Cisco Talos observed an increase in loader activity being used to deliver various malware to systems located in various European countries. Jasper loader employs a multi-stage infection process that features several obfuscation techniques that make analysis more difficult. Most of the Jasper loader campaign activity that has been observed over the past few months has been targeting Italy. The threat actors distributing Jasper loader are leveraging a legitimate certified email service called Posta Elettronica Certificata (PEC) to distribute these emails. These emails purport to be notifications associated with the receipt of a “certified email” and contain an attached EML file.”]
Source: https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html