Il bello del #Fediverso?

Se fossi rimasto sui social “classici” ora starei lì a consumarmi il pollice a forza di scrollare sul telefonino rincorrendo algoritmi impazziti e contenuti che non ho chiesto. Invece sono in pensione forzata, ho un sacco di tempo libero e me lo gioco molto meglio di così 😏

Nel Fediverso è tutto più rilassante. Ho i miei server, i log da spulciare con calma, le mie paranoie sane su sicurezza e backup e soprattutto la mia istanza #self-hosted #snowfan.it che posso aggiornare, sistemare e coccolare come e quando voglio. Non sono ospite a casa d’altri, sono a casa mia.

La cosa bella è che non vivo attaccato allo schermo. Ho il tempo per fare esercizio fisico ogni giorno, staccare, respirare e poi tornare a chiacchierare con gli amici sul Fediverso seguendo le loro storie e interagendo con loro senza la pressione di dover “performare” per un algoritmo.

Sì, amo il Fediverso. Qui posso scegliere il ritmo, le persone e gli strumenti. Tornare indietro nella bolgia che ho lasciato anni fa, fatta di notifiche tossiche, urla e rincorsa all’attenzione? No grazie. Io resto di qua tra log, toot e quiete digitale 🙏

IT threat evolution in Q3 2025. Mobile statistics
IT threat evolution in Q3 2025. Non-mobile statistics

The quarter at a glance

In the third quarter of 2025, we updated the methodology for calculating statistical indicators based on the Kaspersky Security Network. These changes affected all sections of the report except for the statistics on installation packages, which remained unchanged.

To illustrate the differences between the reporting periods, we have also recalculated data for the previous quarters. Consequently, these figures may significantly differ from the previously published ones. However, subsequent reports will employ this new methodology, enabling precise comparisons with the data presented in this post.

The Kaspersky Security Network (KSN) is a global network for analyzing anonymized threat information, voluntarily shared by users of Kaspersky solutions. The statistics in this report are based on KSN data unless explicitly stated otherwise.

The quarter in numbers

According to Kaspersky Security Network, in Q3 2025:

• 47 million attacks utilizing malware, adware, or unwanted mobile software were prevented.

• Trojans were the most widespread threat among mobile malware, encountered by 15.78% of all attacked users of Kaspersky solutions.
• More than 197,000 malicious installation packages were discovered, including:
  
  • 52,723 associated with mobile banking Trojans.
  • 1564 packages identified as mobile ransomware Trojans.

  
  

Quarterly highlights

The number of malware, adware, or unwanted software attacks on mobile devices, calculated according to the updated rules, totaled 3.47 million in the third quarter. This is slightly less than the 3.51 million attacks recorded in the previous reporting period.

Attacks on users of Kaspersky mobile solutions, Q2 2024 — Q3 2025 (download)

At the start of the quarter, a user complained to us about ads appearing in every browser on their smartphone. We conducted an investigation, discovering a new version of the BADBOX backdoor, preloaded on the device. This backdoor is a multi-level loader embedded in a malicious native library, librescache.so, which was loaded by the system framework. As a result, a copy of the Trojan infiltrated every process running on the device.

Another interesting finding was Trojan-Downloader.AndroidOS.Agent.no, which was embedded in mods for messaging and other apps. It downloaded Trojan-Clicker.AndroidOS.Agent.bl onto the device. The clicker received a URL from its server where an ad was being displayed, opened it in an invisible WebView window, and used machine learning algorithms to find and click the close button. In this way, fraudsters exploited the user’s device to artificially inflate ad views.

Mobile threat statistics

In the third quarter, Kaspersky security solutions detected 197,738 samples of malicious and unwanted software for Android, which is 55,000 more than in the previous reporting period.

Detected malicious and potentially unwanted installation packages, Q3 2024 — Q3 2025 (download)

The detected installation packages were distributed by type as follows:

Detected mobile apps by type, Q2* — Q3 2025 (download)

* Changes in the statistical calculation methodology do not affect this metric. However, data for the previous quarter may differ slightly from previously published figures due to a retrospective review of certain verdicts.

The share of banking Trojans decreased somewhat, but this was due less to a reduction in their numbers and more to an increase in other malicious and unwanted packages. Nevertheless, banking Trojans, still dominated by Mamont packages, continue to hold the top spot. The rise in Trojan droppers is also linked to them: these droppers are primarily designed to deliver banking Trojans.

Share* of users attacked by the given type of malicious or potentially unwanted app out of all targeted users of Kaspersky mobile products, Q2 — Q3 2025 (download)

* The total may exceed 100% if the same users experienced multiple attack types.

Adware leads the pack in terms of the number of users attacked, with a significant margin. The most widespread types of adware are HiddenAd (56.3%) and MobiDash (27.4%). RiskTool-type unwanted apps occupy the second spot. Their growth is primarily due to the proliferation of the Revpn module, which monetizes user internet access by turning their device into a VPN exit point. The most popular Trojans predictably remain Triada (55.8%) and Fakemoney (24.6%). The percentage of users who encountered these did not undergo significant changes.

TOP 20 most frequently detected types of mobile malware

Note that the malware rankings below exclude riskware and potentially unwanted software, such as RiskTool or adware.

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The top positions in the list of the most widespread malware are once again occupied by modified messaging apps Triada.ii, Triada.fe, Triada.gn, and others. The pre-installed backdoor Triada.z ranked fifth, immediately following Fakemoney – fake apps that collect users’ personal data under the guise of providing payments or financial services. The dropper that landed in ninth place, Agent.gen, is an obfuscated ELF file linked to the banking Trojan Coper.c, which sits immediately after DangerousObject.Multi.Generic.

Region-specific malware

In this section, we describe malware that primarily targets users in specific countries.

* The country where the malware was most active.
** Unique users who encountered this Trojan modification in the indicated country as a percentage of all Kaspersky mobile security solution users attacked by the same modification.

Banking Trojans, primarily Coper, continue to operate actively in Turkey. Indian users also attract threat actors distributing this type of software. Specifically, the banker Rewardsteal is active in the country. Teledoor backdoors, embedded in a fake Telegram client, have been deployed in Iran.
Notable is the surge in Rkor ransomware Trojan attacks in Germany. The activity was significantly lower in previous quarters. It appears the fraudsters have found a new channel for delivering malicious apps to users.

Mobile banking Trojans

In the third quarter of 2025, 52,723 installation packages for mobile banking Trojans were detected, 10,000 more than in the second quarter.

Installation packages for mobile banking Trojans detected by Kaspersky, Q3 2024 — Q3 2025 (download)

The share of the Mamont Trojan among all bankers slightly increased again, reaching 61.85%. However, in terms of the share of attacked users, Coper moved into first place, with the same modification being used in most of its attacks. Variants of Mamont ranked second and lower, as different samples were used in different attacks. Nevertheless, the total number of users attacked by the Mamont family is greater than that of users attacked by Coper.

TOP 10 mobile bankers

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats.

Mobile ransomware Trojans

Due to the increased activity of mobile ransomware Trojans in Germany, which we mentioned in the Region-specific malware section, we have decided to also present statistics on this type of threat. In the third quarter, the number of ransomware Trojan installation packages more than doubled, reaching 1564.

* Unique users who encountered the malware as a percentage of all Kaspersky mobile security solution users attacked by ransomware Trojans.

securelist.com/malware-report-…

Charge NiMH Batteries with Style, Panache and an RP2040

The increasing dominance of lithium cells in the market place leave our trusty NiMH cells in a rough spot. Sure, you can still get a chargers for the AAs in your life, but it’s old tech and not particularly stylish. That’s where [Maximilian Kern] comes in, whose SPINC project was recently featured in IEEE Spectrum— so you know it has to be good.

With the high-resolution LED, the styling of this device reminds us a little bit of the Pi-Mac-Nano— and anything that makes you think of a classic Macintosh gets automatic style points. There’s something reminiscent of an ammunition clip in the way batteries are fed into the top and let out the bottom of the machine.

[Maximilian] thought of the, ah, less-detail-oriented amongst us with this one, as the dedicated charging IC he chose (why reinvent the wheel?) is connected to an H-bridge to allow the charger to be agnostic as to orientation. That’s a nice touch. An internal servo grabs each battery in turn to stick into the charging circuit, and deposits it into the bottom of the device once it is charged. The LCD screen lets you monitor the status of the battery as it charges, while doubling as a handy desk clock (that’s where the RP2040 comes in). It is, of course, powered by USB-C-PD as all things are these days. Fast-charging upto 1A is enabled, but you might want to go slower to keep your cells lasting as long as possible. Firmware, gerbers and STLs are available on GitHub under a GPL-3.0 license– so if you’re still using NiCads or want to bring this design into the glorious lithium future, you can consider yourself welcome to.

We recently featured a AA rundown, and for now, it looks like NiMH is still the best bang for your buck, which means this project will remain relevant for a few years yet. Of course, we didn’t expect the IEEE to steer us wrong.

Thanks to [George Graves] for the tip.

hackaday.com/2025/11/19/charge…

La polizia olandese smantella servizio di hosting ‘a prova di bomba’ per cybercriminali

La polizia olandese ha riferito di aver condotto un’operazione su larga scala contro un servizio di hosting “a prova di bomba” non meglio identificato, confiscando circa 250 server fisici nei data center dell’Aia e di Zoetermeer.

Migliaia di server virtuali sono stati successivamente disattivati. I media ritengono che si tratti di hosting CrazyRDP. Le forze dell’ordine non hanno rivelato il nome del servizio, ma è operativo dal 2022 ed è stato coinvolto in oltre 80 indagini sulla criminalità informatica, sia nei Paesi Bassi che all’estero.

Secondo gli investigatori, la società di hosting offriva ai propri clienti l’anonimato e garantiva la non collaborazione con la polizia. Le sue risorse ospitavano ransomware, botnet, campagne di phishing e persino contenuti relativi ad abusi sessuali su minori.

Gli investigatori stanno attualmente conducendo un’analisi forense delle apparecchiature sequestrate per identificare gli operatori e i clienti del servizio.

Questo servizio offriva ai clienti servizi VPS e RDP senza KYC o registri, e la registrazione richiedeva solo nome utente e password. La pubblicazione sottolinea che veniva spesso raccomandato come affidabile sul darknet.

Il 12 novembre, tutti i post sul canale Telegram ufficiale di CrazyRDP sono stati cancellati e gli iscritti sono stati reindirizzati a un nuovo canale che discuteva dell’improvvisa chiusura del servizio. I clienti hanno segnalato che alcuni di loro avevano oltre 30 server ospitati sulla piattaforma.

Molti hanno sospettato un exit scam: il supporto tecnico di CrazyRDP ha inizialmente segnalato problemi al data center, ma poi ha semplicemente smesso di rispondere.

L'articolo La polizia olandese smantella servizio di hosting ‘a prova di bomba’ per cybercriminali proviene da Red Hot Cyber.

#Poland closes #Russia consulate in Gdańsk in response to the railway sabotage

“In this regard, while this will not be our full response, I have decided to withdraw my consent for the operation of the last [Russian] consulate in Gdańsk,” Sikorski stated. He also noted that an official note would be sent to the Russian government within the next few hours.

united24media.com/latest-news/…

In my opinion, this specific response hints that Russian diplomatic personnel and diplomatic bags - legally protected - might have been used to facilitate the attack.

You likely won’t find it in English, but if you’re seriously into Russian and Soviet relations I very much recommend book “Zdrada Sowietów. Pamiętniki dyplomaty sowieckiego” by G.Z. Biesiedowski published in Polish 1989, but I now see the original was published in Russian:

archive.org/details/B-001-004-…

Besedovski, a Soviet diplomat in Warsaw who defected to France, described in great detail the sabotage operations the Soviet Russia conducted in 1930’s Poland.

Many* years ago (approximately 27 in fact), when I was a Unix sysadmin at BHP-IT in Newcastle, we had one of our periodic "blame the network" events where suddenly all our systems went offline.

I, and another Unix sysadmin bolted to the network team's office to let them know there was a significant outage.

And so did admins from the NT team.

And so did admins from the VMS team.

And so did admins from the Tandem team.

And then, admins from the Mainframe team arrived.

***OH SHIT***

So we all piled downstairs to see the emergency lights on in the datacentre, and a very sheepish looking $telco engineer being escorted from the next-door operations centre from one of the senior operators.

And that was the moment it dawned on folks that having an unshielded "Emergency Stop" button right next to the "Open Door" button, both the same colour, was perhaps not the best of ideas. Particularly when neither were labelled.

It was also my first lesson that causes for major outages don't have to be highly esoteric or technical. The simple fact is that so many outages are caused by sheer mundanity. The mundanity of some bean counter refusing to pay for a small perspex cover. The mundanity of leaving a human – subject to human error – being left in the wrong place unattended. The mundanity of not putting labels on buttons.

✍️ (Riflessioni nate dal confronto, dall'ascolto e condivisione, di una personale esperienza.)
Il cancro non distrugge solo un corpo: travolge, sconvolge e coinvolge un’intera famiglia. E tutto cambia, arriva un terremoto inatteso,
Crollano muri, difese, certezze, rapporti, si aprono voragini, si inciampa , si cade, ma poi ci si rialza! Ogni terremoto è diverso, cambia l'intensità, la pericolosità, stessa cosa per questo amico, nemico, apparentemente invisibile, ma pericoloso, può essere benevolo, cattivo o estremamente cattivo! E allora che si fa? Si ricomincia tutto da capo, inizia una nuova vita, bisogna ricostruire se stessi, mura, difese, rapporti, certezze, fiducia, è un lavoro pesante, ma va fatto, bisogna impegnarsi, farsi forza, saper chiedere aiuto e dare la possibilità a chi ci è accanto di poterlo fare, perché questo terremoto purtroppo colpisce e distrugge tutto ciò che trova nel suo cammino!

Non ho timore a dirlo, ma solo la parola mi fa ancora paura, ho difficoltà a pronunciarla, non perché io non abbia ormai accettato la situazione, il percorso, semplicemente perché quando le vivi in prima persona, tutto è più reale quindi si ha più paura, perché si è da soli a combattere , nel senso che indipendentemente dalle terapie, percorsi, dalla gravità, ecc , bisogna fare i conti con se' stessi, bisogna ascoltarsi e darsi tempo, tutto quello che serve, senza avere fretta di guarire, perché non siamo noi a decidere nulla, il terremoto è in agguato, sotto controllo, ma non siamo totalmente al sicuro! Perché chi
entra nella vita impetuosamente, senza chiedere permesso, stanca, ferisce, mette in ginocchio all'improvviso e non è che uno nasce già pronto ad affrontare, superare e sopravvivere ad un terremoto. Non si può avere la presunzione di comprendere a priori, chi lotta e chi assiste, chi è vicino, chi vorrebbe farlo e non può e chi invece potrebbe e dovrebbe e non lo fa deliberatamente...Io stessa mi sono trovata in diverse situazioni, ho avuto in famiglia già questo terremoto, ma quando è capitato a me , ovviamente la musica è cambiata e li poi non ci sono regole, consigli o manuali che tengano!
Chi poi diventa un malato, combatte contro un dolore che non dà tregua, non solo nel fisico, ma anche nell'anima...spesso e ripeto parlo per esperienza, non per verità assoluta, la famiglia , amici, conoscenti, a volte vivono l’impotenza, l'incapacità, di non essere in grado di aiutare, di sostenere, di reagire e agire in risposta ad una situazione di un' entità dalle proporzioni sconosciute!..Con il rischio, la consapevolezza o la paura di non riuscire nell'impresa, lasciando che il cuore si spezzi giorno per giorno..
Perciò ad un anno da questo terremoto personale, sto imparando, sto cambiando, sto inevitabilmente accettando e constatando che non possiamo pretendere nulla, non vogliamo essere diversi, non vogliamo nasconderci o vergognarci per come lo abbiamo affrontato, per come lo stiamo affrontando!
Chi convive con questo terremoto, chi lo vive, affronta, chi lo accompagna, chi in qualche modo lo subisce, ne subisce i risvolti, le debolezze, le ferite e le fragilità, conosce e riconosce ancora di più ogni singola sfumatura, grandezza, importanza di ogni giorno, di ogni attimo vissuto , di ogni goccia di quella forza che può dare l’amore, la speranza , la vicinanza, un sorriso, un abbraccio o semplicemente un rispettoso silenzio!