ITW exploits and new 0-days, global state-sponsored operations, AI frameworks and emerging threats

OT attacks and cyber breaches, APT and cyberspionage campaigns, AI frameworks and emerging threats

 View all

Blog

Discover, learn more and keep up to date on the trends and latest news in the world of cybersecurity and cryptography.

Spotlight
ITW exploits and new 0-days, global state-sponsored operations, AI frameworks and emerging threats

Vulnerabilities: Google and Microsoft 0-days and several flaws exploited ITW Over the past week, numerous actively exploited vulnerabilities were detected, including two Google Chrome and Microsoft Outlook 0-days and several...

 Read more
Threat Intelligence
Legal
Cybersecurity
Cryptography
Quantum Security
News
All articles
Threat Intelligence
Legal
Cybersecurity
Cryptography
Quantum Security
News
All articles
Sort by:
From older
From most recent
Threat Intelligence, News
ITW exploits and new 0-days, global state-sponsored operations, AI frameworks and emerging threats

Vulnerabilities: Google and Microsoft 0-days and several flaws exploited ITW Over the past week, numerous actively exploited vulnerabilities were detected, including two Google Chrome and Microsoft Outlook 0-days and several...
Threat Intelligence, News
OT attacks and cyber breaches, APT and cyberspionage campaigns, AI frameworks and emerging threats

Cyberattacks and compromises: from industrial systems to digital platforms Between 1 and 2 November 2026, a series of cyberattacks affected refrigeration systems at supermarkets and commercial businesses in several European...
Threat Intelligence, News
PHP2Shell, Fragnesia and new ITW exploits, APT and cyberspionage operations, the latest from Italy

Vulnerabilities: new developments concerning PHP2Shell and active exploitation of flaws in Linux, Brotli and enterprise products During the week, developments concerning CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), collectively known as PHP2Shell,...
Threat Intelligence, News
PHP2Shell and new ITW exploits, APT and cyberspionage operations, the latest from Italy

Vulnerabilities: active exploitation of vulnerabilities in PHP, Plex, Siemens, Nextcloud and BeyondTrust During the week, the landscape of vulnerabilities exploited in the wild (ITW) was marked by an intensification of...
Threat Intelligence, News
Attacks targeting Italy, APT and cyberspionage campaigns, new vulnerabilities exploited ITW

Italy: DDoS attacks, ransomware and smishing operations Over the past week, the pro-Russian collective NoName057(16) once again turned its attention to Italy, targeting several portals, including: Municipality of Bari; DGS...
Threat Intelligence
China and the BRICS Card in the Geostrategic Game Over AI

Concerns Among Experts in the U.S. and China The concerns expressed in the West regarding the still-unknown potential of AI technologies and the risks we face in the absence of...
Threat Intelligence, News
Italy targeted by multiple adversaries, new cyberspionage and cybercrime campaigns, law enforcement operations and security incidents

Italy: attacks from multiple threat actors detected Over the past week, the pro-Russian hacktivist collective NoName057(16) renewed its focus on Italy, targeting the country over its military support for Ukraine...
Threat Intelligence, News
The latest from Italy, ITW exploits and new 0-days, Oxygen Forensics, breaches and arrests

Italy: phishing, hacktivism and new ransomware claims A “documents”-themed phishing campaign has been identified in Italy, exploiting the name and logo of the National Research Council (CNR) to exfiltrate employees’...
Threat Intelligence, News
Italy targeted by multiple adversaries, APT and cyberspionage campaigns, breaches and AI

Italy: attacks from multiple threat sources detected The pro-Russian hacktivist collective NoName057(16) has once again targeted Italian portals. According to the group, the country was targeted because it had allegedly...
Threat Intelligence
AI and Security Alerts: A Technological Challenge to Human Biases

The OpenAI-Hugging Face case was not the first The OpenAI-Hugging Face incident marked a turning point in the AI-security debate. The rapid race to increase capabilities and performance seems to...
Threat Intelligence, News
The latest from Italy, international cybercrime operations, updates from Tehran and Beijing

Italy: Revolut data breach, ransomware claims and phishing In September 2026, Revolut confirmed that it had disclosed sensitive information belonging to a limited number of customers in response to fraudulent...
Threat Intelligence, News
BlueMoon used in espionage campaigns, the latest developments on the APT front, global cybercrime activity and operations targeting Italy

BlueMoon: 0-day exploit kit rapidly adopted in espionage campaigns Between late August and early September 2026, BlueMoon, a new exploit kit used by espionage-focused groups in targeted spear phishing campaigns,...
Threat Intelligence, News
New ITW-exploited vulnerabilities, breaches and international law enforcement activity, new global APT operations

Vulnerabilities: 0-days and ITW flaws On August 28, 2026, PaperCut released a second emergency patch (Emergency Patch Release 2) for versions 24, 25 and 26 in relation to the 0-day...
Threat Intelligence, News
New offensives in Italy, the latest from the APT landscape, international cyber operations

Italy: phishing attacks and ransomware claims This week, several phishing operations were identified in Italy. An email using the name and logo of the Ministry of Health, pretending to offer...
Threat Intelligence
Cybersecurity and AI Agents: A Double-Edged Sword Without a Handle?

The Joint Alert from the Five Eyes Cybersecurity Agencies On June 22, 2026, the Five Eyes cybersecurity agencies (Australia, the United States, the United Kingdom, New Zealand and Canada) issued...
Threat Intelligence, News
Phishing and Ransomware in Italy: Data Breach Affects Government Agencies and Cryptowallet Providers; Chinese APT Campaigns

Italy: phishing and ransomware campaigns Over the past week, several phishing campaigns have been detected involving fraudulent websites mimicking those of major financial and government organizations. A clone portal of...
Cryptography
The Kasiski Method: what it is, how it works, and why it’s important in cryptography

The Kasiski Method is a fundamental technique in classical cryptography used to break polyalphabetic ciphers, particularly the famous Vigenère cipher. Developed in the 19th century by the German cryptographer Friedrich...
Threat Intelligence, News
Attacks in Italy, offensive campaigns and APT activity, compromises and global efforts to counter North Korean threats

Italy: multiple malicious activities observed Security researchers identified two phishing websites targeting Telepass customers. Data entered by victims is intercepted instantly via WebSocket (WSS), ensuring successful theft even if the...
Cryptography
The Vigenère Cipher: one of the most famous encryption systems in history

The Vigenère cipher is one of the most famous encryption systems in history. Used to protect sensitive messages and confidential communications, it represents an evolution of the simpler Caesar cipher....
Threat Intelligence, News
Novel APT Operations, In-the-Wild Exploits and New 0-Days, High-Profile Compromises

APT: new operations conducted across Eurasia and the Middle East Since at least July 2025, the Russian state-sponsored group Void Blizzard (also known as Laundry Bear, CL-STA-1114, and TA488) has...
Threat Intelligence
The 2026 FIFA World Cup: Old Cyber Threats and New Challenges

A Risk Scenario That Was No Longer New—But Featured a New Factor The FIFA World Cup 2026 took place from 11 June to 19 July across the United States, Mexico...
Cybersecurity, News
New exploit chains and exploitation activity, AI between autonomous capabilities and offensive use, cyber incidents and campaigns

Vulnerabilities: Pre-auth RCE exploit chain in WordPress and new evidence of in-the-wild exploitation On July 17, 2026, WordPress released versions 6.9.5 and 7.0.2 to address two core vulnerabilities, CVE-2026-63030 and...
Threat Intelligence, News
Italy Targeted by Multiple Adversaries, Developments in the APT Landscape, Vulnerabilities Exploited ITW

Italy: multiple Malicious Activities Observed Several malicious activities targeting Italy have been identified. A smishing campaign was detected leveraging the theme of a purported failed delivery in the name of...
Cryptography, Quantum Security
New post-quantum digital signatures: NIST announces the third round candidates

Introduction On May 14, 2026, the National Institute of Standards and Technology (NIST) published the schemes selected for the third round of the additional process for standardizing post-quantum digital signatures. With the...
Threat Intelligence, News
The latest from Italy, emerging APT operations, newly announced breaches, and law enforcement activity

Italy: malware, smishing, and ransomware activity On July 9, 2026, security researchers identified a campaign in Italy impersonating the UniCredit brand by promoting a fake banking rewards program designed to...
Threat Intelligence, News
Cybercrime operations, developments in the APT landscape, data breaches and Police activities

Cybercrime: new campaigns and ransomware activity A new active campaign dubbed StrikeShark has been identified, targeting organizations across multiple countries and sectors through the deployment of previously unseen malware named...
Threat Intelligence, News
Attacks in Italy, cybercrime operations, developments in the APT and hacktivist landscape

Italy: cybercrime and hacktivist activities Several active phishing operations have been detected in Italy that fraudulently exploit the name, logo, and visual identity of the Italian Revenue Agency (Agenzia delle...
Threat Intelligence
New Cybersecurity Challenges in the Healthcare Sector

The Clusit Report on Cybersecurity in Italy and Worldwide – 2026 includes a focus section entitled The Fragility of Digital Healthcare: Rising Attacks, New AI-Driven Risks, and an Ever-Expanding Perimeter, prepared...
Threat Intelligence, News
Italy targeted by multiple adversaries, developments in the APT landscape, vulnerabilities exploited ITW

Italy: several malicious activities observed A phishing campaign has been detected in Italy that abuses the identity of the Postal Police’s Online Public Security Office (Commissariato di P.S. Online) to...
Threat Intelligence, News
Multiple breaches announced, vulnerabilities exploited ITW, attacks in Italy

Breaches: University of Oxford, World Food Programme (WFP), Tchap and ServiceNow targeted Third-party provider Group GTI, responsible for the CareerConnect platform used by the University of Oxford, informed the institution...
Threat Intelligence, News
NoName057(16) targets Italy, new cybercrime offensives, the latest from Moscow and Pyongyang

Italy: DDoS offensives targeting Italian organizations Following the trend observed last week, the pro-Russian hacktivist collective NoName057(16) renewed its focus on Italy. The adversary claimed DDoS attacks against the following...
Threat Intelligence, News
Italy targeted by multiple adversaries, novel APT operations, emerging threats, and supply chain compromises

Italy: New ransomware claims The pro-Russian hacktivist collective NoName057(16) has resumed targeting Italian websites following the allocation of an additional €10 million in support of Ukraine for the restoration of...
Threat Intelligence, News
Offensive supply chain, unprecedented APT operations, new vulnerabilities exploited ITW

Threat: multiple supply chain attacks detected On May 13, 2026, OpenAI published an official statement confirming that it had been affected by the supply chain attack known as Mini Shai-Hulud....
Threat Intelligence, News
PCPJack and infected npm packages observed, new attacks targeting the peninsula, several vulnerabilities reported

Threat: PCPJack worm and several supply chain attacks tracked Security researchers have tracked an active credential theft campaign that uses a worm called PCPJack and targets exposed Linux cloud infrastructure,...
Cybersecurity
Supply chain attacks

Supply chain attacks represent one of the most significant evolutions in today’s cyber threat landscape. Unlike traditional campaigns, which directly target the victim organization, this offensive model exploits the compromise...
Threat Intelligence, News
New attacks in Italy, malware and supply chain offensives detected, data breaches reported

Italy: several malicious activities observed A phishing campaign has been detected in Italy that uses a malicious clone of the Caritas Italiana website to carry out identity theft against citizens,...
Threat Intelligence
Handala: one of the faces of pro-government hacktivism in Iran

During the first month of the war launched by Israel and the United States against Iran, two groups—Handala and Homeland Justice—stood out among pro-Tehran collectives. Analysts have long linked both...
Threat Intelligence, News
Updates in cybercrime, the latest from Italy, several ITW exploits emerged

Cybercrime: several global campaigns reported A group called UNC6692 conducted a multi-stage intrusion campaign – based on social engineering techniques and a modular suite of custom malware called SNOW –...
Threat Intelligence, News
Cybercrime in Italy, new data breaches, vulnerabilities in Microsoft Defender

Italy: new phishing and ransomware attacks A new phishing campaign has been detected in Italy exploiting the name of the Ministry of Health to exfiltrate personal and credit card data....
Threat Intelligence, News
New attacks in Italy, novel APT operations, reported data breaches

Italy: multiple malicious activities observed A phishing campaign has been detected in Italy leveraging the name of the Agenzia delle Entrate–Riscossione with the aim of stealing login credentials belonging to...
Cryptography, Quantum Security
CROSS: Code-Based Digital Signature

[latexpage] Introduction In 2022, NIST launched a second standardization process for post-quantum digital signature schemes, with the goal of diversifying the mathematical foundations of the cryptographic portfolio with respect to the schemes...
Threat Intelligence, News
Latest from Italy, updates in the state-sponsored landscape, ransomware and leaks

Italy: several malicious activities observed In the past week, several offensives have targeted Italian entities. Specifically, Microsoft reported an advanced phishing campaign exploiting the legitimate “device code flow” authentication mechanism...
Threat Intelligence, News
Attacks in Italy, several breaches announced, new state-sponsored operations

Italy: spyware, breaches, ransomware and DDoS WhatsApp notified approximately 200 users, primarily in Italy, that they had been targeted through a counterfeit version of its iPhone application containing spyware. Those...
Threat Intelligence, News
War in Iran and cyber operations, offensive activity in Italy, iOS threats, and phishing campaigns

Iran: cyber offensives linked to the conflict In the context of the escalation between the United States, Israel, and Iran, the cyber domain continues to represent a relevant operational space,...
Cybersecurity
AI-Powered Phishing: The New Frontier of Cyber Threats

In recent years, phishing has evolved from a rudimentary technique into a sophisticated and highly targeted tool, capable of striking individuals and organizations with increasing precision. Today, the integration of...
Threat Intelligence, News
EU Sanctions Against Iran and China, Beijing’s Activities in Asia and the Gulf, New iOS Exploit Kit

EU: Sanctions on Chinese and Iranian Entities for Cyberattacks and Internal Repression The Council of the European Union has imposed restrictive measures against three entities and two individuals held responsible...
Threat Intelligence
The Milan-Cortina 2026 Olympic and Paralympic Games: an unprecedented test of cyber resilience

The Milan-Cortina 2026 Olympic and Paralympic Games were a paradigmatic and unprecedented global event due to certain distinctive characteristics, such as the fragmented geographical distribution of the competitions and the...
Threat Intelligence, News
Cyber operations in the Iranian conflict, attacks in Italy, developments in the APT landscape

Iran: cyberattacks in the context of the conflict Within the context of the escalation between the United States, Israel, and Iran, the cyber domain continues to represent a significant operational...
Threat Intelligence, News
Iranian conflict and cyber warfare, attacks in Italy, LeakBase and Tycoon 2FA disrupted

Iran: cyber offensives linked to the conflict The conflict between the United States, Israel, and Iran has unfolded alongside extensive cyber operations, with reports of widespread internet disruptions, hacking of...
Threat Intelligence, News
Latest from Italy, updates in the APT landscape, multiple vulnerabilities exploited ITW

Italy: multiple malicious activities observed Over the past week, several offensive operations targeted Italian entities. Specifically, a new distribution campaign involving a malware strain named UpCrypter was tracked, inducing targets...
Threat Intelligence, News
Phishing and ransomware in Italy, notified data breaches, new spyware attacks

Italy: cybercrime operations across the peninsula A resurgence of activity linked to a thread hijacking campaign documented in December 2025 has recently been identified. The campaign targets organizations based in...
Threat Intelligence, News
New attacks in Italy, reported data breaches, AI and cybersecurity

Italy: offensives target the country and the Olympic Games Over the past week, several attacks targeting Italian entities were tracked. The Municipality of Chioggia and SST Chioggia reported they are...
Legal
The role of ISO certifications in ACN cloud qualification: security and quality for the Public Administration

Since these are internationally recognized standards that define benchmark requirements for management systems across various fields and operational sectors, certifications issued by the International Organization for Standardization (ISO) carry importance...
Threat Intelligence, News
DDoS and ransomware in Italy, supply-chain attacks, new Russian offensives

Italy: attacks on various portals linked to the Winter Olympic Games, with ransomware claims After targeting German and Ukrainian entities, the pro-Russian collective NoName057(16) redirected its DDoS attacks against several...
Threat Intelligence
Surveillance and counter-espionage in Iran

In order to deal with the new intense wave of popular protests, the Islamic Republic of Iran (IRI) is deploying every resource at its disposal, including technological ones. Over the...
Threat Intelligence, News
Diverging attributions on the energy attack in Poland, new cybercrime offensives in Italy, multiple vulnerabilities exploited ITW

Poland: latest updates on the late-December attack on the power system On December 29, 2025, a coordinated cyberattack hit numerous Polish power system sites connected to distributed generation, in particular...
Threat Intelligence, News
Ransomware and phishing in Italy, new Asia-based state-sponsored activity, Cisco and Fortinet 0-days

Italy: new cybercrime attacks  New operations linked to a phishing campaign themed around the renewal of the health insurance card have been identified in Italy, initially reported on January 8, 2026. The theme has proven...
Threat Intelligence, News
Developments in the APT landscape, new campaigns and previously unseen malware, multiple data breaches reported

APT: North Korean, Iranian, and Ukraine-focused operations tracked Between August and November 2025, security researchers identified a new campaign by the North Korean group ScarCruft, dubbed Artemis, aimed at distributing...
Threat Intelligence, News
Critical vulnerabilities in n8n, Italy in the crosshairs of phishing and ransomware activity, the latest from China

n8n: critical vulnerabilities with high operational impact In recent days, the open-source workflow automation platform n8n has been in the spotlight following the disclosure and analysis of multiple critical vulnerabilities,...
Threat Intelligence, News
New attacks in Italy, data breaches reported, offensives from China

Italy: new phishing and ransomware offensives Over the past two weeks, multiple phishing campaigns have targeted Italian users. One operation abused the name and logo of Fineco Bank. In particular, a fraudulent email with the subject “Confirmation of...
Threat Intelligence
Million-euro BEC fraud at the Opera di Santa Maria del Fiore

The Opera di Santa Maria del Fiore was involved in a million-euro BEC (Business Email Compromise) fraud. The incident dates back to 2024 but was disclosed only in December of...
Threat Intelligence, News
Phishing and ransomware in Italy, offensives hit the West, new 0-days disclosed

Italy: cybercrime activity across the country A new Polizia di Stato–themed phishing campaign has been tracked in Italy. As observed in previous cases, the email abuses the name and logo...
Threat Intelligence, News
Updates on React2Shell exploitation, the latest from Beijing and Tehran, new attacks in Italy

React2Shell: EtherRAT and other malware delivered in state-sponsored and cybercrime activity During a recent attack based on the exploitation of the critical vulnerability CVE-2025-55182 (known as React2Shell), security researchers identified...
Threat Intelligence, News
Phishing and ransomware in Italy, global data breaches, new state-sponsored operations

Italy: offensive cybercrime hits the country  A new phishing campaign targeting Italian users has been identified, leveraging the name and visual identity of the Italian Government and the Presidency of...
Threat Intelligence, News
Chinese and Russian APT activity tracked, multiple breach disclosures, ShadowV2 observed and malicious npm packages identified

 APT: updates on China- and Russia-linked adversaries  Security researchers have uncovered Operation WrtHug, a campaign that in recent months has targeted SOHO devices worldwide by exploiting n-day vulnerabilities in the...
Threat Intelligence
Chinese front companies BIETA and CIII and steganography in APT operations

The cyber ecosystem sponsored by the Chinese government remains the subject of significant analysis and discoveries. In line with the numerous revelations of the last few years—detailed investigations by Intrusion...
Legal
The cyber challenge inlight of the new regulatory framework on AI

On 17 September 2025, the Senate definitively approved Law 132/2025, entitled “Provisions and Delegations to the Government on Artificial Intelligence,” which regulates the adoption of artificial intelligence tools across various...
Threat Intelligence, News
New breaches and ransomware attacks, multiple vulnerabilities fixed, and the latest from the state-sponsored landscape 

Cybercrime: attacks on Almaviva, Eurofiber France, Pajemploi and Poltronesofà A few days after the publication on an underground forum of a leak of approximately 2.3 TB containing data linked to...
Cryptography, Quantum Security
HQC: key encapsulation based on codes

[latexpage] Introduction In 2022, the third round conclusion of the NIST standardization process on post-quantum cryptography selected a key encapsulation mechanism (CRYSTALS-Kyber/ML-KEM), three digital signature schemes (CRYSTALS-Dilithium/ML-DSA, Falcon/FN-DSA and SPHINCS+/SLH-DSA) and opened a fourth round devoted to evaluating an...
Threat Intelligence, News
New attacks in Italy, state-sponsored activity, operations in Ukraine

Italy: cybercrime operations target the country During the past week, several phishing campaigns targeting Italy were identified. In one case, a fake login portal for students and staff of the...
Cybersecurity
The Internet of Medical Things (IoMT)

The Internet of Medical Things (IoMT) promises to revolutionize the healthcare industry by improving patient care, facilitating home care of chronic conditions, opening the way for personalized medicine, and optimizing...
Threat Intelligence, News
Italy targeted by multiple adversaries, new APT operations, latest developments in cybercrime

Italy: DDoS, phishing, and ransomware attacks detected, along with BadCandy distribution During the first weekend of the month, NoName057(16) continued to claim DDoS attacks against the following Italian targets: the...
Threat Intelligence, News
New attacks targeting Italy, the latest state-sponsored operations, and newly discovered malware

Italy: NoName057(16) and phishing campaigns threaten the Peninsula The hacktivist group NoName057(16) has claimed new DDoS attacks against Italian portals in protest against the preparation of the twelfth military aid...
News
Telsy and Fortinet Collaborate for Quantum-Safe VPN

In the era of quantum computing, where what appears secure today may become vulnerable tomorrow, it is essential to adopt solutions designed for the future. For this reason, Telsy and...
Cybersecurity
The benefits of security awareness: defending against phishing, social engineering, and related threats

We live in an era where digital technology permeates every aspect of our daily lives. Email, online banking, social networks, and corporate collaboration platforms have become indispensable tools. However, where...
Threat Intelligence
Parts of the Great Firewall of China may have been “exported” to other countries

A year and a half after the leak to the technology company iSoon, which shed light on an important segment of the Chinese government’s cyber ecosystem, a new data leak...
Threat Intelligence, News
APT operational developments, malware families and variants, new cybercrime ecosystems, and methods of compromise

APT: new toolkits and TTPs from state-sponsored adversaries In the state-sponsored landscape, this week saw new tactics and tools from various APTs. The Indian Bitter sent phishing emails targeting diplomatic...
Threat Intelligence, News
Recent attacks in Italy, new malware developments, Ukraine hit by malicious campaigns

Italy: New offensives hit the country The Israeli-made spyware Graphite, developed by Paragon Solutions, has reportedly infected the devices of Italian businessman Francesco Gaetano Caltagirone and UniCredit CEO Andrea Orcel....
Threat Intelligence, News
APTs between East and West, malware news, three 0-days exploited in malicious campaigns

APT: State-sponsored campaigns detected around the globe This week, multiple campaigns by various state-sponsored adversaries were tracked worldwide. In Russia, the Sandworm subgroup known as Seashell Blizzard targeted critical infrastructure...
Cybersecurity
Incident Management: new approaches to cyber incident handling

In recent years, cyber incident handling—more commonly referred to as Incident Management—has become a central theme in organizational security strategies. The growing complexity of attacks, the increasing attack surface, and...
Threat Intelligence, News
Attacks targeting Italian entities, new data breaches disclosed, vulnerabilities exploited ITW

Italy: new offensives hit the country In the past week, several malicious campaigns were tracked in Italy. Specifically, two phishing operations abused the logos of the Healthcare Card System (Sistema...
Threat Intelligence, Cybersecurity
New cyber threats made with the support of AI

Cyber threat intelligence has fully entered the age of artificial intelligence and must now take into account its use by criminals of every kind. Scenarios that, until last year, were...
Legal
The negotiating impacts of the DORA Regulation

By providing a range of tools to manage risks linked to cyber incidents, as well as measures to prevent and mitigate them, the DORA Regulation aims to ensure the security...
Cryptography
SQIsign: the isogeny-based digital signature proposed to NIST

[latexpage] Introduction Among the digital signatures submitted in 2023 to the NIST call in the post-quantum standardization process, the only proposal based on isogenies is SQIsign (Short Quaternion Isogeny Signature)....
Cybersecurity
Ransomware: characteristics, risks and solutions

In the cybersecurity landscape, one of the most insidious and growing dangers is ransomware, malicious programs designed to lock or encrypt a system’s data and demand a ransom for their...
Cryptography
Leonhard Euler and cryptography

Leonhard Euler was a Swiss mathematician, physicist and astronomer.  Euler was probably the most prolific mathematician of all time, having produced nearly 900 publications and works and made fundamental contributions...
Cybersecurity
The Lamphone Attack

Today it’s possible to spy on secret conversations happening in a room from a remote location just by observing a light bulb hanging in there – visible from a window...
Cybersecurity
Operation Eastwood strikes NoName057(16), but does not stop him

Threat Discovery is an editorial space dedicated to in-depth analysis in the field of global cyber threat intelligence. The information reported is the result of the collection and analysis work...
Cryptography, Quantum Security
The applications of isogenies in Post Quantum Cryptography

[latexpage] After introducing the theory of elliptic curves and defining the necessary tools, we present some classical schemes in isogeny-based cryptography. As mentioned in the previous article, this part of...
Legal
The Establishment of Accredited Testing Laboratories (LAP) within the Italian Cybersecurity Framework

The introduction of Law 133/2019, which established the National Cybersecurity Perimeter, set among its main objectives the development and implementation of a strategy aimed at strengthening national cyber resilience. This...
Cybersecurity
The financial sector amid cybercrime, espionage, and the hybrid threat linked to ongoing conflicts

Threat Discovery is an editorial space dedicated to in-depth analysis in cyber threat intelligence at the global level. The information reported is the outcome of the collection and analysis work...
Cryptography, Quantum Security
The Mathematics behind PQC: Isogenies of Elliptic Curves

[latexpage] Elliptic curves cryptography After presenting the main PQC algorithms based on lattices, error correcting codes, hash functions, and multivariate systems, this article is focused on the topic of isogenies...
Legal
Web reputation e social engineering: mutual influence and impacts on the business

In an increasingly connected marketplace, a company’s online reputation linked to its digital security can define its future. Attacks based on social engineering use human vulnerability more than technical vulnerability,...
Cryptography, Quantum Security
Post-Quantum Cryptography for Embedded Systems: Challenges and Accelerator Integration over RISC-V Architecture

Introduction Information security has taken an increasingly crucial and pervasive role, particularly for embedded systems, which are low-power, resource-constrained devices involved in critical applications such as automotive, IoT and industrial...
Cybersecurity
The many aspects of the cyber threat to the energy sector

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis in cyber threat intelligence at the global level. The information reported is the outcome of the...
Cryptography
TelsyInTouch: secure mobile conversations

In the world of information and interconnection, where both workers and private citizens are exposed to a multitude of cyber risks ranging from malware, computer fraud, theft of intellectual property...
Cybersecurity
Cyber Threat Intelligence perspectives on 2025

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis in cyber threat intelligence at the global level. The information reported is the outcome of the...
Cryptography, Quantum Security
Multivariate signatures based on identification schemes

[latexpage]   Introduction The goal of an identification protocol is to enable the verification of someone’s identity. More specifically, a Prover must demonstrate to an interlocutor, called the Verifier, that...
Cybersecurity
The Mobile Threat Defense (MTD)

Mobile devices such as smartphones, tablets, smartwatches, and many others are easy targets for cyber attacks. Not only do they now contain sensitive business information, but they can also be...
Cybersecurity
The importance of cybersecurity for Local Public Administrations (LPAs)

In an increasingly connected and digitized world, Local Public Administrations (LPAs) are crucial in protecting information and services for citizens and organizations. However, the rise of cyber threats makes it...
Cybersecurity
Three police operations strike Crimenetwork, Manson Market and MATRIX criminal platform

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis in cyber threat intelligence at the global level. The information reported is the outcome of the...
Cybersecurity
Infostealers: what they are and how to defend yourself  

An infostealer is a malicious software designed to extract the victim’s personal information, including credentials, banking data, and any other valuable information.    This type of attack is increasingly used...
Cybersecurity
The 2024 state-sponsored campaigns

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis in cyber threat intelligence at the global level. The information reported is the outcome of the...
Cryptography, Quantum Security
UOV and its Variants: Digital Signatures Based on Multivariate Systems

[latexpage] In the previous exploration of multivariate cryptography, we examined how systems of polynomial equations over finite fields can form the basis for cryptographic schemes resistant to quantum computing attacks....
Cybersecurity
The security of Application Programming Interfaces (API)

A key element of innovation in today’s app-driven world is the API. From banking, retail, and transportation to IoT, autonomous vehicles, and smart cities, APIs are a key part of...
Cybersecurity
The cyber threat to the transportation sector

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
Cryptography, Quantum Security
The Mathematics behind PQC: Multivariate Polynomials

Introduction Multivariate cryptography, along with lattice-based, code-based and hash-based cryptosystems, is one of the primary classes of cryptographic schemes resistant to quantum attacks. These schemes are based on the difficulty...
Cybersecurity
BEC and CEO fraud: a growing risk for companies

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
Cryptography, Quantum Security
SPHINCS+: stateless hash-based digital signature

Introduction The Forest Of Random Subset (FORS) scheme constitutes the last element needed in order to describe the complete structure of the SPHINCS+ digital signature algorithm, selected at the end...
Cybersecurity
The NoName057(16) collective and DDoS offensives in support of the Russian narrative

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
Cybersecurity
Mobile device security: focus on three threats to Android

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the collection and analysis work done...
Cryptography, Quantum Security
XMSS: hash-based stateful digital signature

Introduction XMSS (eXtended Merkle Signature Scheme) represents a fundamental component of the SPHINCS+’s construction, which is a post-quantum hash-based digital signature selected in the NIST standardization process. As a standalone...
Cybersecurity
Breach & Attack Simulation, Vulnerability Assessment and Penetration Testing in Cyber Risk Management

Companies and organizations are constantly looking for techniques, tactics and procedures to better protect their data and assets from cyber risk. The pervasive use of the Web and new modes...
Cybersecurity
Healthcare sector targeted by ransomware attacks

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the collection and analysis work done...
Cryptography
Future-proof cryptography: the security of TelsyMusa

Ensuring proper security standards for our systems and servers has never been more essential. This need, coupled with the growth rate of cyber threats and, more importantly, the increasingly various...
Cryptography
The role of cryptographic secure elements in cybersecurity

In the digital age, data security is a top priority. With the growing number of connected devices and the continuous evolution of cyber threats, protecting sensitive information has become as...
Cybersecurity
Spyware: a growing global threat

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
Cryptography, Quantum Security
The Mathematics behind PQC: hash functions

Introduction After analyzing in detail the Post Quantum algorithms that base their security on mathematical problems defined over lattices (Kyber, Dilithium, Falcon) and on error correcting codes (Classic McEliece), we...
Cybersecurity
Black Basta Team and double extortion ransomware attacks

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
Cybersecurity
Protect smartphones and tablets from cyber risks: the mobile security

Smartphones, tablets, smartwatches, and in general all so-called “smart” devices, are today indispensable tools for companies, public administration, and private citizens.The mobility and immense technological capabilities of these devices actually...
Cybersecurity
APT29: focus on a Russian state-sponsored opponent

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level. The information reported is the outcome of the...
News
Telsy’s website is carbon neutral

Over the course of 2023 Telsy website, together with our Group’s main websites, with almost 490 million total page views, generated around 397 tonnes of CO2eq, as much as would...
Cryptography, Quantum Security
Classic McEliece: key encapsulation based on codes

Introduction At the end of the third round of the NIST standardization process, the CRYSTALS-Kyber key encapsulation method aimed at replacing the current ECDH scheme was selected. NIST then defined...
Legal, Cybersecurity
Challenges, opportunities, and solutions for the NIS2 Directive  

In January 2023, EU Member States formally issued a revision to the 2016 Network and Information Systems (NIS) security Directive.   Conceived in response to several widely publicized and damaging cyber-attacks,...
Cryptography
Security for offline conversations: TelsyATMO

Protecting our data and communications from cyber risks is, now more than ever, extremely important to secure the content we exchange.   In fact, many dangers can lurk around the corner,...
Cybersecurity, Cryptography, News
The Made-in-Italy Secure Microchip

With the growing quantity and quality of cyber attacks and cybercrime, the security of devices, data, and communications exchanged by companies, institutions, and private citizens is constantly at risk. When...
Cryptography, Quantum Security
The math behind the PQC: Syndrome Decoding Problem

Introduction Cryptographic schemes starring in the NIST standardization process belonging to the code-based cryptography family are constructed from a problem called the Decoding Problem. Given a code and a vector,...
Cryptography, Quantum Security
The mathematics behind PQC: the codes

Introduction In addition to lattices, the foundation of lattice-based cryptography, another mathematical structure used to construct post-quantum cryptography schemes is error-correcting codes, more briefly codes. The codes originated in the...
Cryptography, Quantum Security
New post-quantum digital signature proposals: the second NIST competition

[latexpage] Introduction In response to the threat posed by quantum computers, in 2017 the National Institute of Standards and Technology (NIST) launched a standardization process for the selection of quantum-resistant public-key cryptography...
Cybersecurity
TS-Intelligence: The Advanced Cyber Threat Intelligence Platform from Telsy and TS-WAY  

In the ever-evolving digital age, cybersecurity has become a must-have priority for organizations of all sizes and industries.      The increasing frequency and sophistication of cyber-attacks threaten sensitive data, reputation,...
Cryptography
Secure collaboration

In the office, on the road, at home, and in many other places, we often use tools and devices constantly connected to the Internet.   This condition has greatly increased...
Cryptography, Quantum Security
Falcon: NTRU-based digital signature

[latexpage] Introduction The Post-Quantum Cryptography NIST standardization process has identified two digital signature schemes based on lattice theory CRYSTALS-Dilithium and Falcon. In modern cryptographic protocols, these solutions are set to replace the currently used digital signature schemes...
Cybersecurity
The security of mobile devices: TelsyMobileDefender

Smartphones are today an indispensable tool for businesses, expanding the perimeter to be defended and the risks to be prevented to avoid harm. Careless or unsafe use of mobile devices...
Cybersecurity
Red Teaming

Red Teaming is an ethical hacking methodology that helps assess a company’s ability to detect, prevent and respond to sophisticated and targeted threats, as well as identify and quantify existing...
Cybersecurity
Enhancing Healthcare Cybersecurity – TelsyMediSOC

In an industry where a vulnerability can lead to financial losses and to potentially life-threatening incidents, being prepared to defend against cyber threats becomes imperative. In this context, healthcare organizations...
Cybersecurity
The Spyware

Spyware are a type of software that collects information regarding a user’s activity without its consent. The term is often used to define a wide range of malware with the...
Cryptography, Quantum Security
CRYSTALS-Dilithium: LWE-based digital signature

[latexpage] Introduction The NIST standardization process in the post-quantum domain has identified two cryptographic schemes to be considered “primary” solutions. Regarding Key Encapsulation Mechanisms (KEMs), i.e., key derivation schemes, CRYSTALS-Kyber was selected, while for digital...
Cybersecurity
eXtended Detection and Response (XDR)

The trend of cyber attacks shows a steady growth in terms of volume and sophistication. Every organization, especially small and medium-sized ones, cannot cope with the critical issues of monitoring...
Cybersecurity
The Security Operations Center (SOC)

A Security Operations Center (SOC) consists of an in-house (or outsourced) team of cybersecurity professionals equipped with sophisticated technologies that monitor an organization’s IT infrastructure, 24 hours a day, 7...
Cryptography, Quantum Security
CRYSTALS-Kyber: LWE-based key encapsulation

[latexpage] Introduction In the context of the NIST standardization process for identifying and analyzing Post-Quantum Cryptography (PQC) solutions, the first crucial outcome is given by the selection of the key encapsulation mechanism CRYSTALS-Kyber. Kyber...
Cybersecurity
Risk Analysis and VAPT: how to manage cyber risk

Companies and organizations are constantly looking for ways to protect their data and online activities from cyber risk. The inescapable use of the Web and new ways of collaboration have...
Cybersecurity
Cyber Threat Intelligence: knowing and anticipating threats

Success in the digital age depends on the ability to validate complex information and leverage it to lead change. For organizations, it is today necessary to equip themselves with tools...
Cryptography, Quantum Security
The Math Behind PQC: Learning With Errors

[latexpage] Introduction Some of the cryptographic schemes that emerged as winners of the NIST standardization process and belong to the lattice-based cryptography family are built upon a problem known as Learning With Errors (LWE)....
Cybersecurity
Security Awareness: how to avoid the dangers of cybersecurity with TelsySkills

Being aware of the existence of real danger and the consequences it entails on multiple levels is – itself – a tool to defend against it, to protect ourselves. This...
Cybersecurity
The Triple Cyber Threat: Borat RAT

Recently a US cyber risk intelligence company has discovered a new Remote Access Trojan (RAT) malware. RAT malware typically helps cybercriminals gain complete control of a victim’s system, permitting them...
News
Telsy website is Carbon Neutral

TIM Group offsets the climate impact of its websites with certified international project During 2022, our Group’s main websites, with around 680 million total page views, generated around 554 tonnes...
Cybersecurity
Security Monitoring: protecting your business from cyber threats

Hackers or malware, careless or disgruntled employees, outdated or vulnerable devices and operating systems, public and mobile cloud computing, or third-party service providers: in the normal course of business operations,...
Cryptography, Quantum Security
The mathematics behind PQC: lattices

[latexpage] Introduction A large number of post-quantum cryptographic schemes are based on a mathematical structure known as a lattice. Within this framework, it is possible to define problems that are...
Cybersecurity
Cyber Threat Investigation and Threat Hunting

According to the Verizon Data Breach Investigation Report (DBIR), advanced threats hide in environments undetected, often for months, as they stealthily try to gather valuable information or data to compromise....
Cybersecurity
ICT Risk Management: how to set up your cyber defenses

IT security is a complex and evolving field and needs a systemic approach to managing cyber incidents. These incidents do not always concern malicious attacks, but can be the result...
Cybersecurity
The Cyber Vulnerabilities

The fast evolution of the international scenario puts companies in front of new challenges. These challenges are closely related to security, staff preparation and the constant growth of cyber vulnerabilities....
Cybersecurity
The Cyber Incident Response

Every day thousands of companies have to face the growing threat of cybercrime and Security Incidents, with consequent waste of time and money. In the modern corporate landscape, we have...
Cybersecurity
Microsoft Exchange servers exploited with OWASSRF

Executive Summary In December 2022, Telsy Incident Response Team was called upon to handle a cyber security incident. The analysis conducted detected the execution of PowerShell code by exploiting a...
Cybersecurity
Decision Intelligence: a tool for the security of people and companies

Having large volumes of data available is essential when it comes to security. Even more central is the ability to know how to read, analyze and process these data, or...
Cryptography
One-Way and Trapdoor Functions: The Heart Of Modern Encryption

[latexpage] Introduction By definition, a one-way function is easy to compute but hard to invert. In other words, inverting a one-way function is equivalent to solving an intractable mathematical problem...
Quantum Security
Quantum Key Distribution (QKD) and security

In the collective imagination, quantum computing has been relegated to science fiction for many years, but thanks to recent developments in technologies and substantial investments by major players, we are...
Cryptography
The videoconference vulnerabilities

As for business meetings or for hearing the family from all corners of the world, many people use video conferencing to connect with others and will likely continue to do...
Cybersecurity
Cyber, physical and reputational risks exposure

The growing online presence of personal data on platforms, social networks, digital collaboration tools and so on increases, the risks exposure associated with this availability is also increased. From a...
Cryptography, Quantum Security
Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC)

Today the quantum attacks threat is a real danger. The protection of data and communications is linked to technologies that give future-proof answers, capable of thwarting threats with still partially...
Cryptography
Secure communications: end-to-end encryption (E2EE)

End-to-end encryption is a message encryption method based on asymmetric encryption algorithms and the decentralization of cryptographic keys. Is an encrypted communication system in which only people who are communicating...
Cybersecurity
Decision Intelligence and security: VIP digital protection

Having large volumes of data available is essential when it comes to security. Even more central is the ability to know how to read, analyze and process these data, or...
Cryptography, Quantum Security
Digital signature algorithms: present and future

[latexpage] Introduction and general structure In many ways, digital signatures are the digital equivalent of the handwritten signatures we all use every day. However, the main difference between the two...
Cybersecurity
Endpoint Detection & Response (EDR)

The evolution of cyber attacks in terms of frequency and attack methods (multi-channel and multi-target), as well as the ongoing digitalization process, exposes organizations to vulnerabilities that weaken continuity plans,...
Cryptography
Videoconference and security

In a historical moment in which virtual meetings are becoming the main means of communication, both in the workplace and in the school environment, it is necessary and essential to...
Cybersecurity
What Is Decision Intelligence?

Decision Intelligence (DI) is a practical discipline that aims to support decision making by understanding and engineering the intelligence process, driving the decision-making process and the evaluation (and improvement, through...
Cybersecurity
Microsoft Exchange servers backdoored with OwlProxy

Introduction In early 2022, Telsy observed malicious cyber activity in the Microsoft Exchange infrastructure. The analysis conducted revealed the presence of a malicious DLL, called “fuscom.dll“, and its persistence by...
Cryptography, Quantum Security
Quantum Key Distribution (QKD): a disruptive technology

The quantum computing development and the prospect of its widespread diffusion are challenging the existing classical cryptography protocols security. At the same time, the advent of quantum computers has given...
Cybersecurity
The Cybersecurity Awareness

Being aware of the existence of a danger and the consequences that this entails is the first defense tool. Cybersecurity awareness transforms employees into the first line of defense against...
Cryptography, Quantum Security
Key Negotiation in the Post-Quantum Era

[latexpage] Introduction Cryptography, understood as the set of schemes for protecting information, is typically divided into symmetric or private key cryptography and asymmetric or public key cryptography. Symmetric encryption involves...
Cryptography
Cryptophones: what they are and how they work

The issue of mobile communication security highlights one of the weak links in the security chain of organizations. It is often the behavior of individual employees, not necessarily malicious but...
Cybersecurity
The CryptoLocker ransomware

CryptoLocker is a ransomware capable of blocking documents on your computer by encrypting them with a password and making it impossible to open files, a malicious software that infects Windows...
Cybersecurity
The Lateral Movement

Lateral movement refers to the techniques that a cyber attacker uses, after gaining initial access, to move deeper into a network in search of sensitive data and other high-value assets....
Cybersecurity
The TrickBot malware

TrickBot (or “TrickLoader”) is a banking Trojan that targets both businesses and consumers for their data, such as banking information, account credentials, personally identifiable information (PII), and even bitcoins. As...
Cybersecurity
The FTCode Ransomware

FTCode is a type of ransomware that spreads itself via spam emails, and is able to execute its PowerShell-based malicious payload in memory only, without downloading any files to disk....
Cryptography
Leon Battista Alberti’s cipher disk

Leon Battista Alberti’s cipher disk, described in “De cifris” around 1467, is the first polyalphabetic encryption system. The device consists of two concentric discs, rotating relative to each other, containing...
Cryptography, Quantum Security
Post-Quantum Cryptography (PQC): a classical solution to the quantum threat

Introduction Public key cryptography (or asymmetric cryptography) is one of the foundations on which all communication protocols are based. Starting from an insecure channel, these protocols must achieve multiple security...
Cybersecurity
The Emotet Trojan

The Emotet Trojan is one of the most dangerous malware in cybersecurity history. Individuals, companies, or even global authorities, anyone could be potential victims. Emotet tricks basic antiviruses into hiding...
Cybersecurity
The Ryuk Ransomware

Ryuk is a ransomware family that first appeared in mid to late 2018. In December 2018, the New York Times reported that Tribune Publishing had been infected with Ryuk, forcing...
Cybersecurity
The Turla malware

Turla is one of the most advanced APTs (Advanced Persistent Threat) in the world. Also, Turla Group is a well-established collective that has been operational since at least 2004 Also...
Cybersecurity
The Advanced Persistent Threats (APT)

“APT”, the acronym for Advanced Persistent Threat, indicates a type of targeted and persistent attacks carried out by opponents with considerable technical expertise and great resources. As the “Advanced” part...
Cybersecurity
The Locky ransomware

Locky is a type of malware that can encrypt critical files on your computer and hold them hostage while demanding a ransom payment. The cybercriminals promise to give users a...
Legal
The union between art and cryptography: crypto art and NFT

Introduction Crypto art uses the techniques offered by digitization, and in particular the request, to allow artists to give voice to their creativity and make the works subject to exchange...
Cybersecurity
The Evil Twin attack

An Evil Twin attack is a spoofing cyberattack that works by tricking users into connecting to a fake Wi-Fi access point that mimics a legitimate network. Once a user is...
Cryptography, Quantum Security
The logical qubit and the correction of quantum errors

[latexpage] Physical Qubit vs Logical Qubit As discussed in the previous article, the unit of information processed by a quantum computer is generically called a qubit or quantum bit. However,...
Cybersecurity
WannaCry ransomware

WannaCry ransomware is a cryptomalware worm that attacks Windows PCs.  It’s a form of malware that can spread from PC to PC across networks (hence the “worm” component) and then...
Cybersecurity
What is the Cyber Threat Intelligence?

In the nowadays cybersecurity paradigm, Cyber Threat Intelligence plays a leading role. Reactive malware detection tools, firewalls, and analysis through artificial intelligence are not enough: to ensure the security of...
Legal
Corporate Law and new technologies

Corporate Law and new technologies: the “remote” Shareholders’ Meeting and cybersecurity issues The reality that, now (unfortunately) for over two years, we have been living with the sadly known health...
Cryptography
Al-Kindi, the father of cryptanalysis

Abu Yūsuf Yaʻqūb ibn ʼIsḥāq aṣ-Ṣabbāḥ al-Kindi was born in 801 in Kufa or Basra, Iraq, and died in Baghdad in 873. He is known as “the philosopher of the...
Cryptography, Quantum Security
Shor’s Quantum Algorithm

[latexpage] Introduction Among the many applications of the quantum computing model, the most significant in the field of cryptography is the work of the American computer scientist Peter W. Shor....
Cybersecurity
Rootkit viruses

Rootkits have coexisted with the computer world for over 20 years, allowing hackers to access (almost) any computer.   What are Rootkits? First of all, Rootkits are malware, malicious software...
Cybersecurity
FlawedGrace RAT

FlawedGrace is the name of a Remote Access Threat (RAT) that is part of the menacing arsenal of the financially motivated cyber criminals gang known as TA505 (or Hive0065). The...
Cybersecurity
The banking Trojans

The term banking Trojan indicates a category of malware that aims to steal the banking credentials of victims and carry out online fraud, usually causing significant economic damage.   Dridex:...
Cybersecurity
NetWalker ransomware

Netwalker is a type of ransomware that targets Windows-based systems. First discovered in August 2019, it has evolved throughout the rest of 2019 and into 2020. The FBI noted significant spikes in...
Cybersecurity
Legitimate Sites used as Cobalt Strike C2s against Indian Government

Introduction Telsy Threat Intelligence team observed an attack against members of the Indian government or local institutions, which uses social engineering themes as an investigation for a cyber attack or...
Cybersecurity
SharkBot: the stealing banking and cryptocurrency accounts trojan

Some cybersecurity researchers from Cleafy took the wraps off a new Android trojan that takes advantage of accessibility features on mobile devices to siphon credentials from banking and cryptocurrency services...
Legal
Green tech and green computing

Abstract Recently, the constitutional protection of the environment has been strengthened by the bill aimed at reforming articles 9 and 41 of our Constitution on environmental protection to protect biodiversity,...
Cybersecurity
SimJacker, the SIM cards vulnerability

SimJacker is a SIM card vulnerability that allows cybercriminals to compromise any cell phone and spy on victims by simply sending an SMS text message.   What is SimJacker? The...
Cybersecurity
BabaDeda and LorecCPL downloaders used to run Outsteel against Ukraine

Telsy CTI Team found and followed insights from the Ukraine question, new IoCs, and the evolution of the tools employed in the attacks.   Beginning in January 2022, there was...
Cybersecurity
The Web Shell

A Web Shell is a shell-like interface that enables a web server to be remotely accessed, often for the purposes of cyberattacks.   What is a Web Shell? A Web...
Cryptography
The Caesar cipher

In cryptography, the Caesar cipher is one of the oldest cryptographic algorithms of which there is a historical trace. It is a mono-alphabetic substitution cipher, in which each letter of...
Cryptography, Quantum Security
Grover’s Quantum Algorithm

[latexpage] Introduction With the 1996 paper “A fast quantum mechanical algorithm for database search”, the Indian-American computer scientist Lov K. Grover helped highlight the non-negligible impact of quantum computing on...
Cybersecurity
CronRAT, the e-commerce malware

Experts have identified a new Linux RAT that was dubbed “CronRAT”. It stands out through its hiding place, as it can be found in different tasks which have a schedule-timeline...
Legal
The “cybersecurity law”

Cybersecurity law: a new branch of law to support digital security The constant and dialectical relationship between society and law makes the latter available to the former to acknowledge their...
Cybersecurity
Tardigrade, the shape-shifting virus

An APT attacked two different vaccine manufacturers in past years, using shape-shifting malware that initially appears to be a ransomware attack but later turns out to be much more sophisticated....
Cybersecurity
The Phishing as a Service (PHaaS)

Phishing is a common way for cybercriminals to dupe people through socially-engineered emails into giving up their credentials to online accounts that can store sensitive data. Phishers use these emails—which...
Cybersecurity
The BlackMatter ransomware

First seen in July 2021, BlackMatter is a Ransomware-as-a-Service (RaaS) tool that allows the ransomware‘s developers to profit from cybercriminal affiliates (i.e., BlackMatter actors) who deploy it against victims.  BlackMatter...
Cybersecurity
SideCopy APT: from Windows to *nix

Telsy Threat Intelligence team has observed a spear-phishing campaign conducted by cyber-espionage group SideCopy against critical government entities in India.    SideCopy APT: from Windows to *nix As previously published...
Cryptography
The cipher of Aeneas

In the sacred texts, in particular in the Old Testament, three main secret writings can be found: the Atbash, the Albam and the Atbah. The first cipher code, Atbash, was...
Legal
Artificial intelligence and Cybersecurity between cyber defense and cyber attack

Abstract Artificial intelligence can be qualified as an ambivalent tool since it lends itself to being used both as a means to create cyber defense products and, unfortunately, as a...
Cryptography, Quantum Security
The Qubit: introduction to quantum algorithms

[latexpage] Introduction In popular science contexts, the quantum computer is sometimes labeled as a particular computer that is “incredibly faster.” Although this characterization is not entirely detached from reality, some...
Cybersecurity
Phishing Campaign targeting citizens abroad using COVID-19 theme lures

Telsy Threat Intelligence team has identified a phishing campaign that appears to be targeting citizens abroad by exploiting the COVID-19 theme associated with a potential embassy lockdown status.   Introduction...
Legal
Digital divide: analysis of the phenomenon

Abstract Having learned the usefulness and importance of digital transformation, which has changed the conduct of daily activities for individual users and the management methods of companies, it is appropriate...
Cybersecurity
Double and triple extortion attacks

Initially, criminals exclusively used ransomware-related malware to restrict access to user data by encrypting files on individual or organizational devices.  In exchange for the decryption key, the victims had to...
Cybersecurity
NOBELIUM again or eCrime operation?

Telsy Threat Intelligence team identified a phishing campaign that seems to target multiple victims based in the United States, Great Britain, and Europe. The campaign appears to have been active since...
Cybersecurity
The Dharma ransomware

Dharma is a dangerous ransomware, identified as early as 2016, whose uniqueness lies entirely in its peculiar attack technique: the Dharma ransomware, in fact, is able to install itself on...
Legal
The integration of cybersecurity and sustainability in the 2030 Agenda for sustainable development

Abstract From the analysis of the 2030 Agenda for sustainable development and the 17 Goals set out therein, it can be deduced that digital security and sustainability today mix, allowing...
Cryptography
History of cryptography: the scitala

The scitala or scital (in ancient Greek: σκυτάλη, skytàlē, “stick”) is traditionally considered an encrypted and secret message that was sent by the ephors, the five supreme magistrates of Sparta,...
Cryptography, Quantum Security
The Quantum Computing

Quantum computing history By the end of the twentieth century, experimental physics had been transformed by the technological rise of classical computers. Among many breakthroughs, the ability to simulate the...
Cybersecurity
Possible attack to Telco company in Middle East

Telsy Threat Intelligence team identified a possible Grunt Covenant multi-stage attack aimed at a major telecommunications company in Iran.   Introduction In this article, we will look at the different steps...
Cybersecurity
The REvil ransomware

REvil (Ransomware Evil, also known as Sodinokibi) is a Russian-speaking private Ransomware-as-a-Service (RaaS) operation. After an attack, REvil would threaten to publish the information on their page (Happy Blog) unless...
Cybersecurity
The DarkSide Ransomware

DarkSide is a ransomware strain that threat actors have been using to target multiple large, high-revenue organizations resulting in the encryption and theft of sensitive data and threats to make...
Legal
Blockchain and Cybersecurity: a legal perspective

Abstract Over the years, media around the world have constantly reported (and continue to report with assiduous frequency) news relating to cryptocurrency theft and computer scams also linked, among other...
Cybersecurity
The dissemination of LockBit 2.0

LockBit is a relatively new ransomware that has become very popular and known fast. The ecosystem behind this threat has significantly increased its criminal activities since Q4 of 2020 and...
Cybersecurity
Dissecting new AppleSeed backdoor of Kimsuky threat actor

Telsy analyzed the cyber espionage group known as Kimsuky in a particular spear phishing campaign.   Introduction The Telsy Threat Intelligence team trackings various threat actors, among them the cyber espionage...
Cybersecurity
The Ransomware as a Service (RaaS)

Ransomware is evolving from a linear attack model to an insidious Ransomware as a Service (RaaS) model: attackers are increasingly focusing on program development, while letting third parties identify victims...
Cybersecurity
The social engineering

Social engineering is a technique for obtaining information widely used by experienced hackers and spies and, since it involves (especially in the last phase of the attack) a more direct...
Cybersecurity
New malicious campaign spreading Windows and Linux backdoors

Telsy analyzed a new malicious campaign spreading Linux and Windows backdoors.   Introduction This type of campaign starts by exploiting known vulnerabilities related to the target technologies and then performs...
Cybersecurity
Lazarus Group continues AppleJeus Operation

Telsy analyzed new samples related to the threat actor Lazarus Group and in particular to the “AppleJeus Operation”.   Introduction While some of the details have changed, the methods used...
Legal, Cybersecurity
Cybersecurity and prevention of computer crimes pursuant to Legislative Decree 231/2001

Curated by Alessandro Livi and Erica Onorati, Team Legal Telsy   Abstract Cybersecurity issues cannot (and must not) be considered isolated issues but they necessarily see the mixing and involvement...
Legal, Cybersecurity
The era (also normative) of Cybersecurity

Curated by Alessandro Livi and Erica Onorati, Team Legal Telsy   Abstract On January 23, 2020, the hand of the Doomsday Clock arrived just one hundred seconds from the symbolic...
Legal, Cybersecurity
REGULATORY PRODUCTION CONTINUES INCESSANTLY: the latest news of cybersecurity protagonists

Curated by Alessandro Livi and Erica Onorati, Team Legal Telsy   Abstract The regulatory and institutional framework within which the leading bodies of the cyber sector operate, with their respective...
Cybersecurity
The HEH virus

A virus has been circulating since last year: it’s called HEH and it can infect practically everything: from routers to IoT devices. This new threat that is spreading on the...
Legal, Cybersecurity
CSIRT: the new institutional actor of cybersecurity

Curated by Alessandro Livi and Erica Onorati, Team Legal Telsy   The CSIRT: the new institutional actor of cybersecurity In recent years, in tandem with the evolution and progress of...
Legal, Cybersecurity
Cybersecurity and Data Protection: the boundaries and contact points between the two sectors

Curated by Alessandro Livi and Erica Onorati, Team Legal Telsy   Abstract Data protection is one of the most complex and debated issues of recent years, characterized by an application...
Cybersecurity
Google Drive abused in document exfiltration operation against Afghanistan

Telsy analyzed a new campaign that targeted Afghanistan and aimed to steal documents.   Introduction Telsy last June analyzed a new campaign that targeted Afghanistan, specifically researchers and government employees....
Cybersecurity
The Glowworm attack

Glowworm is a novel technique that leverages optical emanations from a device’s power indicator LED to recover sounds from connected peripherals, and spy on electronic conversations from a distance of...
Cybersecurity
The Botnets

Botnets have become one of the major threats to today’s security systems. Cybercriminals increasingly use them because they allow them to infiltrate almost any device connected to the Internet, from...
Cybersecurity
REMCOS and Agent Tesla loaded into memory with Rezer0 loader

An Italian government email has been targeted by a phishing campaign. The attack’s goal aimed to install some remote control and information-stealing tool.   What’s happened During the last month,...
Cybersecurity
DDoS attacks 

DDoS attacks are a cyber threat as simple to put into practice as it is effective, capable of sending a company or critical infrastructures such as hospitals and airports into...
News
MARITIME CYBERSECURITY: SEAFUTURE 2021

In the last two decades, the cases of cyberattacks against Institutions have increased exponentially, so much so that they pose a real threat to the defense of the state and...
Cybersecurity
Malware-as-a-Service (MaaS): what it is and why it is (very) dangerous

Malware-as-a-Service (MaaS) refers to the illegal lease of software and hardware for carrying out cyber-attacks. Owners of MaaS servers offer to threat actors a paid botnet service that distributes malwares....
Cryptography, Quantum Security, News
Telsy has recently entered into Quantum Telecommunications Italy

Telsy has recently completed its entry into Quantum Telecommunications Italy (QTI) with a minority stake in the share capital of this startup active in the field of quantum fiber optic...
Cybersecurity
Tokyo 2020 Olympic Games & cyber threats

The organizing committee of the Tokyo2020 Olympics has decided to use the expertise of about 200 ethical hackers to protect their infrastructures from possible cyberattacks. Organizers fear that history may...
Cybersecurity
Port scanning: a double-hedge sword?

Port scanning refers to the activity of determining which port within a network can receive and send data, by sending packets to specific ports and analyzing responses to detect flows...
Cryptography
Homomorphic Encryption: (im)practical innovation?

Homomorphic encryption (HE) is an innovative type of cryptography that allows the performance of computations on encrypted data, obtaining results consistent with those that would be obtained by performing the...
Cybersecurity
Cyber threats & economic intelligence: the deadly mix to national security

The ongoing exploit of emerging technologies to carry out cyberattacks is not just a matter concerning gangs of hackers and threat actors asking for ransoms, but also affects national security....
Cryptography
E2EE: features of an “invincible” system

End-to-End encryption (E2EE) is an application of asymmetric encryption systems. This means that in a communication, only the recipient and the sender, its two ends, can decrypt and read the...
Cybersecurity
Machine Learning: why is vital for cybersecurity

Machine learning is becoming more vital than ever in today’s – and tomorrow’s -cybersecurity. Being a subset of AI, machine learning consists of the techniques that enable computers to figure...
Cybersecurity
Firmware security: why it matters

While securing other critical components of their infrastructure such as hardware and software, businesses often neglect firmware security. Being the basic core of all its hardware stuff, an organization is...
Cryptography
RSA Cryptography: history and uses

The RSA encryption is a public-key-based cryptosystem, named after Ron Rivest, Adi Shamir and Len Adleman who invented it in 1977. Clifford Cock had previously invented an equivalent system for...
Cybersecurity
FragAttacks: new Wi-Fi vulnerabilities found!

A few days ago, a Belgian security researcher,  Mathy Vanhoef, has found and named as “FragAttacks (fragmentation and aggregation attacks)”, a dozen of unknown security flows affecting Wi-Fi devices. Within the radio...
Cybersecurity
Vulnerability Assessment: an overview of a crucial cybersecurity task

Vulnerability assessment is a task in delivering an effective cybersecurity strategy in both the corporate and public sectors. It is vital to bring about risk awareness, and it is the...
Cybersecurity
Cybersecurity analysts: what they do and why their work is vital

Cybersecurity analysts are the core of an organization’s security, private and public alike. They have a vital task: ensuring that their IT assets are secure and protect them from violations...
Cybersecurity
Penetration testing: what it is and why it is important

Penetration Testing (Pen Test) refers to the activity of systematically attempting to violate a vulnerable component of a system to discover the security breaches in it through a simulated attack....
Cryptography
AES-256 encryption: how does it protect our most sensitive data?

You have certainly heard of AES-256. Commonly referred to as “military-graded” cipher, the Advanced Encryption Standard (AES) is essential in government cybersecurity, encryption, and electronic data protection. Its story started...
Cybersecurity
Cloud: what is it and its key advantages

Cloud is a metaphor indicating a computing model where an internet connection enables a network of servers, applications, storage, and other development tools. Companies around the world use it to...
Cryptography
Cryptography: what is it and its uses

Cryptography, or crypto, refers to the technique of securing information and communications through codes. By doing so, only those people you send information holding the decoding key to can understand...
Cybersecurity
Cybersecurity career: 4 reasons to consider it

Pursuing a career in cybersecurity can be tempting. Figures show that this industry tends to have a zero unemployment rate. Nowadays, the labor market requires cybersecurity skills more than ever....
Cybersecurity
Cyberattacks: a matter of war or disruption?

Cyberattacks are a threat to national security. However, describing them as war is highly problematic. Critics of this stance often argue that armed conflict has been becoming virtual. They say...
Cybersecurity
Smart working: how to mitigate cyber risks

Smart working is a fertile ground for cyber threats and criminals. As steps to counter the coronavirus outbreak take effect, millions of workers worldwide have been sent home with their...
Cybersecurity
Erecting an IT fortress: strategies for resilience

Erecting an IT fortress is an urgent need these days. Facing the surge in cyber-attacks of these times, companies will need to adopt new strategies, procedures, and technologies to become...
Cybersecurity
Cybercrime: how can we all deal with it?

One of the biggest cybersecurity dilemmas is the following: “Can we avoid cybercrime?” After all, online identity theft and fraud, hackers, ransomware cyber-attacks, phishing, and other scams are threats to...
Cybersecurity
VPN: a must-have tool for privacy and security

VPN (Virtual Private Network) service gives you online privacy, anonymity, and security by creating a private network from a public internet connection. By using it, businesses can securely connect users...
Cybersecurity
SOC: what it is and how it operates

SOC or Security Operations Center – not to be confused with SoC (“System on a Chip) – is the core component of a serious business security strategy. Simply put, a...
Cryptography
Alan Turing: the father of computing

Alan Turing is by consensus the father of modern computing. Suppose we are using a laptop, a computer, a smartphone, or even a network of IoT devices. In that case,...
News
Bitcoin mining: What it is and how it works

What does Bitcoin Mining mean? Bitcoin mining is creating, or rather discovering, bitcoin currency. Unlike real-world money printed when more is needed, bitcoin cannot simply be willed into existence but...
Cybersecurity
Anonymous: what to know about a worldwide hacking group

Anonymous is the most famous hacktivist group in the world. It gained international attention when it attacked the Church of Scientology’s website in 2008. As an informal group without a...
News
Adriano Olivetti: Life of an innovator

A shroud and halo of myth surround the figure of Adriano Olivetti. He was one of the most prominent figures in the Italian cultural and industrial panorama, reserved for the...
News
CrypTO: Telsy’s contribution in the organization of the CrypTO national web conference of Turin’s Polytechnic

The Polytechnic of Turin has organized with the collaboration of Telsy, the CrypTO national web conference. It will take place on the 27th and 28th of May 2021. The organizers are Danilo...
Cybersecurity
Maze: a short story of one of the most dangerous cyberthreats

The Maze group has been one of the subtlest hacking groups in recent history. The maze was a hacking group targeting organizations worldwide across many industries. It has recently announced...
Cryptography, News
Agnes Meyer Driscoll: women in cryptanalysis

Agnes Meyer Driscoll was a leading cryptanalyst working for American defense agencies between WW1 and the Cold War’s early years. She started her career in the US Navy by enlisting...
Cryptography
Enigma: a story about cipher mishandling

Enigma was a portable cipher machine producing a polyalphabetic substitution cipher. It had up to 5 rotor scramblers. Many versions included many sets of plugboard connections, which allowed a further swap of a...
Cybersecurity
Phishing: how to detect one of the subtlest online threats

Phishing is one of the subtlest cyber threats in the dark world. The world has been witnessing a surge in phishing attacks since the pandemic outbreak. It may be extremely...
Cybersecurity
Olicyber: the future of Italian cybersecurity is here!

Will the curriculum of Italian pupils soon include hacking? There is a chance. Italy is organizing its first CyberOlimpics, Olicyber, organized by CINI and TeamItaly, the Italian white hackers’ team....
News
Cablocracy: the history of (and the struggle for) undersea comms

Did you know nations struggle for cablocracy, that is, the control for strategic comms? In the age of wireless and mobile, few people know that a long net of submarine...
Cybersecurity
Cyberwarfare and national economies

Cyberwarfare is not just a standard threat in the dark woods of cyber threats. It is much more serious than that. It is no secret that big and key strategic...
Cybersecurity
Kevin Mitnick: the computer-break-in artist

Kevin Mitnick was the most elusive computer break-in artist in history. Security experts often refer to him as “The World’s Most Wanted Hacker.” Indeed, the US Feds took almost three...
Cybersecurity
Turin Polytechnic under attack: what you should know

A hacker attack has temporarily disabled Turin Polytechnic’s online services servers for a few hours. What did happen? Was it a severe violation? Let’s find it out together! What did...
Cybersecurity
The Emotet threat

Law enforcement agencies from the several EU countries and the UK have dismantled the notorious malware Emotet. The takedown of this malicious botnet happened on Tuesday, 26th January. Emotet is...
Cybersecurity
Sunburst: the attack that shook the world

Cyber analysts recently discovered the “Sunburst” attack malware, which triggered a series of cyber-espionage attacks that began in the spring of 2020. The attack involved thousands of public administrations, private...
Cybersecurity
Take a hacker seriously: the story of Raphael Grey

You will take a hacker seriously after reading the story of Raphael Grey. Raphael Grey managed to hack several e-commerce sites, accessing the customers’ credit card data for a month...
Cybersecurity
Fake vaccines online: beware of scams

The NAS Carabinieri blocked two sites advertising and offering fake vaccines for COVID-19 and flu. In the latter case, subject to the obligation of medical prescription and sold only in...
Cybersecurity
AiR-ViBeR: the hack that exploits PC fans

Cyber ​​risks, as we know, have always been around the corner. They are insidious and can even silently affect the data of companies and individuals quite easily, if not adequately...
Cybersecurity
SolarWinds Attack: Italy activates the Cyber ​​Security Nucleus

Following a tampering with a number of SolarWinds Orion platform updates in March, hackers have infiltrated the networks and computer systems of government and private entities around the world by...
Cybersecurity
COVID-19 vaccine: beware of phishing

Have you received a strange e-mail about COVID-19, offering you various solutions to buy an under-the-counter vaccine currently in distribution? Think twice before clicking on any link. In addition to...
Cybersecurity
Spyware – an almost invisible threat

Is your PC or mobile phone not as fast as it used to be? Has your battery started lasting less and less, despite its limited state of deterioration? Have you...
Cybersecurity
The guy who hacked Twitter: “Kirk” and the human factor

It was a 17-year-old hacker who managed to persuade some Twitter employees that he was a collaborator of the technology department who needed the credentials to log into the customer...
Cryptography
Olivetti P101: an Italian success

The Olivetti “Program 101” computer (P101), presented in 1965, is considered by some to be the first “personal computer” in history, as it had all the main features of large...
Cryptography
How was the Internet born? the World Wide Web Revolution

By the end of the 1980s, ARPANET had expanded its nodes overseas and, through the TCP / IP protocols, had led to the creation of a vast “network of networks”...
Cybersecurity
Business data loss: a nightmare for companies

Business data loss can be detrimental for businesses. Organizations – from small to medium-large – depend on technology when it comes to managing business operations and data storage. Unfortunately, technology...
Cybersecurity
Is SOCaaS useful for companies? Google Chronicle as an effective and advantageous SOCaaS service

Today, we present a paper that explains the convenience of adopting a SOCaaS service for businesses and organizations. The correct management of IT infrastructures is essential to guarantee any organization’s...
Cybersecurity
When a false flag doesn’t work: Exploring the digital-crime underground at campaign preparation stage

At the beginning of October 2020 we found copy of a malicious document potentially to be attributed to an APT group known with the name of APT34 / OilRig. The...
Cybersecurity
Cyber threats linked to COVID

Has the Coronavirus had negative effects on the state of global cybersecurity? Unfortunately, yes. In the past few hours, there has been a series of cyber-attacks against the Italian pharmaceutical...
Cybersecurity
How the Italian Army defends itself from cyber threats: the RSC

The Italian Army has recently made the Cyber Security Department (RSC) operational, after establishing it around two years ago. As threats to cyber space increase exponentially, it is absolutely vital...
Cybersecurity
Augmented and Virtual Reality: what are the privacy risks?

Last month, Nintendo released a new video game in the popular Super Mario Kart saga. The game is part of a new category of Toys-to-life, a video game genre that...
Cybersecurity
The double extortion technique: the Campari case

In recent weeks the Campari group has suffered a serious ransomware attack of the so-called “double extortion” technique. The damage would amount to two terabytes of stolen data, with attached...
Cybersecurity
Cybersecurity and the implementation of smart working

Faced with the unexpected health crisis, institutions and companies around the world are trying to facilitate the implementation of smart working through the dispersion of adequate rules and procedures. The...
Cybersecurity
QNodeService stepped up its features while operated in widespread credential-theft campaigns

Since mid-year 2020, a new piece of malware emerged in the cyber threat landscape. It seems to be linked to the crimeware matrix due its main purpose and use, which...
Cybersecurity
Trying not to walk in the dark woods. A way out of the Maze

After numerous ransomware attacks since its appearance in May 2019, the popular Maze Team recently claimed the end of its criminal activity through a press release on its Dedicated Leak...
News
Enisa report 2020: the pandemic’s effect on cybersecurity

Enisa (the European Union Agency for Cybersecurity) has recently published the eighth edition of its Threat Landscape Report (ETL) on cyber threats registered in the period between January 2019 and...
Cybersecurity
Operation “Space Race”: reaching the stars through professional Social Networks

At the beginning of May 2020, Telsy analyzed some social-engineering based attacks against individuals operating in the aerospace and avionics sector performed through the popular professional social network LinkedIn. According...
Cybersecurity
Cybersecurity’s weakest link: the human factor

The latest studies are further confirming a fact that, although already known, is still too often ignored: the human factor is the greatest source of risk for companies’ IT security....
Cybersecurity
Cloud, Edge Computing and the future of cybersecurity

Cloud Computing is today a fully consolidated and still expanding reality, but the exponential development of IoT and 5G technology is increasingly attracting attention to Edge computing, a new distributed...
Cybersecurity
Twitter attack: the three lessons to learn

The recent cyber-attack that hit Twitter has created a lot of media sensation, especially because it is the first time that one of the great global social media platforms has...
Cybersecurity
Turla / Venomous Bear updates its arsenal: “NewPass” appears on the APT threat scene

  Recently Telsy observed some artifacts related to an attack that occurred in June 2020 that is most likely linked to the popular Russian Advanced Persistent Threat (APT) known as...
Cybersecurity
Ransomware: a threat to the present and the future

Ransomware has become an increasingly prominent threat to cyberspace security globally and the recent statistical data collected would seem to confirm this trend also for the years to come.  ...
Cybersecurity
Cyber war: the current scenario

The modern hybrid war Lately we hear more and more often about “hybrid” or “asymmetric” war, terms intended to explain a military strategy that mixes conventional war, irregular war and...
Cryptography
Steganography: from its origins to the present

The term steganography refers to a technique that aims to hide communication between two interlocutors. The term is composed precisely of the Greek words στεγανός (covered) and γραφία (writing). Unlike...
Cryptography, Quantum Security
War and cryptography: the challenge of quantum communication

Message encryption has always been a very important tool within the military, stretching back to the time of the ancient Greeks to the present day. It is natural for two...
Cybersecurity
How Artificial Intelligence and Machine Learning will change the world of cybersecurity

Artificial Intelligence (AI) and Machine Learning (ML) tools could substantially help in the fight against cybercrime. But even these technologies can’t guarantee absolute security, and they could even be exploited...
Cybersecurity
Simjacker and other cyber threats for mobile devices in 2020

At the end of last year, a security company discovered a serious threat to the world of cell phones and beyond: Simjacker, an attack technique that allows, in fact, to...
Cybersecurity
The revolutionary methods to attack air-gapped devices

In the last few years, the Cyber-Security Research Center of Israel’s Ben Gurion University of the Negev coordinated by Dr. Mordechai Guri, has developed and tested several new types of...
News
Telsy’s report on UniCredit’s data breach went viral worldwide

On the evening of April 19, Telsy denounced that the personal data of about 3000 employees of the UniCredit S.p.A. bank, one of the largest banks in Italy, had been...
Cybersecurity
Unicredit employees database for sale on cyber-crime forums

On the late afternoon of 19/04/2020, a threat actor posted a new sale on a hacking and cyber-crime forum selling the database of UniCredit employees. UniCredit S.p.A. is an Italian...
Cybersecurity
Coronavirus: reported a new campaign of spear phishing attacks to steal personal data

A few days ago, on the 27th of March, industry reporting signalled a new campaign of Covid-19/ coronavirus-themed spear phishing attacks that illegitimately uses the WHO (World Health Organization) mark,...
Cybersecurity
Cybercriminals trojanized orginal SM Covid-19 awareness Android app to target Italy

In these days of particular sacrifices due to the spread of the COVID-19 pandemic, cyber criminals do not seem to save anyone and on the contrary, taking advantage of the...
Cryptography, Quantum Security
Quantum challenges to cryptography: why the future is already here

More and more often, we hear rather dramatic and movie-like statements about how the quantum era will change many aspects of our life, among which also cryptography and, therefore, security....
Cybersecurity
Telsy Cyber Security Awareness – Stay cyber safe at home

Il responsabile della divisone di Cyber Security e Threat Intelligence di Telsy, Emanuele De Lucia, ha stilato un documento rivolto all’utenza comune utile ad accrescere la consapevolezza dei rischi del...
Cybersecurity
Strengthen Android privacy and security via Telsy free secure DNS over TLS

Starting from Android 9 Pie (https://www.android.com/versions/pie-9-0/ ), Google has released some interesting features related to the tuning of its mobile operating system and in particular the possibility of modifying some...
Cybersecurity
APT34 (aka OilRig, aka Helix Kitten) attacks Lebanon government entities with MailDropper implants

Very recently another custom malicious implant that seems to be related to APT34 (aka OilRig) has been uploaded to a major malware analysis platform. Since 2014, year in which FireEye...
Cryptography
ON THE CONDITION NUMBER OF THE VANDERMONDE MATRIX OF THE nTH CYCLOTOMIC POLYNOMIAL

Edoardo Signorini is an undergraduate student who is currently working on various projects in Telsy, while writing his thesis about the “Post Quantum Cryptography”. Furthermore, he also published his work...
News
Webinar: ”Iranian Cyber Capabilities”

On March 6th at 11 am our Head of CTI Division, Emanuele de Lucia, and our CTI Analyst, Marco di Costanzo, will hold a webinar entitled ”Iranian Cyber Capabilities”.This webinar...
News
Telsy has been involved in the organization of the seminar: “BITCOIN, LA MONETA SENZA AUTORITÀ”.

The event will take place on 28 of February, at Turin University, in “Aula Buzano”. Following a short abstract: “Bitcoin is a digital currency that operates without any central authority. The...
Cybersecurity
A Password is not a Pass-Word

From bank accounts to entertainment, our virtual life is wider than ever, and with the 4th industrial revolution is only meant to grow at an exponential rate. Within this redefined...
Cybersecurity
Meeting POWERBAND: The APT33 .Net POWERTON variant

Introduction Since the Islamic revolution, US and regional rivals have put continuos effort in containing and isolating Iran. Implementing a foreign policy generally addressed as “strategic loneliness”, Iran’s defense strategy...
Cybersecurity
How well does my car know me?

It is certain that our cell phones and electronic devices collect a wide variety of data about us. On top of the new technologies to which we expose our home...
Cybersecurity
Tamper detection technologies: it takes a thief to catch a thief

Tamper detection is a concept already present in our everyday life, even when we are not aware that it can be called by that name, or even that it is...
Cybersecurity
Think differently, secure differently

In the new evolving communication landscape, cyber threats do not just target things, objects, or devices. First and foremost, cyberattacks target people and leverage on user’s and programmer’s psychology. On...
Cybersecurity
New threats, new solutions: fighting insecurity with Machine Learning

The landscape of possible cyberthreats is rapidly changing, exploiting vulnerabilities in new technologies, systematically jeopardizing wide and multifaceted systems, and threatening the security of an ever increasing amount of information....
News
NOKIA IMPACT WEB PLATFORM – Responsible Vulnerabilities Disclosure

During some activities of the Telsy research team within a client company, some vulnerabilities emerged in the product NOKIA IMPACT WEB PLATFORM. These vulnerabilities are currently identified according to the...
Cybersecurity
Foreseeing what is next: the rise of 5G technologies

At the end of the 17th century, the French artist Jean-Marc Côté was commissioned some illustrations about en l’an 2000. Already back then, life in the 2000 was pictured as...
Cybersecurity
The Lazarus’ gaze to the world: What is behind the second stone ?

Introduction In a recent blog post (link here) we analysed the first part of an operation likely conducted by APT38/Lazarus, which targeted various organizations, including financial and banking ones. We...
News
Telsy has been involved in the organization of the event ‘’DE CIFRIS AUGUSTAE TAURINORUM’’, that outlines an overview on cryptanalysis of ARX ciphers.

The event will take place on 22 on November, at Turin University (Aula 2), in ‘’Via Carlo Alberto 10’’. Following, a short abstract:   ‘’ We present some features of...
Cybersecurity
Make the Internet a Secure++ Word – The Internet Service Provider Role

“The current world of telematic communications appears as fast-changing environment. The actors of this ecosystems are represented by billions of nodes that, every day, globally transmit a huge amount of...
Cybersecurity
The Lazarus’ gaze to the world: What is behind the first stone ?

Introduction Lazarus (aka APT38 / Hidden Cobra / Stardust Chollima) is one of the more prolific threat actors in the APT panorama. Since 2009, the group leveraged its capability in...
Cybersecurity
The deadly link between zero-day exploit and DDOS botnet attacks

The growing demand for connectivity and faster data transfer, along with new technology trends such as the Internet of Things (IoT) and the Artificial Intelligence (AI), combined withthe progressive implementation...
News
Our Embedded Engineer Andrea Molino was one of the speakers at the National Cryptography Association ”De componentis cifris ”

On 14 October 2019, a member of our team, Eng. Andrea Molino, gave a speech at the event ”La De Cifris incontra Torino” , organized by De Componendis Cifris and...
Cybersecurity
Hacking the Artificial Intelligence

The enemies of the future will not necessarily need bombs, missiles or atomic weapons to instil terror in civilian populations. They will need only some tape, scissors and good practical...
Cybersecurity
Cybersecurity & Cyberattacks, a Hand In Hand Development Through The Years

The birth of the internet and the digital era brought to the light the theme of “cybersecurity”, that over the past years gained more and more importance. Security, indeed, has...
Cybersecurity
DeadlyKiss: Hit one to rule them all. Telsy discovered a probable still unknown and untreated APT malware aimed at compromising Internet Service Providers

In the first days of September 2019, Telsy Cyber Threat Intelligence Unit received a variant of a strange and initially mysterious malware from a stream of thousands of samples coming...
Cybersecurity
Zebrocy relies on dropbox and remote template injection to supply its dishes to an institution of Eastern Europe diplomatic sector.

Introduction On the 22nd of August 2019, a new spear-phishing email message has been collected by Telsy CTI Team. This malicious email has been armed with an attached lure document...
Cybersecurity
PRIMITIVE BEAR USES A NATO-THEMED LURE DOCUMENT TO TARGET UKRAINIAN GOVERNMENT AND DEFENSE AGENCIES

Recently we caught a NATO-themed malicious lure document to be likely associated with a new PRIMITIVE BEAR operation conducted against Ukrainian defense and government agencies. According to its metadata, the...
Cybersecurity
Unknown threat actor is using Agent Tesla variants against Oil&Gas and Energy Sector

On 02/07/2019, Telsy TRT catched a new malware variant belonging to Agent Tesla family addressed to companies operating in the Energy and Oil&Gas sector. Among these organizations, Telsy identifies a...
News
Seminar – “An introduction to secure multi – party computation”

Telsy seminar of Giuseppe D’Alconzo entitled: “An introduction to secure multi – party computation” The seminar, organized with The Polytechnic University of Turin, will be held on Monday 15 July...
News
Seminario Prof. Desmedt, 1 luglio 2019

Seminario del Professor Yvo Desmedt dal titolo Private and reliable communication with untrusted components Il seminario, organizzato da Telsy in collaborazione con il Politecnico di Torino, si terrà lunedì 1...
Cybersecurity
Recent “CEO Fraud” campaign is spreading within EU and already made victims. Telsy TRT joined an international collaborative effort for researching and mitigating the threat.

Malware workflow enable.cmd provides the first system configurations and the starts the executable sender.exe. sender.exe is able to handle some startup parameters given as input; the values of these parameters...
Cybersecurity
APT34: New leaked tool named Jason is available for the mass

In the afternoon of 03/06, Lab Dookhtegan released a new tool they report belonging to the hacking arsenal of the group APT34. This hacking tool seems to be useful in...
Cybersecurity
Following the Turla’s Skipper over the ocean of cyber operations

In the middle of May 2019 new malware variants identified to be part of Turla suite comes into light. Turla, also known as Snake or Uroburos is one of the...
Cybersecurity
Telsy TRT releases its YARA rule to detect Turla LightNeuron, the Microsoft Exchange backdoor

A recent APT malware infection, known as LightNeuron, uses the basic functions of Microsoft’s Exchange Server to monitor and control outgoing and incoming communications from mail servers. The threat group...
Cybersecurity
Unknown threat actor is using a compromised website belonging to a government institution of Middle-East in a campaign referring commercial and financial themes.

Recently, Telsy TRT detected a wave of malicious documents trying to impersonate an official institution of a government of Middle-East. Moreover, the website of another government institution of the same...
News
Playing with PS RogueRobin; The DarkHydrus PowerShell payload

In July 2018, Palo Alto Unit 42 analyzed a targeted attack spreading in the Middle East. In that case, the threat actor used a custom PowerShell based payload that the...
Cybersecurity
Protected: “AVE_MARIA”; it’s not our Sunday prayer. It’s a cheap, publicly referenced and advertised RAT. OSINT insights by TTRT.

There is no excerpt because this is a protected...
Cybersecurity
Threat Hunters vs Red Teamers. A meeting in the cyber space…

Recently, a new wave of malicious decoy Microsoft Office documents addressed exclusively to a central country of the european geographical area was intercepted by Telsy TRT. These have been collected...
Cybersecurity
OceanLotus On ASEAN Affairs

In last days of March, Telsy TRT captured same malicious macro armed documents likely tergeting ASEAN affairs and meeting members. Telemetry and spreading statistics related to these decoy documents highlight...