Author: marcoramilli

Ci sono momenti che ti cambiano, alcuni per il dolore causato mentre altri per la grande gioia.  Questa e’ la mia fortunata storia di un tempo che ha cambiato la mia vita. Durante gli ultimi cinque anni ho avuto la fortuna di creare una organizzazione da zero, di farla nascere, di custodirla, di partecipare ad […]

Read More [ITA] Gratitudine e Cambiamento

Today I’d like to share a quick analysis on a quite new and unknown threat spotted in the wild. The file which grabbed my attention is called Loader.js (md5: 59a03086db5ebd33615b819a7c3546a5) and if you wish you can download it from Yomi. A very similar (or maybe the same) threat has been observed in the past months […]

Read More Threat Actor: Unkown

Advanced and Persistent Threats are often inoculated by emails or by exploiting exposed vulnerabilities. Since vulnerability exploitation follows specific waves, it depends on vulnerability trends, the email vector become one of the most (ab)used and stable way to inoculate Malicious and unwanted software. A common way to attack victims is to make her open an […]

Read More Tracking PhishingKits for Hunting APT Evolution

According to the Yoroi annual cyber security report (available HERE), to Cyber Threat Trends (available HERE) and to many additional resources, Microsoft Office files (Word documents and Excel spreadsheet) are one of the most used malware loaders in the current era. Attackers lure victims, by seducing them to open a specially crafted Office document, which […]

Read More How to Reverse Office Droppers: Personal Notes

If you are a security researcher or even a passionate about how attackers implement phishing you will find yourself to look for phishing kits. A phishing kit is not a phishing builder, but a real implementation (actually re-implementation) of a third party website built to lure your victim. Initially attackers use a phishing builder to […]

Read More Introducing PhishingKitTracker

Hi Folks, today I want to share a quantitative analysis on a weird return-match by Upatre. According to Unit42 Upatre is an ancient downloader firstly spotted in 2013 used to inoculate banking trojans and active up to 2016. First discovered in 2013, Upatre is primarily a downloader tool responsible for delivering additional trojans onto the […]

Read More Is upatre downloader coming back ?