso dei nordcoreani a informazioni alternative.
I racconti dei fuggitivi confermano che l’accesso ai media stranieri, in particolare ai drama sudcoreani, è spesso il primo passo per mettere in discussione la propaganda di stato e, in ultima analisi, per decidere di disertare. Le ricerche dimostrano che i nordcoreani continuano a cercare modi per aggirare le restrizioni governative, nonostante le crescenti barriere tecnologiche.
L'articolo Sorveglianza Ovunque! La Corea del Nord ha il suo smartphone … ma ti spia in ogni tocco proviene da il blog della sicurezza informatica.
Spari contro la fame: la CNN documenta le uccisioni nei centri aiuti a Gaza
@Notizie dall'Italia e dal mondo
Un’inchiesta svela come l’accesso al cibo a Gaza sia diventato una trappola mortale, con spari diretti contro anziani, donne e bambini in attesa degli aiuti umanitari.
L'articolo Spari contro la fame: la CNN documenta le uccisioni nei centri aiuti a Gaza
Notizie dall'Italia e dal mondo reshared this.
IT threat evolution in Q1 2025. Non-mobile statistics
IT threat evolution in Q1 2025. Mobile statistics
The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data.
The quarter in numbers
In Q1 2025:
- Kaspersky products blocked more than 629 million attacks that originated with various online resources.
- Web Anti-Virus detected 88 million unique links.
- File Anti-Virus blocked more than 21 million malicious and potentially unwanted objects.
- Nearly 12,000 new ransomware variants were detected.
- More than 85,000 users experienced ransomware attacks.
- RansomHub was involved in attacks on 11% of all ransomware victims whose data was published on data leak sites (DLSs). Slightly under 11% encountered the Akira and Clop ransomware.
- Almost 315,000 users faced miners.
Ransomware
The quarter’s trends and highlights
Law enforcement success
Phobos Aetor, a joint international effort by law enforcement agencies from the United States, Great Britain, Germany, France and several other countries, resulted in the arrest of four suspected members of 8Base. They are accused of carrying out more than 1000 cyberattacks around the world with the help of the Phobos ransomware. The suspects were arrested in Thailand and charged with extorting more than $16 million dollars in Bitcoin. According to law enforcement officials, the multinational operation resulted in the seizure of more than 40 assets, including computers, phones, and cryptocurrency wallets. Additionally, law enforcement took down 27 servers linked to the cybercrime gang.
An ongoing effort to combat LockBit led to the extradition of a suspected ransomware developer to the United States. Arrested in Israel last August, the suspect is accused of receiving more than $230,000 in cryptocurrency for his work with the group between June 2022 and February 2024.
Vulnerabilities and attacks, BYOVD, and EDR bypassing
The first quarter saw a series of vulnerabilities detected in Paragon Partition Manager. They were assigned the identifiers CVE-2025-0288, CVE-2025-0287, CVE-2025-0286, CVE-2025-0285, and CVE-2025-0289. According to researchers, ransomware gangs had been exploiting the vulnerabilities to gain Windows SYSTEM privileges during BYOVD (bring your own vulnerable driver) attacks.
Akira exploited a vulnerability in a webcam to try and bypass endpoint detection and response (EDR) and encrypt files on the organization’s network over the SMB protocol. The attackers found that their Windows ransomware was being detected and blocked by the security solution. To bypass it, they found a vulnerable network webcam in the targeted organization that was running a Linux-based operating system and was not protected by EDR. The attackers were able to evade detection by compromising the webcam, mounting network drives of other machines, and running the Linux version of their ransomware on the camera.
HellCat leveraged compromised Jira credentials to attack a series of companies, including Ascom, Jaguar Land Rover, and Affinitiv. According to researchers, the threat actors obtain credentials by infecting employees’ computers with Trojan stealers like Lumma.
Other developments
An unidentified source posted Matrix chat logs belonging to the Black Basta gang. The logs feature information about the gang’s attack techniques and vulnerabilities that it exploited. In addition, the logs contain details about the group’s internal structure and its members, as well as more than 367 unique ZoomInfo links that the attackers used to gather data on potential victims.
BlackLock was compromised due to a vulnerability in the threat actor’s data leak site (DLS). Researchers who discovered the vulnerability gained access to confidential information about the group and its activities, including configuration files, login credentials, and the history of commands run on the server. DragonForce, a rival ransomware outfit, exploited the same security flaw to deface the DLS. They changed the site’s appearance, and made BlackLock’s internal chat logs and certain configuration files publicly available.
The most prolific groups
This section highlights the most prolific ransomware groups by number of victims that each added to their DLS during the reporting period. RansomHub, which stood out in 2024, remained the leader by number of new victims with 11.03%. Akira (10.89%) and Clop (10.69%) followed close behind.
The number of the group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs reviewed during the reporting period (download)
Number of new modifications
In the first quarter, Kaspersky solutions detected three new ransomware families and 11,733 new variants – almost four times more than in the fourth quarter of 2024. This is due to the large number of samples that our solutions categorized as belonging to the Trojan-Ransom.Win32.Gen family.
New ransomware variants, Q1 2024 – Q1 2025 (download)
Number of users attacked by ransomware Trojans
The number of unique KSN users protected is 85,474.
Number of unique users attacked by ransomware Trojans, Q1 2025 (download)
Attack geography
Top 10 countries and territories attacked by ransomware Trojans
| Country/territory* | %** | |
| 1 | Oman | 0.661 |
| 2 | Libya | 0.643 |
| 3 | South Korea | 0.631 |
| 4 | China | 0.626 |
| 5 | Bangladesh | 0.472 |
| 6 | Iraq | 0.452 |
| 7 | Rwanda | 0.443 |
| 8 | Pakistan | 0.441 |
| 9 | Tajikistan | 0.439 |
| 10 | Sri Lanka | 0.419 |
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky product users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique Kaspersky product users in the country/territory
TOP 10 most common ransomware Trojan families
| Name | Verdict* | %** | ||
| 1 | (generic verdict) | Trojan-Ransom.Win32.Gen | 25.10 | |
| 2 | WannaCry | Trojan-Ransom.Win32.Wanna | 8.19 | |
| 3 | (generic verdict) | Trojan-Ransom.Win32.Encoder | 6.70 | |
| 4 | (generic verdict) | Trojan-Ransom.Win32.Crypren | 6.65 | |
| 5 | (generic verdict) | Trojan-Ransom.Win32.Agent | 3.95 | |
| 6 | Cryakl/CryLock | Trojan-Ransom.Win32.Cryakl | 3.16 | |
| 7 | LockBit | Trojan-Ransom.Win32.Lockbit | 3.15 | |
| 8 | (generic verdict) | Trojan-Ransom.Win32.Phny | 2.90 | |
| 9 | PolyRansom/VirLock | Virus.Win32.PolyRansom / Trojan-Ransom.Win32.PolyRansom | 2.73 | |
| 10 | (generic verdict) | Trojan-Ransom.Win32.Crypmod | 2.66 |
* Unique Kaspersky product users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.
Miners
Number of new modifications
In the first quarter of 2025, Kaspersky solutions detected 5,467 new miner variants.
New miner variants, Q1 2025 (download)
Number of users attacked by miners
Miners were fairly active in the first quarter. During the reporting period, we detected miner attacks on the computers of 315,701 unique Kaspersky product users worldwide.
Number of unique users attacked by miners, Q1 2025 (download)
Attack geography
Top 10 countries and territories attacked by miners
| Country/territory* | %** | ||
| 1 | Senegal | 2.59 | |
| 2 | Kazakhstan | 1.36 | |
| 3 | Panama | 1.28 | |
| 4 | Belarus | 1.22 | |
| 5 | Ethiopia | 1.09 | |
| 6 | Tajikistan | 1.07 | |
| 7 | Moldova | 0.90 | |
| 8 | Dominican Republic | 0.86 | |
| 9 | Kyrgyzstan | 0.84 | |
| 10 | Tanzania | 0.82 |
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky product users.
** Unique users whose computers were attacked by miners as a percentage of all unique Kaspersky product users in the country/territory.
Attacks on macOS
The first quarter saw the discovery of a new Trojan loader for macOS. This is a Go-based variant of ReaderUpdate, which has previously appeared in Python, Crystal, Rust, and Nim versions. These loaders are typically used to download intrusive adware, but there is nothing stopping them from delivering any kind of Trojan.
During the reporting period researchers identified new loaders from the Ferret malware family which were being distributed by attackers through fake online job interview invitations. These Trojans are believed to be part of an ongoing campaign that began in December 2022. The original members of the Ferret family date back to late 2024. Past versions of the loader delivered both a backdoor and a crypto stealer.
Throughout the first quarter, various modifications of the Amos stealer were the most aggressively distributed Trojans. Amos is designed to steal user passwords, cryptocurrency wallet data, browser cookies, and documents. In this campaign, threat actors frequently modify their Trojan obfuscation techniques to evade detection, generating thousands of obfuscated files to overwhelm security solutions.
TOP 20 threats to macOS
(download)
* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS.
* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.
As usual, a significant share of the most common threats to macOS consists of potentially unwanted applications: adware, spyware tracking user activity, fake cleaners, and reverse proxies like NetTool. Amos Trojans, which we mentioned earlier, also gained popularity in the first quarter. Trojan.OSX.Agent.gen, which holds the third spot in the rankings, is a generic verdict that detects a wide variety of malware.
Geography of threats to macOS
TOP 10 countries and territories by share of attacked users
| Country/territory | Q4 2024* | Q1 2025* |
| Spain | 1.16% | 1.02% |
| France | 1.52% | 0.96% |
| Hong Kong | 1.21% | 0.83% |
| Singapore | 0.32% | 0.75% |
| Mexico | 0.85% | 0.74% |
| Germany | 0.96% | 0.74% |
| Mainland China | 0.73% | 0.68% |
| Brazil | 0.66% | 0.61% |
| Russian Federation | 0.50% | 0.53% |
| India | 0.84% | 0.51% |
* Unique users who encountered threats to macOS as a percentage of all unique Kaspersky product users in the country/territory.
IoT threat statistics
This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.
In the first quarter of 2025, the share of devices that attacked Kaspersky honeypots via the Telnet protocol increased again, following a decline at the end of 2024.
Distribution of attacked services by number of unique IP addresses of attacking devices (download)
The distribution of attacks across Telnet and SSH remained virtually unchanged compared to the fourth quarter of 2024.
Distribution of attackers’ sessions in Kaspersky honeypots (download)
TOP 10 threats delivered to IoT devices:
Share of each threat uploaded to an infected device as a result of a successful attack in the total number of uploaded threats (download)
A significant portion of the most widespread IoT threats continues to be made up of various Mirai DDoS botnet variants. BitCoinMiner also saw active distribution in the first quarter, accounting for 7.32% of detections. The number of attacks by the NyaDrop botnet (19.31%) decreased compared to the fourth quarter of 2024.
Geography of attacks on IoT honeypots
When looking at SSH attacks by country/territory, mainland China’s share has declined, while attacks coming from Brazil have seen a noticeable increase. There was also a slight uptick in attacks coming from the United States, Indonesia, Australia, and Vietnam.
| Country/territory | Q4 2024 | Q1 2025 |
| Mainland China | 32.99% | 20.52% |
| India | 19.13% | 19.16% |
| Russian Federation | 9.46% | 9.16% |
| Brazil | 2.18% | 8.48% |
| United States | 4.90% | 5.52% |
| Indonesia | 1.37% | 3.99% |
| Hong Kong | 2.81% | 3.46% |
| Australia | 1.31% | 2.75% |
| France | 3.53% | 2.54% |
| Vietnam | 1.41% | 2.27% |
The share of Telnet attacks originating from China and India dropped, while Brazil, Nigeria, and Indonesia took a noticeably larger share.
| Country/territory | Q4 2024 | Q1 2025 |
| China | 44.67% | 39.82% |
| India | 33.79% | 30.07% |
| Brazil | 2.62% | 12.03% |
| Russian Federation | 6.52% | 5.14% |
| Pakistan | 5.77% | 3.99% |
| Nigeria | 0.50% | 3.01% |
| Indonesia | 0.58% | 2.25% |
| United States | 0.42% | 0.68% |
| Ukraine | 0.79% | 0.67% |
| Sweden | 0.42% | 0.33% |
Attacks via web resources
The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. Cybercriminals create malicious pages on purpose. Websites that host user-created content, such as forums, as well as compromised legitimate sites, can become infected.
Countries and territories that serve as sources of web-based attacks: the TOP 10
This section contains a geographical distribution of sources of online attacks blocked by Kaspersky products: web pages that redirect to exploits, sites that host exploits and other malware, botnet C&C centers, and so on. Any unique host could be the source of one or more web-based attacks.
To determine the geographical source of web-based attacks, domain names were matched against their actual IP addresses, and then the geographical location of a specific IP address (GeoIP) was established.
In the first quarter of 2025, Kaspersky solutions blocked 629,211,451 attacks launched from online resources across the globe. Web Anti-Virus detected 88,389,361 unique URLs.
Geographical distribution of sources of web-based attacks by country/territory, Q1 2025 (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of online infection faced by PC users in various countries and territories, for each country or territory, we calculated the percentage of Kaspersky users on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data reflects the aggressiveness of the environment in which computers operate in different countries and territories.
These rankings only include attacks by malicious objects that belong in the Malware category. Our calculations do not include Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country/territory* | %** | ||
| 1 | North Macedonia | 10.17 | |
| 2 | Albania | 9.96 | |
| 3 | Algeria | 9.92 | |
| 4 | Bangladesh | 9.92 | |
| 5 | Tunisia | 9.80 | |
| 6 | Slovakia | 9.77 | |
| 7 | Greece | 9.66 | |
| 8 | Serbia | 9.44 | |
| 9 | Tajikistan | 9.28 | |
| 10 | Turkey | 9.10 | |
| 11 | Peru | 8.78 | |
| 12 | Portugal | 8.70 | |
| 13 | Nepal | 8.38 | |
| 14 | Philippines | 8.33 | |
| 15 | Romania | 8.26 | |
| 16 | Sri Lanka | 8.20 | |
| 17 | Bulgaria | 8.19 | |
| 18 | Madagascar | 8.14 | |
| 19 | Hungary | 8.12 | |
| 20 | Egypt | 8.12 |
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.
** Unique users targeted by web-based Malware attacks as a percentage of all unique Kaspersky product users in the country/territory.
On average during the quarter, 6.46% of users’ computers worldwide were subjected to at least one web-based Malware attack.
Local threats
Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-transparent form. Examples of the latter are programs in complex installers and encrypted files.
Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the OAS (on-access scan) and ODS (on-demand scan) modules of File Anti-Virus. The data includes detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives.
In the first quarter of 2025, our File Anti-Virus detected 21,533,464 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky product users on whose computers File Anti-Virus was triggered during the reporting period. These statistics reflect the level of personal computer infection in various countries and territories across the globe.
The rankings only include attacks by malicious objects that belong in the Malware category. Our calculations do not include File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
| Country/territory* | %** | ||
| 1 | Turkmenistan | 47.41 | |
| 2 | Tajikistan | 37.23 | |
| 3 | Afghanistan | 36.92 | |
| 4 | Yemen | 35.80 | |
| 5 | Cuba | 32.08 | |
| 6 | Uzbekistan | 31.31 | |
| 7 | Gabon | 27.55 | |
| 8 | Syria | 26.50 | |
| 9 | Vietnam | 25.88 | |
| 10 | Belarus | 25.68 | |
| 11 | Algeria | 25.02 | |
| 12 | Bangladesh | 24.86 | |
| 13 | Iraq | 24.77 | |
| 14 | Cameroon | 24.28 | |
| 15 | Burundi | 24.28 | |
| 16 | Tanzania | 24.23 | |
| 17 | Niger | 24.01 | |
| 18 | Madagascar | 23.74 | |
| 19 | Kyrgyzstan | 23.73 | |
| 20 | Nicaragua | 23.72 |
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.
** Unique users on whose computers local Malware threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.
On average worldwide, local Malware threats were recorded on 13.62% of users’ computers at least once during the quarter.
securelist.com/malware-report-…
IT threat evolution in Q1 2025. Mobile statistics
IT threat evolution in Q1 2025. Non-mobile statistics
Quarterly figures
According to Kaspersky Security Network, in the first quarter of 2025:
- A total of 12 million attacks on mobile devices involving malware, adware, or unwanted apps were blocked.
- Trojans, the most common mobile threat, accounted for 39.56% of total detected threats.
- More than 180,000 malicious and potentially unwanted installation packages were detected, which included:
- 49,273 packages related to mobile bankers
- 1520 mobile ransomware Trojans.
Quarterly highlights
Attacks on Android devices involving malware, adware, or potentially unwanted apps in the first quarter of 2025 increased to 12,184,351.
Attacks on users of Kaspersky mobile solutions, Q3 2023 – Q1 2025 (download)
This growth was largely due to the activity of Mamont banking Trojans and Fakemoney scam apps, along with the discovery of fake popular brand smartphones that came preloaded with the Triada backdoor, capable of dynamically downloading any modules from a server. Triada’s modules possess a variety of features. They can substitute URLs in the browser, block connections to specific servers, or steal login credentials for social media and instant messaging services like TikTok, WhatsApp, Line, or Telegram. A module that steals crypto from wallets is worth separate mention. We tracked down several of the scammers’ wallets, the balances suggesting that a total of at least $270,000 had been stolen. The stolen amount in TRON cryptocurrency alone was $182,000.
A profitability chart for the threat actor’s TRON wallets (download)
The first quarter saw the discovery of a new banker that attacks users in Turkey: Trojan-Banker.AndroidOS.Bankurt.c. It masquerades as an app for viewing pirated movies.
The Trojan uses DeviceAdmin permissions to gain a foothold in the system, obtains access to Accessibility features, and then helps its operators to control the device remotely via VNC and steal text messages.
Mobile threat statistics
The number of detected Android malware and unwanted app samples increased compared to the fourth quarter of 2024, totaling 180,405.
Detected malicious and potentially unwanted installation packages, Q1 2024 – Q1 2025 (download)
Looking at the distribution of detected installation packages by type, we see that the typical frontrunners, RiskTool and adware, dropped to the third and fourth spots, respectively, in the first quarter. Banking Trojans (27.31%) and spy Trojans (24.49%) ranked as the most common threats.
Distribution of detected mobile apps by type, Q4 2024* – Q1 2025 (download)
* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.
The revision was prompted by a sharp increase in Mamont banker installation packages in the first quarter. Agent.akg, which steals text messages, accounted for the largest number of spy Trojan installation packages.
Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q4 2024 – Q1 2025 (download)
* The total may exceed 100% if the same users experienced multiple attack types.
The first quarter saw a sharp rise in the number of users attacked by Trojans. This was driven by a large number of detected devices preloaded with the Triada Trojan and the increased activity of Fakemoney scam apps, which tricked users into sharing their personal data by promising easy money. The increase in the number of users who encountered banking Trojans was, again, due to the activity of the Mamont family.
TOP 20 most frequently detected types of mobile malware
Note that the malware rankings below exclude riskware and potentially unwanted apps, such as adware and RiskTool.
| Verdict | %* Q4 2024 | %* Q1 2025 | Difference in p.p. | Change in ranking |
| Trojan.AndroidOS.Fakemoney.v | 30.33 | 26.41 | –3.92 | 0 |
| DangerousObject.Multi.Generic. | 13.26 | 19.30 | +6.04 | 0 |
| Trojan-Banker.AndroidOS.Mamont.db | 0.08 | 15.99 | +15.91 | |
| Trojan-Banker.AndroidOS.Mamont.da | 1.56 | 11.21 | +9.65 | +14 |
| Trojan-Banker.AndroidOS.Mamont.bc | 10.79 | 7.61 | –3.17 | –2 |
| Backdoor.AndroidOS.Triada.z | 0.00 | 4.71 | +4.71 | |
| Trojan.AndroidOS.Triada.hf | 0.00 | 3.81 | +3.81 | |
| Trojan.AndroidOS.Triada.fe | 0.00 | 3.48 | +3.47 | |
| Trojan.AndroidOS.Triada.gn | 2.56 | 2.68 | +0.13 | +3 |
| Trojan-Clicker.AndroidOS.Agent.bh | 0.51 | 2.58 | +2.07 | +27 |
| Trojan-Banker.AndroidOS.Mamont.ef | 0.00 | 2.44 | +2.44 | |
| Trojan-Downloader.AndroidOS.Dwphon.a | 3.40 | 2.19 | –1.21 | –2 |
| Trojan.AndroidOS.Fakemoney.u | 0.02 | 1.88 | +1.86 | |
| Trojan-Banker.AndroidOS.Agent.rj | 3.63 | 1.86 | –1.77 | –7 |
| Trojan-Banker.AndroidOS.Mamont.ek | 0.00 | 1.83 | +1.83 | |
| Trojan.AndroidOS.Triada.ga | 4.84 | 1.74 | –3.10 | –11 |
| Trojan-Banker.AndroidOS.Mamont.eb | 0.00 | 1.59 | +1.59 | |
| Trojan-Banker.AndroidOS.Mamont.cb | 1.09 | 1.56 | +0.47 | +4 |
| Trojan.AndroidOS.Triada.gs | 3.63 | 1.47 | –2.16 | –13 |
| Trojan-Banker.AndroidOS.Mamont.dn | 0.00 | 1.46 | +1.46 |
* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.
Nearly the entire list was occupied by the aforementioned Fakemoney apps and various Mamont banking Trojan variants, along with preloaded Backdoor.AndroidOS.Triada.z, and Trojan.AndroidOS.Triada.hf malicious apps. Additionally, remaining among the most prevalent Android malware were modified messengers with the embedded Triada Trojan (Triada.fe, Triada.gn, Triada.ga, Triada.gs) and the preloaded Dwphon Trojan. What is interesting is the inclusion of the Trojan-Clicker.AndroidOS.Agent.bh sample on the list. This is a fake ad blocker that, conversely, inflates ad views.
Region-specific malware
This section describes malware families that mostly focused on specific countries.
| Verdict | Country* | %** |
| Trojan-Banker.AndroidOS.Coper.a | Turkey | 96.85 |
| Trojan-Banker.AndroidOS.Rewardsteal.ks | India | 94.36 |
| Trojan-Banker.AndroidOS.Coper.c | Turkey | 94.29 |
| Trojan-Banker.AndroidOS.Rewardsteal.jp | India | 93.78 |
| Trojan-Banker.AndroidOS.BrowBot.w | Turkey | 92.81 |
| Trojan-Banker.AndroidOS.Rewardsteal.ib | India | 92.79 |
| Trojan-Banker.AndroidOS.Rewardsteal.lv | India | 92.34 |
| Trojan-Spy.AndroidOS.SmForw.ko | India | 90.71 |
| Trojan-Banker.AndroidOS.UdangaSteal.k | India | 90.12 |
| Trojan-Dropper.AndroidOS.Hqwar.bf | Turkey | 88.34 |
| Trojan-Banker.AndroidOS.Agent.rg | India | 86.97 |
| Trojan-Dropper.AndroidOS.Agent.sm | Turkey | 82.54 |
* The country where the malware was most active.
** Unique users who encountered this Trojan variant in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same variant.
The first quarter saw a somewhat smaller number of “selective” malicious apps than before. As usual, Turkey experienced a prevalence of banking Trojans: Coper, equipped with RAT capabilities enabling attackers to steal money through remote device management; BrowBot, which pilfers text messages; and the banking Trojan droppers Hqwar and Agent.sm. In India, users faced Rewardsteal banking Trojans which stole bank details by pretending to offer money. Additionally, the UdangaSteal Trojan, previously prevalent in Indonesia, and the SmForw.ko Trojan, which forwards incoming text messages to another number, also spread to India.
Mobile banking Trojans
Number of installation packages for mobile banking Trojans detected by Kaspersky, Q1 2024 – Q1 2025 (download)
The increase in the number of installation packages for banking Trojans was primarily driven by Mamont. Its creators apparently follow a MaaS model, enabling any scammer to get a custom variant generated for a fee. As a result, a large number of unrelated cybercriminals are spreading distinct versions of Mamont.
When it comes to the percentage of users targeted, various versions of Mamont are also mainly at the top.
Top 10 mobile bankers
| Verdict | %* Q4 2024 | %* Q1 2025 | Difference in p.p. | Change in ranking |
| Trojan-Banker.AndroidOS.Mamont.db | 0.41 | 38.07 | +37.67 | +18 |
| Trojan-Banker.AndroidOS.Mamont.da | 7.71 | 26.68 | +18.98 | +1 |
| Trojan-Banker.AndroidOS.Mamont.bc | 53.25 | 18.12 | –35.13 | –2 |
| Trojan-Banker.AndroidOS.Mamont.ef | 0.00 | 5.80 | +5.80 | |
| Trojan-Banker.AndroidOS.Agent.rj | 17.93 | 4.43 | –13.50 | –3 |
| Trojan-Banker.AndroidOS.Mamont.ek | 0.00 | 4.37 | +4.37 | |
| Trojan-Banker.AndroidOS.Mamont.eb | 0.00 | 3.80 | +3.80 | |
| Trojan-Banker.AndroidOS.Mamont.cb | 5.39 | 3.71 | –1.67 | –4 |
| Trojan-Banker.AndroidOS.Mamont.dn | 0.00 | 3.48 | +3.48 | |
| Trojan-Banker.AndroidOS.Creduz.q | 0.00 | 1.43 | +1.43 |
securelist.com/malware-report-…
China intelligence. Tecniche, strumenti e metodologie di spionaggio e controspionaggio della Repubblica Popolare Cinese
Secondo la rivista MIT Technology Review, la ricerca decennale della Cina per diventare una superpotenza informatica sta dando i primi frutti. Dalla salita al potere di Xi Jinping l’evoluzione delle capacità cibernetiche della Cina si è rivelata inarrestabile e le molteplici operazioni condotte nel mondo virtuale confermano un chiaro sviluppo di capacità asimmetriche che le consentono di conseguire quasi sistematicamente gli obiettivi perseguiti.
E proprio di questo parla il libro il libro di Antonio Teti, China intelligence. Tecniche, strumenti e metodologie di spionaggio e controspionaggio della Repubblica Popolare Cinese (Rubettino, 2024).
Il testo è una descrizione scrupolosa delle tecniche d’attacco e difesa, spionaggio e controspionaggio, analogiche e digitali, impiegate dal paese del Dragone. Le attività di spionaggio informatico cinese – racconta Teti – sono affidate alla principale agenzia di intelligence nazionale, ovvero al Ministero della Sicurezza di Stato, che ha la responsabilità della conduzione del maggior numero di operazioni di cyber-espionage a livello globale. I target sono tipo essenzialmente di tipo politico, economico, industriale e militare.
Ma poi aggiunge che anche le psy-ops, le psychological operations, ovvero le operazioni di guerra psicologica che Pechino inserisce all’interno della strategia delle three warfares (guerra psicologica, legale e dell’opinione pubblica), sono affidate a unità altamente specializzate con lo scopo d’influenzare l’emotività e le percezioni degli avversari onde modificarne i comportamenti.
Il professore universitario di Chieti, dopo avere descritto la complessa architettura cinese di cybersicurezza, il ruolo delle sue aziende di punta come Huawei e Tencent nell’industria cyber, e l’obbligo per singoli e imprese di collaborare con l’intelligence offrendo informazioni e testimonianze, descrive in maniera minuziosa le tattiche, da manuale, su come trasformare ogni singolo cittadino in una vedetta dello Stato, ovvero in un delatore o una spia, attraverso lusinghe e minacce di varia natura. Con una curiosa appendice: l’uso dei fumetti – che tappezzano i trasporti pubblici urbani – per istruire le persone comuni a difendersi dalle spie straniere. Oppure ad utilizzarle.
Il libro presenta una fitta disamina delle tecniche di spionaggio e controspionaggio che usano il fattore umano come cavallo di Troia per insinuarsi tra le difese del nemico; descrive i casi ormai noti, denunciati da Francia e Germania, in cui funzionari dell’intelligence cinese hanno avvicinato circa 10 mila inglesi e 4 mila francesi, funzionari di Stato, accademici e ricercatori, per proporgli via Linkedin allettanti “proposte di lavoro”.
Il saggio si chiude con la lista delle 33 spie cinesi individuate dalla FBI statunitense prima delle ultime due pagine dedicate al caso Tik Tok, strumento di influenza cinese nel mondo, per il contenzioso aperto dal presidente americano Joe Biden con la proprietà cinese ByteDance e non ancora chiuso dalla nuova amministrazione americana a causa degli stop and go dell’attuale inquilino della Casa Bianca, Donald Trump.
