Researchers at the security firm Yoroi have discovered a False Flag Attack on Multi-Stage Delivery of Malware to Italian Organisations. The attack started from a well edited Italian language email (given to me from a colleague of mine, thank you Luca!) reaching out many Italian companies. The email had a weird attachment: ordine_065.js (it would be Order Form in English) which appeared quite malicious to me. By editing the.js attachment it becomes clear that it is not an order form but contrary it turns out to be a downloader. The IP address seems to be hosted by a telecommunication company who sells cloud services such as: dedicated servers.”]
Source: https://securityaffairs.co/wordpress/60104/malware/false-flag-attack-italy.html