County Government Reportedly Paid $1 Million to Cyber Extortion Group

A government entity in the US reportedly paid a $1 million ransom to the Kairos cyber extortion group to prevent the public dissemination of information stolen in a May 2025 intrusion, Ransom-ISAC reports.

A leaked negotiation transcript shows that the extortion group demanded $3 million in cryptocurrency from the victim organization, but eventually settled for $1 million.

Kairos claimed to have stolen over 2 terabytes of data, or approximately 1.6 million files, after accessing the victim’s environment in a brute-force attack.

During the three-week negotiation, the victim increased its offer from $100,000 to $430,000, but eventually accepted a hard deadline and the $1 million ransom, which was paid in Bitcoin on June 13.

The attackers pressured the victim with public exposure, while maintaining control of deadlines and proof-of-access artifacts.

“The affected entity’s responses are consistent with an organization buying time while legal, leadership, financial, and communications decisions were coordinated,” Ransom-ISAC notes.

Advertisement. Scroll to continue reading.

The anti-ransomware organization notes that the incident was an extortion attack and did not involve file-encrypting ransomware. The attackers’ proof-of-deletion appears selective, not comprehensive, but the listings they provided are consistent with a real file-server scrape.

According to Ransom-ISAC, the provided proof of deletion could have been generated by erasing a copy of the data, and no mechanism to independently verify the deletion was provided.

Ransom-ISAC did not name the affected organization, but the negotiation transcript identifies it as “a small county with very limited resources.”

The affected government body reportedly appears to be Union County, Ohio. In September, the county notified (PDF) 45,487 individuals that their personal information was stolen in a ransomware attack in May 2025.

The affected information included names, dates of birth, driver’s license/state ID numbers, passport numbers, Social Security numbers, financial account details, fingerprint information, medical information, and payment card details.

SecurityWeek has emailed Union County for a statement on the matter and will update this article if the county responds.

https://www.securityweek.com/county-government-reportedly-paid-1-million-to-cyber-extortion-group/

Armored Likho APT Targeting Government, Electric Power Entities

A recently discovered advanced persistent threat (APT) actor has been targeting government and electric power organizations in multiple countries, Kaspersky reports.

Dubbed Armored Likho, the APT engages both in financially motivated attacks against individuals and in cyber-espionage operations against organizations in Russia, Brazil, and Kazakhstan.

The threat actor’s arsenal includes modular remote access trojans (RATs) and information stealers, including the Python-based BusySnake Stealer, and tools like Go2Tunnel for remote access and network tunneling.

“This diverse malware stack enables the threat actor to maintain stealthy control of compromised hosts, exfiltrate credentials and other sensitive information, and dynamically deploy downloadable modules tailored to the victim’s profile and the tasks at hand,” Kaspersky notes.

Armored Likho mainly relies on spear-phishing for initial access. Archives attached to its emails contain executables or LNK files that, once opened, display decoys while malware is being installed in the background.

A loader injected in memory via such an executable was seen fetching archives from GitHub repositories that contain early development builds and test samples of the malware. The LNK files display a fake document while a Python 3.12 interpreter and an archive are fetched in the background.

Advertisement. Scroll to continue reading.

Among other components, the archives contain a Python-based infostealer that Kaspersky tracks as BusySnake Stealer. The malware packs multiple evasion techniques and dynamically decrypts bytecode when a function is called, encrypting it immediately after, and runs in the background without a console window.

The stealer relies on multiple handlers for various functions, such as clipboard theft, file enumeration, 64-character hexadecimal key extraction, document exfiltration, screenshot capture, screenshot archiving, persistence checks, and command execution.

Based on commands received from the command-and-control (C&C) server, the malware can capture screenshots, exfiltrate logged keystroke data, decrypt stored passwords from Chromium-based and Firefox browsers, extract cookies from browsers, scrape the machine for OTP keys, find cryptocurrency wallets, harvest Telegram sessions and credentials, establish a reverse SSH tunnel, and restart RustDesk to capture users’ credentials.

Before BusySnake Stealer, Armored Likho relied on Go2Tunnel to establish a reverse SSH tunnel, but has implemented the functionality into the infostealer, which can now provide the attackers with persistent remote access and interactive control over the victim’s system.

Armored Likho’s operations appear to overlap with Eagle Werewolf activity. Previously, the hacking group was seen using the AquilaRAT RAT, which shares a similar structure and persistence mechanism with BusySnake Stealer.

https://www.securityweek.com/armored-likho-apt-targeting-government-electric-power-entities/

Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Threat actors are using prompt injection attacks embedded in malicious websites and manipulated search results to trick AI agents into making payments or trusting fraudulent cryptocurrency platforms.

Zscaler says it identified two campaigns relying on indirect prompt injection, including a payment scam hiding behind API documentation, and a typosquatting operation promoting a crypto platform that impersonates DeBank.

As part of the first campaign, the threat actor has been using SEO poisoning to target AI agents searching for the Python library requests-secure-v2.

“The fraudulent website includes keyword-heavy HTML tied to the fake Python module to poison search results for package installation and dependency troubleshooting queries,” Zscaler explains.

Within the website, the attackers hid indirect prompts instructing the visiting agents to make a payment as part of the routine process of acquiring an API key. The payment was encoded in schema markup to increase the chances that the agents would follow the instructions.

A hidden <div> tag instructing AI agents to resolve an error by making the payment was also discovered on the website, as well as code to initialize a cryptocurrency transfer to a hardcoded wallet.

Advertisement. Scroll to continue reading.

“The website not only attempts to target AI agents, but also human developers. When the website is rendered by a desktop browser, the same payment options via credit card or cryptocurrency are displayed to the user,” Zscaler explains.

The threat actor behind the campaign is using 10 GitHub repositories linking to multiple similar websites containing indirect prompt injections.

As part of the second campaign, a threat actor is promoting a fraudulent website typosquatting the decentralized finance portfolio tracker DeBank. The indirect prompts used in this campaign tell the AI agents that the impersonating website is the legitimate DeBank domain.

“The fraudulent website is optimized to rank for DeBank-related searches by stuffing the title and meta tags with keywords such as DeBank Login, DeFi Dashboard, and Crypto Tracker. It also includes Open Graph and X (formerly Twitter) metadata to make the link appear like an official DeBank service,” Zscaler notes.

To test the campaigns’ impact, the cybersecurity firm built an autonomous AI agent with web-browsing and payment-execution capabilities.

Of the 26 LLMs that were evaluated, four (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro) were successfully manipulated into making a payment. Still, only two (Claude Sonnet 4.5 and GPT-5.4) miscategorized the fraudulent website as the trusted DeBank platform.

“As AI agents become a more common interface to the web, the content itself is going to become a larger attack surface, highlighting that AI is a double-edged sword that can streamline workflows while also introducing new avenues for abuse,” Zscaler notes.

https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/

In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting

SecurityWeek’s cybersecurity news weekly roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape.

This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment.

Here are this week’s highlights:

Anonymous-linked hacker Aubrey Cottle jailed over Texas GOP cyberattack

Aubrey Cottle, a Canadian hacker associated with the hacktivist group Anonymous, has been sentenced to 18 months in prison for his involvement in a cyberattack on the Texas Republican Party’s website in September 2021. Cottle, 39, of Oshawa, Ontario, pleaded guilty to defacing the website, exfiltrating data from a Texas GOP server, and publishing the data online.

14 million impacted by KDDI data breach

Advertisement. Scroll to continue reading.

Japanese telecoms provider KDDI has disclosed (PDF) a data breach likely impacting the email addresses and passwords of 14,22 million people. The incident affected five ISP operators, including BIGLOBE, Chubu Telecommunications C., JCOM Co., NIFTY Corporation, and STNet.

Push Security targeted in poisoned tenant attack

Three years after detailing the poisoned tenant attack, Push Security was targeted using the technique via OpenAI’s organization invitation feature. Multiple employees received an OpenAI invitation to join Push Security Inc. After they would join the tenant, the attacker could spy on their activities or target them with further social engineering.

Rust-based PamStealer targeting macOS

Jamf has detailed PamStealer, an information stealer targeting macOS that validates the harvested credentials via Pluggable Authentication Modules (PAM) before using them. The malware is distributed as a compiled AppleScript file impersonating the open source clipboard manager Maccy.

Russian hackers behind the 2025 Jaguar Land Rover hack

The cyberattack that severely disrupted Jaguar Land Rover’s operations in September 2025 was mounted by Russian hackers, The New York Times says. Microsoft reportedly notified the car manufacturer about the hacking group, with Mandiant, Palo Alto Networks, and US and UK law enforcement agencies also involved in the investigation.

Pegasus spyware targeted a European Parliament member investigating it

Former member of the European Parliament Stelios Kouloglou was hacked with NSO Group’s Pegasus spyware while he was investigating Pegasus abuse cases, as part of the PEGA committee, Citizen Lab discovered. The targeting has not been attributed to a specific government, and there is no evidence that the Greek Government was involved.

Researcher drops dozens of zero-days in open source projects

A researcher known as Bikini has published proof-of-concept (PoC) code targeting dozens of zero-day vulnerabilities in multiple open source projects, including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC. Nine of the security defects have been assigned a CVE identifier. The issues, the researcher says, were surfaced via LLM fuzzing.

Pro-Russia influence operations are shifting

Four years into Russia’s invasion of Ukraine, pro-Russia influence operations are shifting from their single focus on Ukraine to pre-war objectives, Google says. Covert pro-Russia influence operations are targeting the US, European Union members, NATO, Russia’s neighbors, the Middle East and Africa, and internal entities. They focus on global events, elections, the war in Ukraine, and emerging geopolitical developments and events, and are increasingly relying on generative AI.

Venezuelans sentenced in the US over ATM jackpotting

Two illegal aliens from Venezuela, Carlos Javier Padron, 36, and Arnoldo Cabrera Torrealba, 37, have been sentenced to 78 months in prison in the US for their involvement in ATM jackpotting activities. As part of a sophisticated criminal group, they built and deployed a variant of the Ploutus malware on ATMs across the US and used it to withdraw money without authorization. They were also ordered to jointly pay $1.5 million in restitution. 96 other defendants have been charged over their roles in the operation.

Cisco and Synology patches

Cisco has released fixes for seven ClamAV vulnerabilities impacting Secure Endpoint Connector for Windows, Linux, and macOS, and Secure Endpoint Private Cloud, and for one flaw in Catalyst Center. Synology resolved three security defects in MailPlus Server, including two critical bugs that could allow attackers to read or write arbitrary files and cause DoS conditions.

Join the AI Risk Summit | Ritz-Carlton, Half Moon Bay

https://www.securityweek.com/in-other-news-canadian-hacker-jailed-open-source-zero-days-two-sentenced-for-atm-jackpotting/

Medtronic Data Breach Impacts 3.8 Million People

Medical technology giant Medtronic is notifying more than 3.8 million individuals that their personal and medical information was compromised in a recent data breach.

The incident occurred in April 2026, when the infamous extortion group ShinyHunters accessed the company’s corporate IT systems.

Medtronic confirmed the attack in late April, noting that its products and manufacturing and distribution operations were not affected.

ShinyHunters had added the company to its Tor-based leak site on April 17, claiming the theft of over 9 million records of personal information, and terabytes of corporate data.

The group has since removed Medtronic from the website, which suggests that the company might have paid a ransom to recover the stolen information.

This week, the medical technology titan started sending written notification letters to the affected individuals, confirming that the hackers stole patients’ personal and medical information, including names, contact details, dates of birth, Social Security numbers, and health-related details.

Advertisement. Scroll to continue reading.

“We have no evidence that any of that information was posted publicly or exposed on the internet,” reads a copy of the company’s notification letter (PDF) submitted to the California Attorney General’s Office.

Medtronic told the Indiana Attorney General’s Office that 3,834,294 individuals were affected by the incident.

The company is providing them with 24 months of free credit monitoring, dark web monitoring, and identity theft restoration services.

“Medtronic has implemented additional safeguards and continues to work with third-party cybersecurity experts to identify opportunities to further strengthen the security of its systems. Medtronic has also worked with law enforcement and is notifying relevant regulatory authorities,” the company said.

https://www.securityweek.com/medtronic-data-breach-impacts-3-8-million-people/

Alleged Scattered Spider Hacker Extradited to US

A dual US-Estonian citizen was extradited to the US to face charges for his alleged involvement in the activities of the infamous hacking group Scattered Spider.

The individual, Peter Stokes, 19, also known as ‘Bouquet’, was arrested in Finland in April while boarding a flight to Japan. He was indicted with counts of conspiracy, computer intrusion, and fraud.

In May 2025, together with other co-conspirators, Stokes allegedly hacked a luxury jewelry retailer’s computer system, stole data from it, and demanded an $8 million ransom in cryptocurrency from the victim.

While the retailer managed to evict the hackers from its network and no ransom was paid, the attack led to business disruption, which, together with the investigation and mitigation actions, caused at least $2 million in losses.

Also tracked as 0ktapus, Muddled Libra, Octo Tempest, Starfraud, Scatter Swine, and UNC3944, Scattered Spider is believed to have hacked at least 100 organizations and to have received over $100 million in ransom payments from its victims.

The group is known for its widespread 2025 Salesforce hacking campaign and for the 0ktapus campaign, which hit over 130 organizations in 2022.

Advertisement. Scroll to continue reading.

Over the past several years, authorities charged, arrested, and sentenced multiple alleged members of the hacking group. In April this year, UK national Tyler Robert Buchanan pleaded guilty in the US for his role in the Scattered Spider operations.

In September last year, after making the headlines for high-profile attacks against the retail, insurance, and aviation industries, Scattered Spider announced its retirement.

https://www.securityweek.com/alleged-scattered-spider-hacker-extradited-to-us/

Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices

Google, the FBI, and other organizations coordinated in a joint effort to dismantle NetNut, a massive residential proxy network.

Also known as Popa, NetNut is believed to consist of more than 2 million Android devices such as smart TVs and streaming boxes, that have been infected through trojanized applications and malware such as Badbox 2.0.

The network’s operator, linked to the publicly-traded Israeli firm Alarum Technologies Ltd, rented the residential proxies to various threat actors, including cybercriminal and espionage groups.

In a single week in June, Google observed 316 distinct threat clusters using NetNut to hide their locations in password-spray attacks and to access victim environments.

“We believe our coordinated actions have caused significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions,” Google said.

As part of the operation, the internet giant disabled Google accounts and associated services used for command-and-control (C&C), dismantling the botnet’s backend infrastructure.

Advertisement. Scroll to continue reading.

Additionally, it disabled the infected applications via Google Play Protect and automatically warned victims of the threat. Google also shared threat intelligence with industry partners and law enforcement.

According to Google, NetNut is not only selling access to the residential proxy network under its own brand, but also operates a reseller program, allowing other popular brands to whitelabel the NetNut botnet.

The NetNut takedown follows the January disruption of IPIDEA, and is expected to have a ripple effect across the ecosystem.

“What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers,” Google says.

Related: GlassWorm Botnet Disrupted

https://www.securityweek.com/google-fbi-disrupt-netnut-residential-proxy-network-powered-by-millions-of-devices/

Intelligence russa e app di messaggistica: il phishing ora punta alle chiavi di backup di Signal

L’intelligence ucraina conferma e amplia l’allarme statunitense: i servizi russi non rompono la crittografia delle app di messaggistica, ma convincono le vittime a consegnare le chiavi che proteggono i loro backup. Il bersaglio sono funzionari, militari, politici e attivisti in Ucraina, Europa e Stati Uniti. La svolta operativa più recente riguarda in modo specifico Signal; WhatsApp rientra nel quadro più ampio di targeting, non in questa singola tattica.

Il 27 giugno il Servizio di Sicurezza dell’Ucraina (SSU) ha reso noto, in un comunicato su Telegram, di avere ricostruito insieme all’FBI una campagna di lungo corso condotta dai servizi di intelligence russi per violare gli account di messaggistica di obiettivi ad alto valore informativo. Lo SSU non attribuisce l’attività a uno specifico gruppo, ma la inquadra come operazione sistematica di spionaggio: l’obiettivo dichiarato è accedere a informazioni militari, politiche ed economiche scambiate dagli utenti e sottrarne i dati personali. La tecnica di ingresso è un SMS che si finge il bot di assistenza della piattaforma e induce la vittima a rivelare le proprie credenziali.

La comunicazione ucraina arriva il giorno dopo l’aggiornamento congiunto FBI e CISA del 26 giugno, l’avviso
I-062626-PSA
, che rivede il precedente PSA di marzo e introduce l’elemento operativo più rilevante. Gli attori non si limitano più a carpire codici di verifica o PIN dell’account, né a collegare dispositivi controllati dall’aggressore: ora puntano a farsi consegnare la Backup Recovery Key, la chiave che cifra la copia di backup delle conversazioni. Chi ottiene quella chiave può ripristinare il backup, leggere la cronologia di messaggi privati e di gruppo e prendere il controllo dell’account.

Il punto tecnico: non è una falla di Signal

L’FBI è esplicito su un aspetto che conviene tenere fermo per non amplificare letture distorte: gli attori hanno compromesso singoli account, non la crittografia delle applicazioni né le applicazioni stesse. Il perimetro violato è quello del recupero e del backup, non quello del protocollo end-to-end. La leva resta l’inganno: i messaggi-esca riprodotti nell’avviso si presentano come comunicazioni ufficiali di Signal e guidano passo passo l’utente a generare la chiave di recupero e a incollarla in chat, con la promessa di evitare la perdita di messaggi o di sincronizzare un backup a rischio.

Il flusso documentato dall’FBI presuppone due passaggi: prima la vittima attiva il backup seguendo la finta comunicazione (Figura 1 dell’avviso, etichettata Sample Phishing Message 1), poi consegna la chiave di recupero (Figura 2). Entrambi i messaggi-esca ricalcano i passaggi dell’interfaccia di Signal (impostazioni, backup, visualizzazione della chiave), e proprio per questo la nuova tattica delle chiavi di backup va circoscritta a Signal, mentre il riferimento a WhatsApp resta valido per la campagna nel suo insieme.

C’è un dettaglio che alza la posta sul piano della persistenza. Se la vittima condivide la Backup Recovery Key, quella chiave resta valida anche dopo la ricreazione dell’account sullo stesso numero di telefono: l’aggressore potrebbe quindi rientrare in un secondo momento. L’unica contromisura indicata è generare una nuova chiave nelle impostazioni, operazione che invalida la precedente per i download futuri; resta però il fatto che un backup già scaricato dall’attaccante non si annulla. La separazione tra ciò che si può ancora proteggere e ciò che è già compromesso è netta, e va comunicata con altrettanta chiarezza agli utenti a rischio.

Attribuzione e nomi cluster

Sul fronte dell’attribuzione conviene muoversi con cautela, perché le diverse fonti usano etichette diverse. L’FBI parla di più cluster riconducibili ai servizi russi (RIS), tra cui ufficiali dell’FSB inseriti nella Guardia di Frontiera e soggetti che operano per conto delle forze militari, e li traccia pubblicamente come UNC5792
e UNC4221
. Lo SSU, dal canto suo, non nomina un gruppo. Le ondate di attacco analoghe contro utenti Signal e WhatsApp sono state ricondotte in letteratura ai cluster noti come Star Blizzard, UNC5792
(parzialmente sovrapponibile a UAC-0195
per il CERT-UA) e UNC4221
(equivalente a UAC-0185
): nomenclature da incrociare con prudenza, perché la stessa attività può comparire sotto sigle differenti a seconda del fornitore di intelligence o dell’agenzia nazionale.

Va segnalato anche un punto su cui è facile inciampare leggendo l’avviso: la frase che attribuisce gli attacchi a hacker dall’Iran e da Paesi post-sovietici non è una valutazione dell’FBI, ma testo del messaggio-esca riprodotto nell’avviso, ossia parte stessa della truffa.

Perché interessa lettori europei e italiani

La campagna non è un fatto di cronaca confinato al fronte ucraino. L’FBI include tra i bersagli funzionari governativi statunitensi e internazionali, personale militare, figure politiche e giornalisti; lo SSU estende esplicitamente il perimetro a Europa e Stati Uniti, e anche a profili personali di cittadini ucraini.

Per chiunque, in ambito istituzionale, di difesa o giornalistico europeo, usi le app di messaggistica come canale di lavoro, il modello di rischio cambia: la superficie da presidiare non è la cifratura del messaggio, ma il ciclo di vita di sessioni attive, backup e chiavi di recupero. È lo stesso terreno su cui si gioca, da anni, la sicurezza della messaggistica sicura, e che il cyber spionaggio russo ha imparato a sfruttare combinando ingegneria sociale e infrastruttura di intelligence.

Le indicazioni difensive restano elementari ma dirimenti: rivedere periodicamente le sessioni attive e disconnettere i collegamenti sconosciuti, attivare la verifica a due fattori, non scansionare QR ricevuti da utenti non noti e, soprattutto, non comunicare mai codici di conferma, PIN, password o chiavi di recupero, per quanto la richiesta appaia urgente o ufficiale. Come ricorda l’FBI, l’assistenza legittima delle app non chiede codici dentro l’applicazione e non invia link per verificare o ripristinare un account.

Condividi sui Social Network:

https://www.ictsecuritymagazine.com/notizie/intelligence-russa-chiavi-di-backup-messaggistica/

Chinese Framework Powers 200,000 Scam Sites

More than 200,000 websites are using investment scam templates built with the Chinese open source framework Uni-App, Infoblox reports.

A cross-platform development toolkit, Uni-App allows developers to create Vue.js codebases that can be deployed as mobile and desktop applications, or as mobile-optimized websites simultaneously.

Widely used in China and supported by a developer ecosystem, the framework powers thousands of legitimate products, and its maker DCloud does not appear to be involved in its fraudulent use.

However, Infoblox discovered that threat actors are selling investment scam templates, and that numerous scam websites using such templates appear linked to the same cluster of activity.

“Beyond the technical connections, we also uncovered patterns in the growth of the DCloud investment sites, along with coordinated dips in new domain registrations seen across scam websites on diverse hosts, an indication of a centralized owner facing disruption or making coordinated changes across all their DCloud investment scam sites,” the cybersecurity firm notes.

Infoblox identified over 236,000 second-level domains powering the scam infrastructure, ranging from fake crypto exchanges to fake gambling, brand impersonation, WhatsApp phishing, and multi-language pig-butchering websites.

Advertisement. Scroll to continue reading.

Among them is the infamous RainbowEx platform, a fake cryptocurrency platform that made international headlines after thousands of residents of a small Argentine town were duped into pouring money into it.

Hosted across numerous providers, the scam second-level domains have been launched since mid-2022, with an increase observed since late 2024, after the RainbowEx scandal.

“After October 2024, that figure jumped to roughly 15,000 newly observed sites per month at peak. The framework appears to have become a known platform within the scam-operator ecosystem due to the coverage it received by major news outlets,” Infoblox notes.

The largest portion of DCloud-fingerprinted sites consists of investment scam domains, run by multiple unrelated operators, “possibly dozens, even hundreds,” the cybersecurity firm says.

In addition to fake cryptocurrency exchanges and ‘deposit-and-trade’ platforms, they also include crypto wallet drainers, prediction-market and gambling impersonators, messaging platform phishing, and other phishing and credential-harvesting sites.

Lightning Shared Scooter Co. (LSSC), an operation that likely caused millions of dollars in losses in the US, was also using Uni-App. It promised investors sharp increases in passive revenue through funding a high-tech scooter-sharing company, and increased its sense of legitimacy through physical storefronts.

A similar scooter-investment operation, Yuechi Sharing Technology Ltd. (YST), currently active in Australia, New Zealand, and the United States, also has a frontend built using the Uni-App framework. YST, Infoblox says, has legitimate registration paperwork but is connected to a network of other investment-scam websites.

“For the last two years, there’s been a dramatic scaling up of scam websites using the DCloud framework, and operators of these sites continue to launch complex real-world schemes to trick victims. It’s overdue to holistically track threat actors operating in this ecosystem and attempt to identify commonalities that indicate shared ownership of the sites,” Infoblox notes.

https://www.securityweek.com/chinese-framework-powers-200000-scam-sites/

STOCKSTAY, la nuova backdoor di Turla che guarda anche alla politica estera italiana

Google Threat Intelligence Group (GTIG) ha pubblicato l’analisi di STOCKSTAY, una backdoor modulare in .NET sviluppata dal gruppo russo Turla almeno dal dicembre 2022 e impiegata in operazioni dal 2023 per attività di spionaggio contro organizzazioni governative e militari in Ucraina. Il dettaglio che rende la ricerca rilevante per il pubblico italiano è esplicito nel rapporto: tra gli obiettivi figurano anche entità interessate alla politica estera italiana, con campioni di sviluppo individuati in Italia e lure in lingua italiana a tema elettorale e affari esteri.

Turla è uno degli attori di cyber espionage più longevi e meglio profilati. Opera, secondo l’analisi GTIG, sotto diverse etichette assegnate dai vendor: SUMMIT per Google, Secret Blizzard per Microsoft, Venomous Bear per CrowdStrike, UAC-0194 per il CERT-UA. La sua infrastruttura storica, l’impianto Snake, è stata attribuita da CISA al Centro 16 dell’FSB, il servizio di sicurezza federale russo. Qui non si parla quindi di ransomware né di estorsione, ma di raccolta informativa di lungo periodo al servizio di un’agenzia statale, una qualifica che cambia il profilo di rischio e il perimetro dei potenziali bersagli.

Un impianto modulare costruito per restare nascosto

STOCKSTAY non è un singolo eseguibile, ma un ecosistema di componenti che dialogano tra loro tramite messaggi WM_COPYDATA
sul canale di inter-process communication di Windows. L’orchestratore (STOCKMARKET, internamente cor
) gestisce configurazione e tasking; un tunnel di rete proxy-aware (STOCKBROKER, internamente net
) isola tutto il traffico di comando e controllo dal resto dell’attività sull’host; un terzo modulo esegue i comandi ricevuti. A monte agisce un downloader, MARKETMAKER, che scarica i componenti, stabilisce persistenza tramite chiavi di registro e si maschera da MicrosoftUpdateOneDrive
per apparire legittimo.

La comunicazione con il server avviene su WebSocket sicuro, appoggiandosi alla libreria open source websocket-sharp
. Al primo avvio l’impianto genera una coppia di chiavi RSA a 4096 bit e un identificativo univoco di infezione, cifrando i dati in uscita prima dell’invio. Il file di configurazione si traveste da applicazione legittima per il monitoraggio dei mercati delle criptovalute, con descrizioni fasulle dei campi e URL di copertura, mentre i dati reali restano cifrati nei campi decoy.

GTIG ha inoltre individuato su GitHub un controller server-side in Python (basato su tornado) che gestisce l’interfaccia /ws
, spesso ospitato su piattaforme di hosting di terze parti come Render: l’impossibilità per il gestore della piattaforma di decifrare i messaggi in transito offusca la posizione dell’infrastruttura dedicata, un’architettura che ricorda quella multi-hop di KAZUAR.

Le funzioni offerte all’operatore sono quelle classiche dell’accesso remoto: enumerazione e prelievo di file per estensione (con archiviazione ZIP in memoria e base64 per l’esfiltrazione), cattura schermo, scrittura ed eliminazione di file e directory, esecuzione di comandi multipli. Nelle fasi avanzate, dopo la ricognizione, l’impianto viene configurato con environmental keying: gira solo su uno specifico host, utente o dominio, segno che a quel punto l’attaccante sa esattamente quale macchina sta colpendo, tipicamente grazie ad accessi già stabiliti con altri strumenti del gruppo come KAZUAR.

La sovrapposizione con KAZUAR e il nodo dei nomi cluster

GTIG colloca STOCKSTAY dentro l’arsenale di Turla evidenziando sovrapposizioni di codice e funzionali con KAZUAR, il toolkit analizzato da Microsoft a maggio: introdotto in STOCKSTAY ad aprile 2025, l’obfuscator K1MORPHER è stato poi osservato dal giugno 2025 anche nei campioni di KAZUAR, e GTIG legge l’evoluzione di STOCKSTAY come una tendenza a mimare le tecniche di offuscamento multi-classe di KAZUAR.

La stessa architettura a componenti separati per comunicazione, orchestrazione ed esecuzione richiama lo schema BRIDGE, KERNEL e WORKER già documentato in KAZUAR. Su queste basi GTIG valuta con confidenza moderata che STOCKSTAY e KAZUAR possano condividere, almeno in parte, lo stesso sviluppatore o team, con STOCKSTAY costruito a immagine di KAZUAR; l’attribuzione complessiva a Turla resta invece a confidenza alta.

È un buon promemoria operativo sul fronte attribuzione: i nomi dei cluster vanno sempre incrociati tra vendor, perché la stessa famiglia compare con etichette diverse, e ricostruire la genealogia di un toolkit incide direttamente sulle conseguenze, anche giuridiche, di un’attribuzione pubblica, come discusso nell’analisi sull’attribuzione degli attacchi cyber.

Le esche raccontano molto delle priorità del gruppo: ricorrono temi accademici e diplomatici, dai nomi di istituti universitari nei file RDP malevoli alla compromissione di una piattaforma di formazione a tema diplomatico, fino al product name DiplomacyEduAI
usato all’interno dei file MSI di installazione.

Perché interessa l’Italia

L’angolo italiano va riportato con la stessa cautela usata da GTIG. Campioni di sviluppo di STOCKSTAY sono stati identificati in Italia, Paesi Bassi, Polonia e Germania, anche se per la maggior parte delle infezioni precoci non è stato possibile confermare le vittime designate. Il caso più circostanziato risale al febbraio 2024: un file Copia.msi
, caricato su VirusTotal dall’Italia e mascherato da applicazione ILSpy, installava i componenti di STOCKSTAY e abilitava la persistenza via chiavi di registro. L’esca collegata richiamava il tema delle elezioni e l’organizzazione Circolo Degli Esteri, sodalizio legato al Ministero degli Affari Esteri e nato, secondo il sito ufficiale, per rappresentarlo.

Su questo punto il rapporto è netto e va riferito senza forzature: GTIG non valuta che l’attore stesse prendendo di mira le elezioni italiane, bensì che usasse esche a tema elettorale e diplomatico per colpire individui e organizzazioni italofone con interesse per gli affari esteri. La distinzione conta, perché trasforma la notizia da allarme su una presunta interferenza elettorale in ciò che davvero documenta: l’attenzione costante di un attore statale russo verso chi, in Italia, ruota attorno alla diplomazia e alla politica estera.

Cosa cambia per i difensori

Per chi opera nella pubblica amministrazione, nella difesa o in enti e organizzazioni con un mandato sugli affari internazionali, STOCKSTAY conferma alcune costanti su cui calibrare detection e threat hunting: persistenza via registro abbinata a un downloader che si finge aggiornamento Microsoft, traffico di comando e controllo incapsulato in WebSocket cifrati e instradabili via proxy aziendale, staging su piattaforme di hosting legittime per nascondere l’infrastruttura reale.

L’impiego di environmental keying nelle fasi finali indica inoltre che, quando l’impianto compare, l’avversario è già dentro: la finestra utile per intercettarlo si gioca a monte, sulle esche a tema accademico e diplomatico e sui file RDP recapitati via phishing. Il quadro si somma alla pressione di altri attori statali, come lo spionaggio cinese parallelo documentato negli stessi giorni, e ridisegna la superficie di rischio per l’intero comparto pubblico.

Condividi sui Social Network:

https://www.ictsecuritymagazine.com/notizie/stockstay-turla-backdoor-spionaggio/