Italian authorities have arrested two people who are said to have used malware to steal confidential data and military secrets from aerospace and defense company Leonardo SpA .
Leonardo is one of the largest companies in the sector, with 30% owned by the Italian Ministry of Finance. As a multinational company, it is headquartered in Italy but has a large presence in the United Kingdom and the United States.
Information leaked by Italian media outlets indicates that police have arrested a person (said to be a former employee of the company) for using USB keys to infect 94 workstations with a trojan called “cftmon.exe.” The trojan likely took its name from the legitimate Windows file located at C:\Windows\system32\ctfmon.exe, to make it more difficult to detect.
The malware is said to have been used for about two years, between 2015 and 2017, to steal and send data to a command and control server at “fujinama.altervista.org”.
This C2 server has been shut down by the Polizia di Stato. The message now displayed on the site is the following:
The stolen data included confidential accounting information, military secrets, and aircraft designs.
“ In total, 10 gigabytes of data were removed, i.e. around 100,000 files, related to administrative-accounting management, human resources, procurement and distribution of goods, as well as the design of civil and military aircraft components for the Italian and international market. Credentials giving access to personal information of Leonardo employees were also stolen ,” Italian media reported
The second person arrested by authorities was the head of Leonardo's Cyber Emergency Response Team (CERT), who was placed under house arrestfor misleading about the attack and obstructing the investigation.
Prosecutors say the security were unable to detect the malware.
Leonardo issued a statement, in which it said that the company had launched an investigation, after submitting a formal complaint to the court.
“With regard to the current measures adopted by the Naples judiciary, Leonardo announces that it is launching an investigation… The Company has offered maximum cooperation from the beginning and will continue to do so to allow investigators to clarify the incident,” Leonardo said, among other things.
Source: Bleeping Computer
