Black Basta Team and double extortion ransomware attacks

Protect smartphones and tablets from cyber risks: the mobile security

 View all
Blog

CYBER THREAT INTELLIGENCE

For years, Telsy has been involved in identifying and monitoring new cyber threats emerging at European and global level, thus contributing to the protection of the IT perimeter of its customers and the nation itself.

Sort by:
From older
From most recent
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Black Basta Team and double extortion ransomware attacks

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
APT29: focus on a Russian state-sponsored opponent

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
TS-Intelligence: The Advanced Cyber Threat Intelligence Platform from Telsy and TS-WAY  

In the ever-evolving digital age, cybersecurity has become a must-have priority for organizations of all sizes and industries.      The increasing frequency and sophistication of cyber-attacks threaten sensitive data, reputation,...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Red Teaming

Red Teaming is an ethical hacking methodology that helps assess a company’s ability to detect, prevent and respond to sophisticated and targeted threats, as well as identify and quantify existing...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Cyber Threat Intelligence: knowing and anticipating threats

Success in the digital age depends on the ability to validate complex information and leverage it to lead change. For organizations, it is today necessary to equip themselves with tools...
CYBER THREAT INTELLIGENCE
Microsoft Exchange servers exploited with OWASSRF

Executive Summary In December 2022, Telsy Incident Response Team was called upon to handle a cyber security incident. The analysis conducted detected the execution of PowerShell code by exploiting a...
CYBER THREAT INTELLIGENCE
Microsoft Exchange servers backdoored with OwlProxy

Introduction In early 2022, Telsy observed malicious cyber activity in the Microsoft Exchange infrastructure. The analysis conducted revealed the presence of a malicious DLL, called “fuscom.dll“, and its persistence by...
CYBER THREAT INTELLIGENCE
Legitimate Sites used as Cobalt Strike C2s against Indian Government

Introduction Telsy Threat Intelligence team observed an attack against members of the Indian government or local institutions, which uses social engineering themes as an investigation for a cyber attack or...
CYBER THREAT INTELLIGENCE
BabaDeda and LorecCPL downloaders used to run Outsteel against Ukraine

Telsy CTI Team found and followed insights from the Ukraine question, new IoCs, and the evolution of the tools employed in the attacks.   Beginning in January 2022, there was...
CYBER THREAT INTELLIGENCE
SideCopy APT: from Windows to *nix

Telsy Threat Intelligence team has observed a spear-phishing campaign conducted by cyber-espionage group SideCopy against critical government entities in India.    SideCopy APT: from Windows to *nix As previously published...
CYBER THREAT INTELLIGENCE
Phishing Campaign targeting citizens abroad using COVID-19 theme lures

Telsy Threat Intelligence team has identified a phishing campaign that appears to be targeting citizens abroad by exploiting the COVID-19 theme associated with a potential embassy lockdown status.   Introduction...
CYBER THREAT INTELLIGENCE
NOBELIUM again or eCrime operation?

Telsy Threat Intelligence team identified a phishing campaign that seems to target multiple victims based in the United States, Great Britain, and Europe. The campaign appears to have been active since...
CYBER THREAT INTELLIGENCE
Possible attack to Telco company in Middle East

Telsy Threat Intelligence team identified a possible Grunt Covenant multi-stage attack aimed at a major telecommunications company in Iran.   Introduction In this article, we will look at the different steps...
CYBER THREAT INTELLIGENCE
Dissecting new AppleSeed backdoor of Kimsuky threat actor

Telsy analyzed the cyber espionage group known as Kimsuky in a particular spear phishing campaign.   Introduction The Telsy Threat Intelligence team trackings various threat actors, among them the cyber espionage...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
New malicious campaign spreading Windows and Linux backdoors

Telsy analyzed a new malicious campaign spreading Linux and Windows backdoors.   Introduction This type of campaign starts by exploiting known vulnerabilities related to the target technologies and then performs...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Lazarus Group continues AppleJeus Operation

Telsy analyzed new samples related to the threat actor Lazarus Group and in particular to the “AppleJeus Operation”.   Introduction While some of the details have changed, the methods used...
CYBERSECURITY, CYBER THREAT INTELLIGENCE, NEWS
Google Drive abused in document exfiltration operation against Afghanistan

Telsy analyzed a new campaign that targeted Afghanistan and aimed to steal documents.   Introduction Telsy last June analyzed a new campaign that targeted Afghanistan, specifically researchers and government employees....
CYBERSECURITY, CYBER THREAT INTELLIGENCE, NEWS
REMCOS and Agent Tesla loaded into memory with Rezer0 loader

An Italian government email has been targeted by a phishing campaign. The attack’s goal aimed to install some remote control and information-stealing tool.   What’s happened During the last month,...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Cyber threats & economic intelligence: the deadly mix to national security

The ongoing exploit of emerging technologies to carry out cyberattacks is not just a matter concerning gangs of hackers and threat actors asking for ransoms, but also affects national security....
CYBER THREAT INTELLIGENCE
Erecting an IT fortress: strategies for resilience

Erecting an IT fortress is an urgent need these days. Facing the surge in cyber-attacks of these times, companies will need to adopt new strategies, procedures, and technologies to become...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Maze: a short story of one of the most dangerous cyberthreats

The Maze group has been one of the subtlest hacking groups in recent history. The maze was a hacking group targeting organizations worldwide across many industries. It has recently announced...
CYBERSECURITY, CYBER THREAT INTELLIGENCE, NEWS
Kevin Mitnick: the computer-break-in artist

Kevin Mitnick was the most elusive computer break-in artist in history. Security experts often refer to him as “The World’s Most Wanted Hacker.” Indeed, the US Feds took almost three...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Turin Polytechnic under attack: what you should know

A hacker attack has temporarily disabled Turin Polytechnic’s online services servers for a few hours. What did happen? Was it a severe violation? Let’s find it out together! What did...
CYBER THREAT INTELLIGENCE
When a false flag doesn’t work: Exploring the digital-crime underground at campaign preparation stage

At the beginning of October 2020 we found copy of a malicious document potentially to be attributed to an APT group known with the name of APT34 / OilRig. The...
CYBER THREAT INTELLIGENCE
QNodeService stepped up its features while operated in widespread credential-theft campaigns

Since mid-year 2020, a new piece of malware emerged in the cyber threat landscape. It seems to be linked to the crimeware matrix due its main purpose and use, which...
CYBER THREAT INTELLIGENCE
Trying not to walk in the dark woods. A way out of the Maze

After numerous ransomware attacks since its appearance in May 2019, the popular Maze Team recently claimed the end of its criminal activity through a press release on its Dedicated Leak...
CYBER THREAT INTELLIGENCE
Operation “Space Race”: reaching the stars through professional Social Networks

At the beginning of May 2020, Telsy analyzed some social-engineering based attacks against individuals operating in the aerospace and avionics sector performed through the popular professional social network LinkedIn. According...
CYBER THREAT INTELLIGENCE
Turla / Venomous Bear updates its arsenal: “NewPass” appears on the APT threat scene

  Recently Telsy observed some artifacts related to an attack that occurred in June 2020 that is most likely linked to the popular Russian Advanced Persistent Threat (APT) known as...
CYBER THREAT INTELLIGENCE
Unicredit employees database for sale on cyber-crime forums

On the late afternoon of 19/04/2020, a threat actor posted a new sale on a hacking and cyber-crime forum selling the database of UniCredit employees. UniCredit S.p.A. is an Italian...
CYBERSECURITY, CYBER THREAT INTELLIGENCE
Cybercriminals trojanized orginal SM Covid-19 awareness Android app to target Italy

In these days of particular sacrifices due to the spread of the COVID-19 pandemic, cyber criminals do not seem to save anyone and on the contrary, taking advantage of the...
CYBER THREAT INTELLIGENCE
APT34 (aka OilRig, aka Helix Kitten) attacks Lebanon government entities with MailDropper implants

Very recently another custom malicious implant that seems to be related to APT34 (aka OilRig) has been uploaded to a major malware analysis platform. Since 2014, year in which FireEye...
CYBER THREAT INTELLIGENCE
Meeting POWERBAND: The APT33 .Net POWERTON variant

Introduction Since the Islamic revolution, US and regional rivals have put continuos effort in containing and isolating Iran. Implementing a foreign policy generally addressed as “strategic loneliness”, Iran’s defense strategy...
CYBER THREAT INTELLIGENCE
The Lazarus’ gaze to the world: What is behind the second stone ?

Introduction In a recent blog post (link here) we analysed the first part of an operation likely conducted by APT38/Lazarus, which targeted various organizations, including financial and banking ones. We...
CYBER THREAT INTELLIGENCE
The Lazarus’ gaze to the world: What is behind the first stone ?

Introduction Lazarus (aka APT38 / Hidden Cobra / Stardust Chollima) is one of the more prolific threat actors in the APT panorama. Since 2009, the group leveraged its capability in...
CYBER THREAT INTELLIGENCE
DeadlyKiss: Hit one to rule them all. Telsy discovered a probable still unknown and untreated APT malware aimed at compromising Internet Service Providers

In the first days of September 2019, Telsy Cyber Threat Intelligence Unit received a variant of a strange and initially mysterious malware from a stream of thousands of samples coming...
CYBER THREAT INTELLIGENCE
Zebrocy relies on dropbox and remote template injection to supply its dishes to an institution of Eastern Europe diplomatic sector.

Introduction On the 22nd of August 2019, a new spear-phishing email message has been collected by Telsy CTI Team. This malicious email has been armed with an attached lure document...
CYBER THREAT INTELLIGENCE
PRIMITIVE BEAR USES A NATO-THEMED LURE DOCUMENT TO TARGET UKRAINIAN GOVERNMENT AND DEFENSE AGENCIES

Recently we caught a NATO-themed malicious lure document to be likely associated with a new PRIMITIVE BEAR operation conducted against Ukrainian defense and government agencies. According to its metadata, the...
CYBER THREAT INTELLIGENCE
Unknown threat actor is using Agent Tesla variants against Oil&Gas and Energy Sector

On 02/07/2019, Telsy TRT catched a new malware variant belonging to Agent Tesla family addressed to companies operating in the Energy and Oil&Gas sector. Among these organizations, Telsy identifies a...
CYBER THREAT INTELLIGENCE, NEWS
Recent “CEO Fraud” campaign is spreading within EU and already made victims. Telsy TRT joined an international collaborative effort for researching and mitigating the threat.

In the first days of May 2019, Telsy TRT joined a collaborative international effort aimed at studying, researching and mitigating a recent malicious campaign carried out by a criminal gang...
CYBER THREAT INTELLIGENCE
APT34: New leaked tool named Jason is available for the mass

In the afternoon of 03/06, Lab Dookhtegan released a new tool they report belonging to the hacking arsenal of the group APT34. This hacking tool seems to be useful in...
CYBER THREAT INTELLIGENCE
Following the Turla’s Skipper over the ocean of cyber operations

In the middle of May 2019 new malware variants identified to be part of Turla suite comes into light. Turla, also known as Snake or Uroburos is one of the...
CYBER THREAT INTELLIGENCE
Telsy TRT releases its YARA rule to detect Turla LightNeuron, the Microsoft Exchange backdoor

A recent APT malware infection, known as LightNeuron, uses the basic functions of Microsoft’s Exchange Server to monitor and control outgoing and incoming communications from mail servers. The threat group...
CYBER THREAT INTELLIGENCE
Unknown threat actor is using a compromised website belonging to a government institution of Middle-East in a campaign referring commercial and financial themes.

Recently, Telsy TRT detected a wave of malicious documents trying to impersonate an official institution of a government of Middle-East. Moreover, the website of another government institution of the same...
CYBER THREAT INTELLIGENCE
Protected: “AVE_MARIA”; it’s not our Sunday prayer. It’s a cheap, publicly referenced and advertised RAT. OSINT insights by TTRT.

There is no excerpt because this is a protected...
CYBER THREAT INTELLIGENCE
Threat Hunters vs Red Teamers. A meeting in the cyber space…

Recently, a new wave of malicious decoy Microsoft Office documents addressed exclusively to a central country of the european geographical area was intercepted by Telsy TRT. These have been collected...
CYBER THREAT INTELLIGENCE
OceanLotus On ASEAN Affairs

In last days of March, Telsy TRT captured same malicious macro armed documents likely tergeting ASEAN affairs and meeting members. Telemetry and spreading statistics related to these decoy documents highlight...